Methods to transfer the needle on third-party cybersecurity

BOSTON – Chief info safety officers from Intermountain Well being, Northwell Well being and Renown Well being shared insights and guidance on learn how to make third-party administration a precedence through the 2022 HIMSS Cybersecurity Discussion board.

Relatively than deal with a data-specific view of third-party dangers, Erik Decker, assistant vp and CISO at Intermountain Healthcare, opened the third-party threat administration panel by positing a speculation and focusing the attendees on the mission-critical nature of healthcare suppliers’ third-party companies.

“It is not extremely refined [advanced persistent threats], nation-state actors which are spending exorbitant quantities of assets to get into your group,” he mentioned.

“It is in reality, a scarcity of primary controls, some primary hygiene and a few primary points that we thought we had lined, however in fact, we would not have had lined.”

Decker was joined by Kathy Hughes CISO of Northwell Well being and Steven Ramirez CISO of Renown Well being.

The pivot and the concerns

If third-party distributors essential to delivering healthcare companies go down, it could actually acutely impression the operate of care supply.

“I feel we have to additionally pivot in serious about the issue state,” Decker mentioned. 

Whereas electronic health records are an obvious critical third-party system, there are medical units that require computations within the cloud the place a compromise on these programs would have scientific implications.

There are additionally third events that offer core companies – for syringes, laundry, medical tools and different issues.

“In the event that they go down, how does that impression your hospital?” he requested. Decker additionally cited the “Kronos impact,” the convergence of main suppliers that may impression care when they’re attacked. As a result of these main suppliers present progressive companies that enhance operations, “they develop into very target-rich for inflicting most injury and most impression,” he mentioned.

There are additionally these associates with back-end entry that improve the assault floor.

From transactional to steady monitoring

Hughes cautioned that the same old means of vendor threat administration evaluation – asking the suitable inquiries to get a threat profile – is a “snapshot in time.”

Amassing details about a 3rd get together’s threat administration program relies on the kind of information the group will empower or allow a vendor to assist for them, together with the quantity of information, the variety of customers, the place the information goes to be situated, what the use case is, what units or programs are concerned, and many others.

Threat evaluation causes friction “as a result of it does that such a lot of time,” and it identifies gaps. “It is nonetheless a really guide and labor-intensive course of,” she mentioned.

To handle the transactional nature of evaluation, a extra holistic strategy that aligns with business-impact evaluation language begins with capital planning, in accordance with Ramirez. 

“If we are able to get forward of the desk and take a look at high-risk vendor, high-risk processes beforehand, we are able to begin to put these supplemental controls in place” to keep away from a domino impact, he mentioned.

Having one to a few potential distributors in these discussions may help bake continuity into the business-impact evaluation course of.

Hughes mentioned that establishing interdepartmental relationships is important to speak dangers, “as a result of there is no such thing as a such factor as risk-free. There may be at all times some stage that needs to be accepted.” 

Collaboration helps everybody perceive what the dangers are, she mentioned. “It is actually about making an attempt to make that course of as frictionless as doable.”

Protecting discussions alive with key stakeholders helps maintain the heart beat on modifications that evolve over time with distributors, new distributors and interdependencies, Ramirez added.

Scaling threat evaluation processes 

“As we do a whole lot of hundreds of those assessments, that bleeds into a whole lot of hundreds of points that we see and discover, which implies a whole lot of hundreds of various issues you need to handle,” mentioned Decker.

If one thing comes up with the chance evaluation, Hughes mentioned the group will negotiate with that vendor to get a dedication to adjust to its requirements and put that within the contract language.

“Total, that can cut back the residual threat from, say a medium or excessive, all the way down to a low – in the event that they meet these commitments,” she mentioned, including that the seller has to fulfill commitments by sure dates, which the group tracks and follows up on.

“Normally we discover that distributors are very receptive, as a result of they know that each one healthcare organizations are asking the identical questions and are simply actually seeking to shield the programs and the information.”

Vulnerability administration groups that additionally monitor these outward-facing scorecards by insurance coverage carriers, that overview a healthcare group’s perimeter cybersecurity and infer controls inside, present a place to begin to develop maturity, mentioned Ramirez.

“It is one part to the general larger image,” however these threat scores present a possibility to drive extra optimization, he mentioned.

Hughes famous that these threat playing cards relied upon by cyber insurance coverage carriers are additionally reviewed by menace actors taking a look at them. “They’re going to goal these organizations that maybe aren’t as safe,” she famous.

Decker requested if organizations are dedicating assets to repair vendor inaccuracies, is that truly value-added time?

Healthcare organizations share hundreds of distributors and may have a few of the identical questions throughout threat assessments, he mentioned.

If healthcare organizations might register their essential distributors, and different healthcare organizations which are conducting a threat evaluation of these distributors have one thing “pop,” then such a crowdsourcing system might reduce risk-assessment pipelines, Decker instructed.

Constructing a tradition of cybersecurity

So as to align scientific care to enterprise operations, Hughes mentioned a separate business-continuity crisis-management workforce has numerous departments taking a look at their downtime procedures. 

“They haven’t been considering by way of weeks and months,” she mentioned.

Be certain that there are plans in place and that different distributors are recognized, and train these plans, she suggested.

Ramirez mentioned that tabletop exercises are essential, and that he likes to make the most of downtimes to study classes – “Why does one thing not work properly?” – after which emphasize factors of failure. 

“In case you’re in search of a spot to start out, I might counsel you define lab imaging, pharmacy and your EMR,” mentioned Decker. “And take into account how you’d be out of these for over a month, and what that appears like, and what are the options it’s good to have on the prepared to face up?”

He additionally pointed attendees to the Health Industry Cybersecurity Supply Chain Risk Management Guide by the Well being Sector Coordinating Council, which he’s chair of, for extra third-party risk-management steerage.

Andrea Fox is senior editor of Healthcare IT Information.


Electronic mail: afox@himss.org

Healthcare IT Information is a HIMSS publication.