In recent years, the average cost of healthcare-related data breaches increased from approximately US$7 million in 2020 to over US$9 million in 2021. Moreover, breaches in healthcare have been consistently more costly than in other sectors for 11 consecutive years. With the frequency and costs of cyberattacks expected to rise, healthcare organizations must carefully plan for and identify strategies to mitigate cyber-related risks. This paper provides practical guidance for boards, senior leaders and risk managers in the development and implementation of organization-specific cybersecurity measures, with a focus on the identification, mitigation and management of risks.

Introduction

Canadian healthcare organizations have been faced with an elevated risk of cybersecurity threats, which has increased further since the onset of the COVID-19 pandemic (Canadian Centre for Cyber Security 2020). Furthermore, an increase in cybersecurity attacks has been attributed to increased activity by nation-state and cybercrime threat actors (Accenture 2021). Cybersecurity incidents in a healthcare organization can have serious and devastating consequences. They can lead to one or more types of adverse events, including service interruptions, operational and financial losses, patient safety issues and increased mortality rates, privacy breaches, potential civil action or class action lawsuits and regulatory penalties. Moreover, data breaches in the healthcare sector have been the highest for 11 consecutive years, with the average cost of a data breach increasing from US$7 million in 2020 to over US$9 million in 2021 (IBM Corporation 2022). Mitigating against a cyber breach requires increasingly digital healthcare organizations to ensure continuity of care for patients in the event of a cyber-related incident (Pina 2022). Due to the complex nature of cyber threats, security and infrastructure tools alone are not enough to protect an organization from risk as social engineering techniques can be used by threat actors to gain unauthorized access to systems. A single vulnerability can be exploited, which can cause a threat to the healthcare organization. The overall strength of an organization's defence plan is only as robust as its weakest points. As such, cybersecurity preparedness plans must reach all staff within an organization. Furthermore, as technology continuously evolves, so do the associated cyber threats and potential attack vectors. Threat actors are continuously innovating to exploit varying vulnerabilities in technology, workflows and human resources (Wilner et al. 2022). With healthcare organizations facing resource and funding scarcity for the investment, implementation, administration and maintenance of technologically advanced security solutions, seeking advice on ensuring cyber defence best practices and processes for healthcare leaders becomes increasingly important (Garcia-Perez et al. 2022).

Many factors are involved in the prevention of, preparation for and management of potential losses associated with cyber threats. Organizations must follow sound risk management strategies to ensure overall risk mitigation and resilience. Resilience can be achieved through building organization-wide cyber intelligence, expertise, partnerships and a culture of security with appropriate governance, strategy, policies and standards and controls, including appropriate information technology (IT) solutions.

Cybersecurity expert John Chambers has stated that there are only two kinds of organizations – those that have been hacked and know it and those that have been hacked and do not know it yet (Cisco Press 2016). With this urgency in mind, we present practical risk management-based strategies that leaders can adopt to help create organization-specific policies and practices.

Risk Management Principles

The risk management principles presented in this paper build on existing literature for the healthcare landscape. Several authors have presented recommendations for healthcare organizations to reduce the prevalence of security incidents through risk management practices. DeSouza and Valverde (2016) conducted a review of Canadian case studies and feedback from information security professionals to develop recommendations for organizations for reducing behavioural risk. Nifakos et al. (2021) conducted a systematic review of human factors–related literature and provided a summary of recommendations. More broadly, organizations including the Canadian Centre for Cyber Security (Canadian Centre for Cyber Security 2022) regularly provide recommendations on cyber preparedness and information regarding cyber alerts for IT professionals. Other authors have published guidance documents for Canadian healthcare organizations on risk management, including Canada Health Infoway (n.d.), Digital Health Canada (2022), HealthCareCAN (2022) and the Healthcare Insurance Reciprocal of Canada (HIROC) (HIROC 2017). This paper supplements existing work by providing a principle-based framework for guidance to leaders of Canadian healthcare organizations on the prevention of, preparation for and management of cyber risks.

