SlideShare a Scribd company logo

Healthcare/HIPAA Cybersecurity best practices

•Download as PPTX, PDF•
•
Jack Shaffer
Jack Shaffer

My presentation at the TechConnect Coding and Cybersecurity Summit: http://techconnectwv.org/events/2018-coding-cyber-summit/

1 of 11
Healthcare/HIPAA Cybersecurity best practices Jack L. Shaffer, Jr. Business Transformation Director vCIO / vCISO
“The Scary Slide” HIMSS 2018 Cybersecurity Survey Protenus Breach Barometer Health IT News
So what’s going on?? Insider Threats! E-mail! Avg. 308 days to discover the breach! 1,037 days to contain! HIMSS 2018 Cybersecurity Survey Protenus Breach Barometer Report Global statistics in the most recent Ponemon report on the cost of a data breach show dwell time for malicious attacks has stretched to an average of 229 days. As most IT pros know, dwell time is the period between when a malicious attack enters your network and when it is discovered. The average amount of time it took organizations in the sample to contain a data breach was 69 days. In healthcare, organizations took an average of 1,037 days to contain a data breach. Ponemon Institute 2018. Avg. number of days from breach to discovery - 2017 Protenus Breach Barometer Report
For Healthcare Entities - HIPAA points to NIST for best security practices https://www.nist.gov/cyberframework
HIPAA Security Rule can map to NIST CSF 164.308(a)(1) 164.308(a)(2) 164.308(a)(8) 164.308(b)(1) 164.310(d)(1) 164.314(a)(2) 164.314(b)(1) 164.316.a 164.316.b.1 164.316.b.2.i 164.308(a)(3) 164.308(a)(4) 164.308(a)(5) 164.310(a)(1) 164.310(b) 164.310(c) 164.310(d)(1) 164.312(a)(1) 164.312(d) 164.312(e)(1) 164.312(e)(2)(i) 164.312(e)(2)(ii) 164.308(a)(5) 164.312.(b) 164.312(c)(1) 164.312(c)(2) 164.308(a)(6) 164.308(a)(7) 164.312(a)(1) 164.308(a)(7) 164.310(a)(1) HIPAA Security Rule CFR’s
Where is Healthcare still falling short? • Not Performing Thorough Risk Assessments • Focusing on wrong risks • Focusing on wrong assets • Not detecting network activity • High “Dwell time” • Insider threats not discovered • Lack of response planning • Long Avg. days to respond and contain . Healthcare’s Focus is Here – on Protect
What should they be doing?  Create a Cybersecurity Framework and process based on NIST CSF  Train personnel on cybersecurity awareness Continuously!  Conduct a true security risk assessment NOT a checklist! Focus on ePHI assets  Asset inventory with technical details You can’t protect what you don’t know about!
…..and more… Implement a Security Operations Center Either in-house or as a service Need “eyes on glass” to monitor the network Develop incident response plans BEFORE the incident! Implement next generation endpoint protection Detect and Respond to threats proactively
Thank you!
advantage.tech/expert

Recommended

Build a Security Portfolio That Strengthens Your Security Posture
Build a Security Portfolio That Strengthens Your Security PostureBuild a Security Portfolio That Strengthens Your Security Posture
Build a Security Portfolio That Strengthens Your Security Posture
Splunk
 
Threat Hunting Workshop
Threat Hunting WorkshopThreat Hunting Workshop
Threat Hunting Workshop
Splunk
 
Threat Hunting with Deceptive Defense and Splunk Enterprise Security
Threat Hunting with Deceptive Defense and Splunk Enterprise SecurityThreat Hunting with Deceptive Defense and Splunk Enterprise Security
Threat Hunting with Deceptive Defense and Splunk Enterprise Security
Satnam Singh
 
.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition
.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition
.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition
Splunk
 
Wie Sie Ransomware aufspüren und was Sie dagegen machen können
Wie Sie Ransomware aufspüren und was Sie dagegen machen könnenWie Sie Ransomware aufspüren und was Sie dagegen machen können
Wie Sie Ransomware aufspüren und was Sie dagegen machen können
Splunk
 
Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2
Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2
Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2
Splunk
 
SplunkLive! Stockholm 2015 breakout - Analytics based security
SplunkLive! Stockholm 2015 breakout - Analytics based securitySplunkLive! Stockholm 2015 breakout - Analytics based security
SplunkLive! Stockholm 2015 breakout - Analytics based security
Splunk
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM Workshop
Splunk
 

Recommended

Build a Security Portfolio That Strengthens Your Security Posture
Build a Security Portfolio That Strengthens Your Security PostureBuild a Security Portfolio That Strengthens Your Security Posture
Build a Security Portfolio That Strengthens Your Security Posture
Splunk
 
Threat Hunting Workshop
Threat Hunting WorkshopThreat Hunting Workshop
Threat Hunting Workshop
Splunk
 
Threat Hunting with Deceptive Defense and Splunk Enterprise Security
Threat Hunting with Deceptive Defense and Splunk Enterprise SecurityThreat Hunting with Deceptive Defense and Splunk Enterprise Security
Threat Hunting with Deceptive Defense and Splunk Enterprise Security
Satnam Singh
 
.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition
.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition
.conf2016: Splunking the Endpoint: “Hands on!” Ransomware Edition
Splunk
 
