Name: MedSec CEO says healthcare more difficult to secure from cyber attacks than other industries
Uploaded: 2021-05-21
Duration: 4 min 16 s
Description: Justine Bone says security comes second to patient safety.

Justine Bone says security comes second to patient safety.

MedSec CEO says healthcare more difficult to secure from cyber attacks than other industries

Tech

MedSec CEO on challenges of securing healthcare from hacks

Justin I want to ask you, you know, at the start of this pandemic, we're hearing chatter that there was going to be some sort of a truce, like hackers, we're going to hold off attacking things that were really important. Um, they would, you know, not uh, slap hospitals with ransomware given all of the uh, you know, the situation with Covid. What happened to that way we should have known are criminals better? It seems. Um, some of us have grasped at that comment by, I think one group who declared that they hold off on going after hospitals, um, maybe that group held off, but certainly nobody else did. And, you know, we've seen that play out with these organizations, taking advantage of institutions in their weakest moments. Um, we were not resilient in health care to start with, I'd say, you know, perhaps the silver lining of the sort of rapid modernization of healthcare technology that that that we've just seen happen with very fast introduction of kelly, health and the remote delivery of health care along with any, as we know, insecurity with any reinvention or, or rapid evolution of technology strategy comes risk. And so we took an already vulnerable industry, arguably under resourced, already transformed through a pandemic, needless to say distracted by a pandemic. Um, and and you know, the infrastructure as a result is not yet resilient and it's also tip analyses point extremely lucrative. And so unfortunately, um you know, there's these organized crime groups out there took advantage of the situation and it's continuing right up until this moment. Um there are differences with the health care industry versus a lot of others, you know, as healthy was saying a lot of people are working remotely, but when it comes to hospitals, you know, telehealth can go a long way, but you know, when it comes down to it, you have to have patients in there. They need operations, they need all sorts of care. I wonder how the health care industry differs from some of the other ones. Um, and especially given your work with med SEc, this is sort of your specialty area to kind of talk uniqueness about respecting health care. It's the one overriding factor in health care is patient safety and this is the first time in my career with cybersecurity is almost had to take a second place to this overriding priority of patient safety. So for example, what we would think of as the, the concept of availability of systems just takes over everything is a priority up time and availability inside of a hospital is the number one. Priority security of those systems comes in a close second place. So for example, a security best practice that we will follow in a financial institution, vulnerability management, Patch management. Let's take their systems offline, update them, test them, Roll them back up. We're off to the races on monday morning. You can't do that inside of a 24 7 facility that is continuously delivering healthcare, patient safety. The availability of these systems is the number one priority. And so you can't you can't just take these things off line and roll out some patches and reboot them and hope that everything functioning normally. So it is a very challenging industry to work in because although we do know how to solve a lot of the cyber security problems that we run into in many cases, we can't just apply the same methodology. We can't be so aggressive with the rollout of security testing. We can't call in a bunch of pen testers, we can't run a bunch of vulnerability scans, we can't continue, certainly can't do that in a continuous fashion. So we have to sort of take a step back and think about patient safety first and then figure out how we can apply cybersecurity best practices and that just drives everything, um, including my area of focus, such as medical device security.