Principles for Canadian healthcare organizations to consider when building organization-specific policies and practices for cyber risk management

These principles include governance and leadership; cyber risk management frameworks; risk-based management of cybersecurity; education and training; monitoring tools and technologies; and organizational cyber resiliency. A brief description of each principle is provided below.

Governance and leadership

Board oversight and corresponding senior management accountability are essential to fostering a successful cyber risk management program that effectively supports the implementation of cyber risk mitigation activities. Board oversight should, at a minimum, assign senior management accountability for cybersecurity and clearly delineate who will ensure the implementation of controls and mitigation strategies throughout the organization. A board committee can be positioned to receive regular updates from senior management or the subject matter expert on the progress and effectiveness of cyber risk management strategies. Boards can also undertake training, education and research to increase cyber literacy, understand challenges and risks faced by the organization, engage external experts regularly for updates and benchmarking and participate in informed discussions with management about critical cybersecurity exposures.

Senior management should also be accountable for the following:

• operationalizing cyber risk management activities that are mandated by the board,
• serving as an overarching enforcement body for the organization's cyber risk management undertakings,
• providing regular progress updates to the responsible board committee,
• ensuring that accountability for cybersecurity is cascaded throughout the organization from IT operational leads to all functional managers and leaders,
• preparing and critically reviewing the organization's cybersecurity incident response plan and
• keeping partners and stakeholders fully informed of the organization's cybersecurity strategy.

Several resources are available to support leaders in managing cybersecurity, including from the Chartered Professional Accountants of Canada (CPA Canada 2019) and HIROC (HIROC 2022).

Cyber risk management frameworks

Several well-recognized frameworks have been established for managing cyber risks, which can be fully or partially adopted to suit an organization's needs and business model. The National Institute of Standards and Technology (NIST 2018) cybersecurity framework addresses potential threats and risks to infrastructure and critical systems. The NIST framework applies the principles and best practices of risk management to improve the security posture and resiliency of the overall infrastructure. In addition, the SANS Institute's (2021) Centre for Internet Security Critical Security Controls framework provides a set of recommended actions focused on effective cyber defence. The International Organization for Standardization (ISO) 27001/27002 framework provides best practice recommendations for holistic information security management system implementation standards (ISO n.d.). Adopting a cybersecurity framework can help organizations identify areas of weakness, build a road map to address the gaps and track and report the maturity level of the cybersecurity program.

Additional guidelines and checklists are available to support the development of organization-specific processes, including the Ransomware Playbook from the Canadian Centre for Cyber Security (2021), Cyber Loss Risk Reference Sheet from HIROC (2020) and learning modules from the Cyber Security Centre of Excellence (Government of Ontario 2020).

Risk-based management of cybersecurity

A risk-based approach can help organizations identify threats and vulnerabilities before they are found or exploited by a malicious actor, especially as new cyber threats and system vulnerabilities are constantly being discovered (IBC 2022). To effectively manage risks, organizations must keep abreast of what is happening externally and closely monitor their internal systems and processes.

Slow network performance or unusual increases in network traffic are some examples of internal environment monitoring that can lead to early identification of the emerging threat. Undertaking regular vulnerability assessments and penetration tests will also help organizations identify, validate and classify their vulnerabilities. Similarly, subscribing to security notifications, alerts and publications from vendors and trusted authorities can lead to the identification of external threats and new system vulnerabilities, such as zero-day vulnerabilities, in a timely manner.

Early identification of evolving risks can help organizations implement appropriate actions to mitigate them in a timely manner. Examples can include patching vulnerabilities, blocking traffic from selected geographical locations and others.

Education and training

State-of-the-art technology alone is insufficient to completely protect organizations against intentional or unintentional harmful actions of an end-user with access to systems, networks, devices and equipment. A 2021 report found that over 80% of cyber breaches involved a human element, including factors such as stolen credentials, successful phishing attempts or other human errors (Solomon 2022). Moreover, the average time to detect and contain a cyber breach is nearly 280 days, according to a recent report from the IBM Corporation (IBM 2022). As such, a strong organizational cyber-awareness training and education program is a critical factor for cyber preparedness.