Wie Sie Ransomware aufspüren und was Sie dagegen machen können
Wie Sie Ransomware aufspüren und was Sie dagegen machen könnenWie Sie Ransomware aufspüren und was Sie dagegen machen können
Wie Sie Ransomware aufspüren und was Sie dagegen machen können
Splunk
 
Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2
Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2
Splunk GDPR Security Roundtable: Zurich - 22 Nov 2017 PT2
Splunk
 
SplunkLive! Stockholm 2015 breakout - Analytics based security
SplunkLive! Stockholm 2015 breakout - Analytics based securitySplunkLive! Stockholm 2015 breakout - Analytics based security
SplunkLive! Stockholm 2015 breakout - Analytics based security
Splunk
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM Workshop
Splunk
 
Splunk conf2014 - Operationalizing Advanced Threat Defense
Splunk conf2014 - Operationalizing Advanced Threat DefenseSplunk conf2014 - Operationalizing Advanced Threat Defense
Splunk conf2014 - Operationalizing Advanced Threat Defense
Splunk
 
Splunk at the Bank of England
Splunk at the Bank of EnglandSplunk at the Bank of England
Splunk at the Bank of England
Splunk
 
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
ThreatConnect
 
Threat Hunting with Splunk
Threat Hunting with Splunk Threat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Splunk Threat Hunting Workshop
Splunk Threat Hunting WorkshopSplunk Threat Hunting Workshop
Splunk Threat Hunting Workshop
Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Republic Services Customer Presentation
Republic Services Customer PresentationRepublic Services Customer Presentation
Republic Services Customer Presentation
Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Splunk Enterprise for Information Security Hands-On Breakout Session
Splunk Enterprise for Information Security Hands-On Breakout SessionSplunk Enterprise for Information Security Hands-On Breakout Session
Splunk Enterprise for Information Security Hands-On Breakout Session
Splunk
 
SplunkLive! Utrecht - Splunk for Security - Monzy Merza
SplunkLive! Utrecht - Splunk for Security - Monzy MerzaSplunkLive! Utrecht - Splunk for Security - Monzy Merza
SplunkLive! Utrecht - Splunk for Security - Monzy Merza
Splunk
 
A Day in the Life of a GDPR Breach
A Day in the Life of a GDPR BreachA Day in the Life of a GDPR Breach
A Day in the Life of a GDPR Breach
Splunk
 
Splunk für Security
Splunk für SecuritySplunk für Security
Splunk für Security
Splunk
 
Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
Splunk live nyc_2017_sec_buildinganalyticsdrivensocSplunk live nyc_2017_sec_buildinganalyticsdrivensoc
Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
Rene Aguero
 
Nadog dev secops_survey
Nadog dev secops_surveyNadog dev secops_survey
Nadog dev secops_survey
Curtis Yanko
 
Learn how to use an Analytics-Driven SIEM for your Security Operations
Learn how to use an Analytics-Driven SIEM for your Security OperationsLearn how to use an Analytics-Driven SIEM for your Security Operations
Learn how to use an Analytics-Driven SIEM for your Security Operations
Splunk
 
Insider theft detection
Insider theft detection Insider theft detection
Insider theft detection
SumanthKommineni
 
Splunk workshop-Threat Hunting
Splunk workshop-Threat HuntingSplunk workshop-Threat Hunting
Splunk workshop-Threat Hunting
Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
Splunk Discovery Dusseldorf: September 2017 - Security Session
Splunk Discovery Dusseldorf: September 2017 - Security SessionSplunk Discovery Dusseldorf: September 2017 - Security Session
Splunk Discovery Dusseldorf: September 2017 - Security Session
Splunk
 
Are NIST standards clouding the implementation of HIPAA security risk assessm...
Are NIST standards clouding the implementation of HIPAA security risk assessm...Are NIST standards clouding the implementation of HIPAA security risk assessm...
Are NIST standards clouding the implementation of HIPAA security risk assessm...
David Sweigert
 
July 2010 Cover Story
July 2010 Cover StoryJuly 2010 Cover Story
July 2010 Cover Story
Patrick Spencer
 

More Related Content

What's hot

Splunk conf2014 - Operationalizing Advanced Threat Defense
Splunk conf2014 - Operationalizing Advanced Threat DefenseSplunk conf2014 - Operationalizing Advanced Threat Defense
Splunk conf2014 - Operationalizing Advanced Threat Defense
Splunk
 
Splunk at the Bank of England
Splunk at the Bank of EnglandSplunk at the Bank of England
Splunk at the Bank of England
Splunk
 
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
ThreatConnect
 
Threat Hunting with Splunk
Threat Hunting with Splunk Threat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Splunk Threat Hunting Workshop
Splunk Threat Hunting WorkshopSplunk Threat Hunting Workshop
Splunk Threat Hunting Workshop
Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Republic Services Customer Presentation
Republic Services Customer PresentationRepublic Services Customer Presentation
Republic Services Customer Presentation
Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Splunk Enterprise for Information Security Hands-On Breakout Session
Splunk Enterprise for Information Security Hands-On Breakout SessionSplunk Enterprise for Information Security Hands-On Breakout Session
Splunk Enterprise for Information Security Hands-On Breakout Session
Splunk
 
SplunkLive! Utrecht - Splunk for Security - Monzy Merza
SplunkLive! Utrecht - Splunk for Security - Monzy MerzaSplunkLive! Utrecht - Splunk for Security - Monzy Merza
SplunkLive! Utrecht - Splunk for Security - Monzy Merza
Splunk
 
