Ask 10 healthcare CEOs about the future of their industry and all 10 will tell you technology will transform how they deliver care. Innovative new solutions and medical devices will help doctors bring better care to more people at a lower cost than was previously possible. In many ways, they already are doing so today.
What you may not hear about is how challenging it is for these organizations to embrace the massive opportunity presented by new technologies, while simultaneously securing these systems — and the sensitive patient data they contain. If the cyber attacks we saw throughout 2017 are any indication, addressing this challenge is more vital than ever.
The solution to both these challenges — getting the most out of new technology and securing your network — starts with the same foundation: understanding what technology you have.
A continuously accurate inventory of IT assets should be the foundation of nearly every decision a CIO makes — from security to compliance to budgeting. Even more, an accurate inventory is crucial to effectively investing in and using this next generation technology. It sounds simple. Yet, obtaining such accurate information is often easier said than done.
CIOs are responsible for managing an increasingly large number of endpoints. They are constantly bringing new medical devices and software onto, and off of, their networks. Meanwhile, many healthcare organizations are also consolidating, merging multiple hospitals — and all their endpoints — into one health system.
This scale exacerbates the challenge, making visibility more important, and more difficult, than ever before. What we find is that most organizations don’t fully know what technology they have deployed on their network, especially as the number of endpoints soar into the tens or hundreds of thousands.
In my days working as an incident responder, the first question I would ask organizations seems remarkably simple: how many endpoints do you have on your network? The typical response was off by thousands of units. As a baseline, a healthcare CIO who believes his or her organization has, say, 50,000 computers, can expect to have at least another 15,000 unmanaged devices — a mix of computers and medical devices that aren’t being tracked. The CIO has no way of knowing whether these untracked devices have been updated. These are the endpoints attackers target.
Healthcare providers also face stringent legal requirements and regulations, like HIPAA and HITRUST. When CIOs have access to critical data on each of their endpoints, it becomes much easier to stay continually compliant with these regulations.
But while knowing your number of endpoints is helpful, of course, it’s not enough. CIOs also need to know the status of those endpoints, and need to have the ability to change them. Just as doctors need detailed data on their patient before making a treatment decision, so, too, do CIOs need detailed data on each individual endpoint to inform their decisions.
Yet, most organizations are largely operating off faulty data. Many CIOs believe the majority of their systems are patched — when, for a variety of reasons, a sizeable percentage are not. This was a regular occurrence when I responded to breaches.
In healthcare, providers are rightfully focused on saving lives and treating patients, and they can’t often afford to have their systems down to be patched — even for just a few hours. Having 24/7 access to patients’ data is crucial. It’s also why outdated systems and software are now common in healthcare providers.
But, as 2017 has shown, the risk equation has changed. The potential harm from delaying critical system updates can be far greater than any risk from making those updates. As a result, CIOs must abandon the legacy approach to patching, which commonly takes 60-90 days to achieve 80 percent completion. And fortunately, they can. Today, industry leaders are adopting new, resilient solutions and processes that allow patching cycles to complete in hours and days — not months.
Improved visibility can also help healthcare providers take advantage of the new medical technology they are adopting. As technology becomes ever more crucial to healthcare delivery, so too will knowing what technology you have, how it is being used, and having the ability to change it — quickly.
The healthcare leaders who understand how to take advantage of this unprecedented level of connection will be the ones who thrive in the 21st century.
David Damato is Chief Security Officer at Tanium.
© Copyright ASC COMMUNICATIONS 2017. Interested in LINKING to or REPRINTING this content? View our policies by clicking here.
To receive the latest hospital and health system business and legal news and analysis from Becker's Hospital Review, sign-up for the free Becker's Hospital Review E-weekly by clicking here.