A Day in the Life of a GDPR Breach
A Day in the Life of a GDPR BreachA Day in the Life of a GDPR Breach
A Day in the Life of a GDPR Breach
Splunk
 
Splunk für Security
Splunk für SecuritySplunk für Security
Splunk für Security
Splunk
 
Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
Splunk live nyc_2017_sec_buildinganalyticsdrivensocSplunk live nyc_2017_sec_buildinganalyticsdrivensoc
Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
Rene Aguero
 
Nadog dev secops_survey
Nadog dev secops_surveyNadog dev secops_survey
Nadog dev secops_survey
Curtis Yanko
 
Learn how to use an Analytics-Driven SIEM for your Security Operations
Learn how to use an Analytics-Driven SIEM for your Security OperationsLearn how to use an Analytics-Driven SIEM for your Security Operations
Learn how to use an Analytics-Driven SIEM for your Security Operations
Splunk
 
Insider theft detection
Insider theft detection Insider theft detection
Insider theft detection
SumanthKommineni
 
Splunk workshop-Threat Hunting
Splunk workshop-Threat HuntingSplunk workshop-Threat Hunting
Splunk workshop-Threat Hunting
Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
Splunk Discovery Dusseldorf: September 2017 - Security Session
Splunk Discovery Dusseldorf: September 2017 - Security SessionSplunk Discovery Dusseldorf: September 2017 - Security Session
Splunk Discovery Dusseldorf: September 2017 - Security Session
Splunk
 

What's hot (20)

Splunk conf2014 - Operationalizing Advanced Threat Defense
Splunk conf2014 - Operationalizing Advanced Threat DefenseSplunk conf2014 - Operationalizing Advanced Threat Defense
Splunk conf2014 - Operationalizing Advanced Threat Defense
 
Splunk at the Bank of England
Splunk at the Bank of EnglandSplunk at the Bank of England
Splunk at the Bank of England
 
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
 
Threat Hunting with Splunk
Threat Hunting with Splunk Threat Hunting with Splunk
Threat Hunting with Splunk
 
Splunk Threat Hunting Workshop
Splunk Threat Hunting WorkshopSplunk Threat Hunting Workshop
Splunk Threat Hunting Workshop
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Republic Services Customer Presentation
Republic Services Customer PresentationRepublic Services Customer Presentation
Republic Services Customer Presentation
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Splunk Enterprise for Information Security Hands-On Breakout Session
Splunk Enterprise for Information Security Hands-On Breakout SessionSplunk Enterprise for Information Security Hands-On Breakout Session
Splunk Enterprise for Information Security Hands-On Breakout Session
 
SplunkLive! Utrecht - Splunk for Security - Monzy Merza
SplunkLive! Utrecht - Splunk for Security - Monzy MerzaSplunkLive! Utrecht - Splunk for Security - Monzy Merza
SplunkLive! Utrecht - Splunk for Security - Monzy Merza
 
A Day in the Life of a GDPR Breach
A Day in the Life of a GDPR BreachA Day in the Life of a GDPR Breach
A Day in the Life of a GDPR Breach
 
Splunk für Security
Splunk für SecuritySplunk für Security
Splunk für Security
 
Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
Splunk live nyc_2017_sec_buildinganalyticsdrivensocSplunk live nyc_2017_sec_buildinganalyticsdrivensoc
Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
 
Nadog dev secops_survey
Nadog dev secops_surveyNadog dev secops_survey
Nadog dev secops_survey
 
Learn how to use an Analytics-Driven SIEM for your Security Operations
Learn how to use an Analytics-Driven SIEM for your Security OperationsLearn how to use an Analytics-Driven SIEM for your Security Operations
Learn how to use an Analytics-Driven SIEM for your Security Operations
 
Insider theft detection
Insider theft detection Insider theft detection
Insider theft detection
 
Splunk workshop-Threat Hunting
Splunk workshop-Threat HuntingSplunk workshop-Threat Hunting
Splunk workshop-Threat Hunting
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics
 
Splunk Discovery Dusseldorf: September 2017 - Security Session
Splunk Discovery Dusseldorf: September 2017 - Security SessionSplunk Discovery Dusseldorf: September 2017 - Security Session
Splunk Discovery Dusseldorf: September 2017 - Security Session
 

Similar to Healthcare/HIPAA Cybersecurity best practices

Are NIST standards clouding the implementation of HIPAA security risk assessm...
Are NIST standards clouding the implementation of HIPAA security risk assessm...Are NIST standards clouding the implementation of HIPAA security risk assessm...
Are NIST standards clouding the implementation of HIPAA security risk assessm...
David Sweigert
 
July 2010 Cover Story
July 2010 Cover StoryJuly 2010 Cover Story
July 2010 Cover Story
Patrick Spencer
 
Csec 610 Inspiring Innovation--tutorialrank.com
Csec 610 Inspiring Innovation--tutorialrank.comCsec 610 Inspiring Innovation--tutorialrank.com
Csec 610 Inspiring Innovation--tutorialrank.com
PrescottLunt384
 
IRJET-Ethical Hacking
IRJET-Ethical HackingIRJET-Ethical Hacking
IRJET-Ethical Hacking
IRJET Journal
 
What Is Security Risk Analysis? By: MedSafe
What Is Security Risk Analysis? By: MedSafeWhat Is Security Risk Analysis? By: MedSafe
What Is Security Risk Analysis? By: MedSafe
MedSafe
 
Computer Forensics in the Age of Compliance
Computer Forensics in the Age of ComplianceComputer Forensics in the Age of Compliance
Computer Forensics in the Age of Compliance
Anton Chuvakin
 
Csec 610 Motivated Minds/newtonhelp.com
Csec 610 Motivated Minds/newtonhelp.comCsec 610 Motivated Minds/newtonhelp.com
Csec 610 Motivated Minds/newtonhelp.com
amaranthbeg52
 
Csec 610 Extraordinary Success/newtonhelp.com
Csec 610 Extraordinary Success/newtonhelp.comCsec 610 Extraordinary Success/newtonhelp.com
Csec 610 Extraordinary Success/newtonhelp.com
amaranthbeg112
 
Csec 610 Education is Power/newtonhelp.com
Csec 610 Education is Power/newtonhelp.comCsec 610 Education is Power/newtonhelp.com
Csec 610 Education is Power/newtonhelp.com
amaranthbeg72
 
Csec 610 Your world/newtonhelp.com
Csec 610 Your world/newtonhelp.comCsec 610 Your world/newtonhelp.com
Csec 610 Your world/newtonhelp.com
amaranthbeg92
 
The IT Analysis Paralysis
The IT Analysis Paralysis The IT Analysis Paralysis
The IT Analysis Paralysis
PYA, P.C.
 
Health Insurance Portability and Accountability Act (HIPAA) Compliance
Health Insurance Portability and Accountability Act (HIPAA) ComplianceHealth Insurance Portability and Accountability Act (HIPAA) Compliance
Health Insurance Portability and Accountability Act (HIPAA) Compliance
ControlCase
 
Cst 610 Your world/newtonhelp.com
Cst 610 Your world/newtonhelp.comCst 610 Your world/newtonhelp.com
Cst 610 Your world/newtonhelp.com
amaranthbeg93
 
Cst 610 Motivated Minds/newtonhelp.com
Cst 610 Motivated Minds/newtonhelp.comCst 610 Motivated Minds/newtonhelp.com
Cst 610 Motivated Minds/newtonhelp.com
amaranthbeg53
 
Cst 610 Education is Power/newtonhelp.com
Cst 610 Education is Power/newtonhelp.comCst 610 Education is Power/newtonhelp.com
Cst 610 Education is Power/newtonhelp.com
amaranthbeg73
 
Cyb 610 Enhance teaching / snaptutorial.com
Cyb 610 Enhance teaching / snaptutorial.comCyb 610 Enhance teaching / snaptutorial.com
Cyb 610 Enhance teaching / snaptutorial.com
Baileyaby
 
CST 610 RANK Redefined Education--cst610rank.com
CST 610 RANK Redefined Education--cst610rank.comCST 610 RANK Redefined Education--cst610rank.com
CST 610 RANK Redefined Education--cst610rank.com
claric240
 
Cst 610 Enhance teaching / snaptutorial.com
Cst 610 Enhance teaching / snaptutorial.comCst 610 Enhance teaching / snaptutorial.com
Cst 610 Enhance teaching / snaptutorial.com
Baileyabw
 
MUSE 2015 Product Showcase v2
MUSE 2015 Product Showcase v2MUSE 2015 Product Showcase v2
MUSE 2015 Product Showcase v2
Chris Baldwin
 
Computer Security Incident Handling Guide Recommendati.docx
Computer Security Incident Handling Guide Recommendati.docxComputer Security Incident Handling Guide Recommendati.docx
Computer Security Incident Handling Guide Recommendati.docx
patricke8
 

Similar to Healthcare/HIPAA Cybersecurity best practices (20)

Are NIST standards clouding the implementation of HIPAA security risk assessm...
Are NIST standards clouding the implementation of HIPAA security risk assessm...Are NIST standards clouding the implementation of HIPAA security risk assessm...
Are NIST standards clouding the implementation of HIPAA security risk assessm...
 
July 2010 Cover Story
July 2010 Cover StoryJuly 2010 Cover Story
July 2010 Cover Story
 
Csec 610 Inspiring Innovation--tutorialrank.com
Csec 610 Inspiring Innovation--tutorialrank.comCsec 610 Inspiring Innovation--tutorialrank.com
Csec 610 Inspiring Innovation--tutorialrank.com
 
IRJET-Ethical Hacking
IRJET-Ethical HackingIRJET-Ethical Hacking
IRJET-Ethical Hacking
 
What Is Security Risk Analysis? By: MedSafe
What Is Security Risk Analysis? By: MedSafeWhat Is Security Risk Analysis? By: MedSafe
What Is Security Risk Analysis? By: MedSafe
 
Computer Forensics in the Age of Compliance
Computer Forensics in the Age of ComplianceComputer Forensics in the Age of Compliance
Computer Forensics in the Age of Compliance
 
Csec 610 Motivated Minds/newtonhelp.com
Csec 610 Motivated Minds/newtonhelp.comCsec 610 Motivated Minds/newtonhelp.com
Csec 610 Motivated Minds/newtonhelp.com
 
Csec 610 Extraordinary Success/newtonhelp.com
Csec 610 Extraordinary Success/newtonhelp.comCsec 610 Extraordinary Success/newtonhelp.com
Csec 610 Extraordinary Success/newtonhelp.com
 
Csec 610 Education is Power/newtonhelp.com
Csec 610 Education is Power/newtonhelp.comCsec 610 Education is Power/newtonhelp.com
Csec 610 Education is Power/newtonhelp.com
 
Csec 610 Your world/newtonhelp.com
Csec 610 Your world/newtonhelp.comCsec 610 Your world/newtonhelp.com
Csec 610 Your world/newtonhelp.com
 
The IT Analysis Paralysis
The IT Analysis Paralysis The IT Analysis Paralysis
The IT Analysis Paralysis
 
Health Insurance Portability and Accountability Act (HIPAA) Compliance
Health Insurance Portability and Accountability Act (HIPAA) ComplianceHealth Insurance Portability and Accountability Act (HIPAA) Compliance
Health Insurance Portability and Accountability Act (HIPAA) Compliance
 
Cst 610 Your world/newtonhelp.com
Cst 610 Your world/newtonhelp.comCst 610 Your world/newtonhelp.com
Cst 610 Your world/newtonhelp.com
 
Cst 610 Motivated Minds/newtonhelp.com
Cst 610 Motivated Minds/newtonhelp.comCst 610 Motivated Minds/newtonhelp.com
Cst 610 Motivated Minds/newtonhelp.com
 
Cst 610 Education is Power/newtonhelp.com
Cst 610 Education is Power/newtonhelp.comCst 610 Education is Power/newtonhelp.com
Cst 610 Education is Power/newtonhelp.com
 
Cyb 610 Enhance teaching / snaptutorial.com
Cyb 610 Enhance teaching / snaptutorial.comCyb 610 Enhance teaching / snaptutorial.com
Cyb 610 Enhance teaching / snaptutorial.com
 
CST 610 RANK Redefined Education--cst610rank.com
CST 610 RANK Redefined Education--cst610rank.comCST 610 RANK Redefined Education--cst610rank.com
CST 610 RANK Redefined Education--cst610rank.com
 
Cst 610 Enhance teaching / snaptutorial.com
Cst 610 Enhance teaching / snaptutorial.comCst 610 Enhance teaching / snaptutorial.com
Cst 610 Enhance teaching / snaptutorial.com
 
MUSE 2015 Product Showcase v2
MUSE 2015 Product Showcase v2MUSE 2015 Product Showcase v2
MUSE 2015 Product Showcase v2
 
Computer Security Incident Handling Guide Recommendati.docx
Computer Security Incident Handling Guide Recommendati.docxComputer Security Incident Handling Guide Recommendati.docx
Computer Security Incident Handling Guide Recommendati.docx
 

More from Jack Shaffer

Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Jack Shaffer
 
Advantage wvde containerization - june 2018
Advantage wvde containerization - june 2018Advantage wvde containerization - june 2018
Advantage wvde containerization - june 2018
Jack Shaffer
 
Cybersecurity Presentation at WVONGA spring meeting 2018
Cybersecurity Presentation at WVONGA spring meeting 2018Cybersecurity Presentation at WVONGA spring meeting 2018
Cybersecurity Presentation at WVONGA spring meeting 2018
Jack Shaffer
 
The obligatory EHR Implementation Lessons Learned presentation
The obligatory EHR Implementation Lessons Learned presentationThe obligatory EHR Implementation Lessons Learned presentation
The obligatory EHR Implementation Lessons Learned presentation
Jack Shaffer
 
HealtheMountaineer PHR presentation to WorldVistA
HealtheMountaineer PHR presentation to WorldVistAHealtheMountaineer PHR presentation to WorldVistA
HealtheMountaineer PHR presentation to WorldVistA
Jack Shaffer
 
Personal health record launched in Clay County, West Virginia
Personal health record launched in Clay County, West VirginiaPersonal health record launched in Clay County, West Virginia
Personal health record launched in Clay County, West Virginia
Jack Shaffer
 
Broadband presentation to WV Legislature
Broadband presentation to WV LegislatureBroadband presentation to WV Legislature
Broadband presentation to WV Legislature
Jack Shaffer
 
WV Telehealth Alliance presentation to USAC
WV Telehealth Alliance presentation to USACWV Telehealth Alliance presentation to USAC
WV Telehealth Alliance presentation to USAC
Jack Shaffer
 
Managing Gas Well Operations with hand held computing
Managing Gas Well Operations with hand held computingManaging Gas Well Operations with hand held computing
Managing Gas Well Operations with hand held computing
Jack Shaffer
 
Intermec Case Study - Columbia Natural Resources
Intermec Case Study - Columbia Natural ResourcesIntermec Case Study - Columbia Natural Resources
Intermec Case Study - Columbia Natural Resources
Jack Shaffer
 
Next gov.com VA EHR
Next gov.com VA EHRNext gov.com VA EHR
Next gov.com VA EHR
Jack Shaffer
 
Improving Patient Health Outcomes with an EHR whitepaper
Improving Patient Health Outcomes with an EHR whitepaperImproving Patient Health Outcomes with an EHR whitepaper
Improving Patient Health Outcomes with an EHR whitepaper
Jack Shaffer
 
mHealth and IHS RPMS-EHR Discussion
mHealth and IHS RPMS-EHR DiscussionmHealth and IHS RPMS-EHR Discussion
mHealth and IHS RPMS-EHR Discussion
Jack Shaffer
 
The W.Va. Experience with the IHS RPMS-EHR
The W.Va. Experience with the IHS RPMS-EHRThe W.Va. Experience with the IHS RPMS-EHR
The W.Va. Experience with the IHS RPMS-EHR
Jack Shaffer
 
WV transformation slide show may conference2
WV transformation slide show may conference2WV transformation slide show may conference2
WV transformation slide show may conference2
Jack Shaffer
 
Legislative presentation oct 16, 2006 final2
Legislative presentation oct 16, 2006 final2Legislative presentation oct 16, 2006 final2
Legislative presentation oct 16, 2006 final2
Jack Shaffer
 
Technologies and procedures for HIPAA compliance
Technologies and procedures for HIPAA complianceTechnologies and procedures for HIPAA compliance
Technologies and procedures for HIPAA compliance
Jack Shaffer
 
ARRA - RHITEC
ARRA - RHITECARRA - RHITEC
ARRA - RHITEC
Jack Shaffer
 
3G HIT
3G HIT3G HIT
3G HIT
Jack Shaffer
 
EMR 101
EMR 101EMR 101
EMR 101
Jack Shaffer
 

More from Jack Shaffer (20)

Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
 
Advantage wvde containerization - june 2018
Advantage wvde containerization - june 2018Advantage wvde containerization - june 2018
Advantage wvde containerization - june 2018
 
Cybersecurity Presentation at WVONGA spring meeting 2018
Cybersecurity Presentation at WVONGA spring meeting 2018Cybersecurity Presentation at WVONGA spring meeting 2018
Cybersecurity Presentation at WVONGA spring meeting 2018
 
The obligatory EHR Implementation Lessons Learned presentation
The obligatory EHR Implementation Lessons Learned presentationThe obligatory EHR Implementation Lessons Learned presentation
The obligatory EHR Implementation Lessons Learned presentation
 
HealtheMountaineer PHR presentation to WorldVistA
HealtheMountaineer PHR presentation to WorldVistAHealtheMountaineer PHR presentation to WorldVistA
HealtheMountaineer PHR presentation to WorldVistA
 
Personal health record launched in Clay County, West Virginia
Personal health record launched in Clay County, West VirginiaPersonal health record launched in Clay County, West Virginia
Personal health record launched in Clay County, West Virginia
 
Broadband presentation to WV Legislature
Broadband presentation to WV LegislatureBroadband presentation to WV Legislature
Broadband presentation to WV Legislature
 
WV Telehealth Alliance presentation to USAC
WV Telehealth Alliance presentation to USACWV Telehealth Alliance presentation to USAC
WV Telehealth Alliance presentation to USAC
 
Managing Gas Well Operations with hand held computing
Managing Gas Well Operations with hand held computingManaging Gas Well Operations with hand held computing
Managing Gas Well Operations with hand held computing
 
Intermec Case Study - Columbia Natural Resources
Intermec Case Study - Columbia Natural ResourcesIntermec Case Study - Columbia Natural Resources
Intermec Case Study - Columbia Natural Resources
 
Next gov.com VA EHR
Next gov.com VA EHRNext gov.com VA EHR
Next gov.com VA EHR
 
Improving Patient Health Outcomes with an EHR whitepaper
Improving Patient Health Outcomes with an EHR whitepaperImproving Patient Health Outcomes with an EHR whitepaper
Improving Patient Health Outcomes with an EHR whitepaper
 
mHealth and IHS RPMS-EHR Discussion
mHealth and IHS RPMS-EHR DiscussionmHealth and IHS RPMS-EHR Discussion
mHealth and IHS RPMS-EHR Discussion
 
The W.Va. Experience with the IHS RPMS-EHR
The W.Va. Experience with the IHS RPMS-EHRThe W.Va. Experience with the IHS RPMS-EHR
The W.Va. Experience with the IHS RPMS-EHR
 
WV transformation slide show may conference2
WV transformation slide show may conference2WV transformation slide show may conference2
WV transformation slide show may conference2
 
Legislative presentation oct 16, 2006 final2
Legislative presentation oct 16, 2006 final2Legislative presentation oct 16, 2006 final2
Legislative presentation oct 16, 2006 final2
 
Technologies and procedures for HIPAA compliance
Technologies and procedures for HIPAA complianceTechnologies and procedures for HIPAA compliance
Technologies and procedures for HIPAA compliance
 
ARRA - RHITEC
ARRA - RHITECARRA - RHITEC
ARRA - RHITEC
 
3G HIT
3G HIT3G HIT
3G HIT
 
EMR 101
EMR 101EMR 101
EMR 101
 

Recently uploaded

INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)
INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)
INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)
blessyjannu21
 
Bringing AI into a Mid-Sized Company: A structured Approach
Bringing AI into a Mid-Sized Company: A structured ApproachBringing AI into a Mid-Sized Company: A structured Approach
Bringing AI into a Mid-Sized Company: A structured Approach
Brian Frerichs
 
KEY Points of Leicester travel clinic In London doc.docx
KEY Points of Leicester travel clinic In London doc.docxKEY Points of Leicester travel clinic In London doc.docx
KEY Points of Leicester travel clinic In London doc.docx
NX Healthcare
 
Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...
Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...
Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...
The Lifesciences Magazine
 
PrudentRx's Function in the Management of Chronic Illnesses
PrudentRx's Function in the Management of Chronic IllnessesPrudentRx's Function in the Management of Chronic Illnesses
PrudentRx's Function in the Management of Chronic Illnesses
PrudentRx Program
 
Empowering ACOs: Leveraging Quality Management Tools for MIPS and Beyond
Empowering ACOs: Leveraging Quality Management Tools for MIPS and BeyondEmpowering ACOs: Leveraging Quality Management Tools for MIPS and Beyond
Empowering ACOs: Leveraging Quality Management Tools for MIPS and Beyond
Health Catalyst
 
Time line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGY
Time line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGYTime line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGY
Time line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGY
DianaRodriguez639773
 
LEAD Innovation Launch_WHO Innovation Initiative.pptx
LEAD Innovation Launch_WHO Innovation Initiative.pptxLEAD Innovation Launch_WHO Innovation Initiative.pptx
LEAD Innovation Launch_WHO Innovation Initiative.pptx
ChetanSharma78255
 
Under Pressure : Kenneth Kruk's Strategy
Under Pressure : Kenneth Kruk's StrategyUnder Pressure : Kenneth Kruk's Strategy
Under Pressure : Kenneth Kruk's Strategy
Kenneth Kruk
 
Luxurious Spa In Ajman Chandrima Massage Center
Luxurious Spa In Ajman Chandrima Massage CenterLuxurious Spa In Ajman Chandrima Massage Center
Luxurious Spa In Ajman Chandrima Massage Center
Chandrima Spa Ajman
 
Letter to MREC - application to conduct study
Letter to MREC - application to conduct studyLetter to MREC - application to conduct study
Letter to MREC - application to conduct study
Azreen Aj
 
Hypotension and role of physiotherapy in it
Hypotension and role of physiotherapy in itHypotension and role of physiotherapy in it
Hypotension and role of physiotherapy in it
Vishal kr Thakur
 
RECENT ADVANCES IN BREAST CANCER RADIOTHERAPY
RECENT ADVANCES IN BREAST CANCER RADIOTHERAPYRECENT ADVANCES IN BREAST CANCER RADIOTHERAPY
RECENT ADVANCES IN BREAST CANCER RADIOTHERAPY
Isha Jaiswal
 
PrudentRx: A Resource for Patient Education and Engagement
PrudentRx: A Resource for Patient Education and EngagementPrudentRx: A Resource for Patient Education and Engagement
PrudentRx: A Resource for Patient Education and Engagement
PrudentRx Program
 
Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...
Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...
Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...
nirahealhty
 
NEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSON
NEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSONNEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSON
NEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSON
SHAMIN EABENSON
 
The positive impact of SGRT – The Berkshire Cancer Centre experience
The positive impact of SGRT – The Berkshire Cancer Centre experienceThe positive impact of SGRT – The Berkshire Cancer Centre experience
The positive impact of SGRT – The Berkshire Cancer Centre experience
SGRT Community
 
Gemma Wean- Nutritional solution for Artemia
Gemma Wean- Nutritional solution for ArtemiaGemma Wean- Nutritional solution for Artemia
Gemma Wean- Nutritional solution for Artemia
smuskaan0008
 
NKTI Annual Report - Annual Report FY 2022
NKTI Annual Report - Annual Report FY 2022NKTI Annual Report - Annual Report FY 2022
NKTI Annual Report - Annual Report FY 2022
nktiacc3
 
Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...
Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...
Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...
The Lifesciences Magazine
 

Recently uploaded (20)

INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)
INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)
INFECTION OF THE BRAIN -ENCEPHALITIS ( PPT)
 
Bringing AI into a Mid-Sized Company: A structured Approach
Bringing AI into a Mid-Sized Company: A structured ApproachBringing AI into a Mid-Sized Company: A structured Approach
Bringing AI into a Mid-Sized Company: A structured Approach
 
KEY Points of Leicester travel clinic In London doc.docx
KEY Points of Leicester travel clinic In London doc.docxKEY Points of Leicester travel clinic In London doc.docx
KEY Points of Leicester travel clinic In London doc.docx
 
Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...
Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...
Cold Sores: Causes, Treatments, and Prevention Strategies | The Lifesciences ...
 
PrudentRx's Function in the Management of Chronic Illnesses
PrudentRx's Function in the Management of Chronic IllnessesPrudentRx's Function in the Management of Chronic Illnesses
PrudentRx's Function in the Management of Chronic Illnesses
 
Empowering ACOs: Leveraging Quality Management Tools for MIPS and Beyond
Empowering ACOs: Leveraging Quality Management Tools for MIPS and BeyondEmpowering ACOs: Leveraging Quality Management Tools for MIPS and Beyond
Empowering ACOs: Leveraging Quality Management Tools for MIPS and Beyond
 
Time line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGY
Time line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGYTime line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGY
Time line.ppQAWSDRFTGYUIOPÑLKIUYTREWASDFTGY
 
LEAD Innovation Launch_WHO Innovation Initiative.pptx
LEAD Innovation Launch_WHO Innovation Initiative.pptxLEAD Innovation Launch_WHO Innovation Initiative.pptx
LEAD Innovation Launch_WHO Innovation Initiative.pptx
 
Under Pressure : Kenneth Kruk's Strategy
Under Pressure : Kenneth Kruk's StrategyUnder Pressure : Kenneth Kruk's Strategy
Under Pressure : Kenneth Kruk's Strategy
 
Luxurious Spa In Ajman Chandrima Massage Center
Luxurious Spa In Ajman Chandrima Massage CenterLuxurious Spa In Ajman Chandrima Massage Center
Luxurious Spa In Ajman Chandrima Massage Center
 
Letter to MREC - application to conduct study
Letter to MREC - application to conduct studyLetter to MREC - application to conduct study
Letter to MREC - application to conduct study
 
Hypotension and role of physiotherapy in it
Hypotension and role of physiotherapy in itHypotension and role of physiotherapy in it
Hypotension and role of physiotherapy in it
 
RECENT ADVANCES IN BREAST CANCER RADIOTHERAPY
RECENT ADVANCES IN BREAST CANCER RADIOTHERAPYRECENT ADVANCES IN BREAST CANCER RADIOTHERAPY
RECENT ADVANCES IN BREAST CANCER RADIOTHERAPY
 
PrudentRx: A Resource for Patient Education and Engagement
PrudentRx: A Resource for Patient Education and EngagementPrudentRx: A Resource for Patient Education and Engagement
PrudentRx: A Resource for Patient Education and Engagement
 
Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...
Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...
Can coffee help me lose weight? Yes, 25,422 users in the USA use it for that ...
 
NEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSON
NEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSONNEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSON
NEEDLE STICK INJURY - JOURNAL CLUB PRESENTATION - DR SHAMIN EABENSON
 
The positive impact of SGRT – The Berkshire Cancer Centre experience
The positive impact of SGRT – The Berkshire Cancer Centre experienceThe positive impact of SGRT – The Berkshire Cancer Centre experience
The positive impact of SGRT – The Berkshire Cancer Centre experience
 
Gemma Wean- Nutritional solution for Artemia
Gemma Wean- Nutritional solution for ArtemiaGemma Wean- Nutritional solution for Artemia
Gemma Wean- Nutritional solution for Artemia
 
NKTI Annual Report - Annual Report FY 2022
NKTI Annual Report - Annual Report FY 2022NKTI Annual Report - Annual Report FY 2022
NKTI Annual Report - Annual Report FY 2022
 
Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...
Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...
Deep Leg Vein Thrombosis (DVT): Meaning, Causes, Symptoms, Treatment, and Mor...
 

Healthcare/HIPAA Cybersecurity best practices

  • 1. Healthcare/HIPAA Cybersecurity best practices Jack L. Shaffer, Jr. Business Transformation Director vCIO / vCISO
  • 2. “The Scary Slide” HIMSS 2018 Cybersecurity Survey Protenus Breach Barometer Health IT News
  • 3. So what’s going on?? Insider Threats! E-mail! Avg. 308 days to discover the breach! 1,037 days to contain! HIMSS 2018 Cybersecurity Survey Protenus Breach Barometer Report Global statistics in the most recent Ponemon report on the cost of a data breach show dwell time for malicious attacks has stretched to an average of 229 days. As most IT pros know, dwell time is the period between when a malicious attack enters your network and when it is discovered. The average amount of time it took organizations in the sample to contain a data breach was 69 days. In healthcare, organizations took an average of 1,037 days to contain a data breach. Ponemon Institute 2018. Avg. number of days from breach to discovery - 2017 Protenus Breach Barometer Report
  • 4. For Healthcare Entities - HIPAA points to NIST for best security practices https://www.nist.gov/cyberframework
  • 5. HIPAA Security Rule can map to NIST CSF 164.308(a)(1) 164.308(a)(2) 164.308(a)(8) 164.308(b)(1) 164.310(d)(1) 164.314(a)(2) 164.314(b)(1) 164.316.a 164.316.b.1 164.316.b.2.i 164.308(a)(3) 164.308(a)(4) 164.308(a)(5) 164.310(a)(1) 164.310(b) 164.310(c) 164.310(d)(1) 164.312(a)(1) 164.312(d) 164.312(e)(1) 164.312(e)(2)(i) 164.312(e)(2)(ii) 164.308(a)(5) 164.312.(b) 164.312(c)(1) 164.312(c)(2) 164.308(a)(6) 164.308(a)(7) 164.312(a)(1) 164.308(a)(7) 164.310(a)(1) HIPAA Security Rule CFR’s
  • 6. Where is Healthcare still falling short? • Not Performing Thorough Risk Assessments • Focusing on wrong risks • Focusing on wrong assets • Not detecting network activity • High “Dwell time” • Insider threats not discovered • Lack of response planning • Long Avg. days to respond and contain . Healthcare’s Focus is Here – on Protect
  • 7. What should they be doing?  Create a Cybersecurity Framework and process based on NIST CSF  Train personnel on cybersecurity awareness Continuously!  Conduct a true security risk assessment NOT a checklist! Focus on ePHI assets  Asset inventory with technical details You can’t protect what you don’t know about!
  • 8. …..and more… Implement a Security Operations Center Either in-house or as a service Need “eyes on glass” to monitor the network Develop incident response plans BEFORE the incident! Implement next generation endpoint protection Detect and Respond to threats proactively
  • 10.

Editor's Notes

  1. Cyber-Security is not a “one and done” type of project, but is instead and ongoing effort. To assist firms in this sometimes large and daunting process, the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF) was published in response to Presidential Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” which called for a standardized security framework for critical infrastructure in the United States. The NIST CSF is recognized by many as an excellent resource to help improve the security operations and governance for public and private organizations. The NIST CSF is organized into five core Functions also known as the Framework Core. The functions are organized concurrently with one another to represent a security lifecycle. Each function is essential to a well-operating security posture and successful management of cybersecurity risk. Definitions for each Function are as follows: • Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities. • Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services. • Detect: Develop and implement the appropriate activities to identify the occurrence of a security event. • Respond: Develop and implement the appropriate activities when facing a detected security event. • Recover: Develop and implement the appropriate activities for resilience and to restore any capabilities or services that were impaired due to a security event. Organizations wishing to increase their overall Cyber-security posture would be well served in investigating and implementing the NIST CSF. (More information on the NIST CSF can be found at: https://www.nist.gov/cyberframework)
  2. Great way to get started