Additional considerations for the development of a training program (Deloitte Touche Tohmatsu Limited 2019) include the following:

• A robust cybersecurity awareness training and education program should enable staff members to recognize cyber threats, such as phishing emails, malicious websites and others.
• Training programs should be conducted at more frequent intervals and tailored to specific user groups and the information they require.
• The development of success metrics can gauge completion and participation of training activities.
• Embedding cyber risk management thinking in all activities and decision making can strengthen the organization.

In the development of organization-specific cybersecurity success metrics, frameworks such as CARE (Consistent, Adequate, Reasonable and Effective), established by Gartner, Inc. (Gartner 2021), can be informative. This framework recommends organizations to consider success metrics in each of the following four categories:

• Consistent: Ensure that cybersecurity controls function as intended and comparably across all areas of an organization.
• Adequate: Ensure that controls are satisfactory according to business needs.
• Reasonable: Ensure that controls are appropriate given the need for maintaining security and the ability to perform business operations.
• Effective: Ensure that security controls and practices function as intended and provide desired outcomes.

Additional resources to support the development of technical success measures include “Building a Cybersecurity and Privacy Awareness and Training Program” (NIST 2021).

Monitoring tools, technology and activities

Tools for monitoring processes, systems and activities can help organizations with the proactive identification of potential anomalies in access patterns. Organizations may require external professional assistance to adopt holistic intrusion detection, as well as prevention and monitoring tools and activities. Early identification of potential threats and vulnerabilities will help organizations contain breaches in a timely manner and may help limit exposure and operational interruptions.

Healthcare organizations may not be able to effectively address all cyber-related risks on their own. Partnerships with other healthcare organizations and provincial and territorial bodies responsible for cybersecurity for public organizations can lead to cost-effective cyber risk management strategies. This includes combining efforts to implement a centralized managed security service or security operations system that provides surveillance and protection software and monitoring. Smaller organizations can partner with nearby larger healthcare organizations so that resources can be pooled and applied efficiently.

Cyber resiliency

Cyber resiliency of an organization can be defined as its ability to effectively respond to, contain and manage cyber attacks or cyber-related breach events with the objective of minimizing operational impacts and associated losses. A comprehensive cybersecurity resiliency program includes formalized incident response plans, a disaster recovery plan, system downtime procedures, regular drills and testing of data recovery and appropriate cyber response education for staff and leadership teams, such as table-top exercises.

The first element of building a cyber resiliency program involves understanding the current state of an organization's cybersecurity posture. Healthcare organizations need to develop an inventory of existing assets, which may include data and their permission and sensitivity classifications; applications, software and systems; networks; and hardware to support IT infrastructure.

A comprehensive cyber resiliency program will also include strategies to prevent or minimize the loss experienced because of a cybersecurity incident. In general, cyber resiliency, cybersecurity incident management and loss prevention strategies are essential components of a comprehensive cyber risk management program. Minimum cybersecurity strategies for organizations to consider to help mitigate risk are provided in Table 1.

A Principle-Based Decision-Making Framework

When the potential for a breach or an actual breach is identified, immediate actions are required to support risk reduction and containment. By preparing ahead of time and building meaningful decision-making criteria for potential scenarios, healthcare organizations can manage difficult events and decisions more effectively.

The principles outlined in Table 2 are considerations that leaders should include when developing internal cyber risk management plans specific to their organization.

Conclusion

As Canadian healthcare organizations continue to face increasingly frequent and complex cyber-related threats, guidance on the mitigation and response of these incidents becomes increasingly important. Organizational resilience in response to cyber threats can be achieved through a variety of approaches. What is essential is building expertise at all levels in cyber intelligence, fostering partnerships and promoting a culture of security with appropriate governance, strategy, policies and standards and controls. This paper has sought to add to the body of literature on risk management for Canadian healthcare organizations by providing advice on principle-based risk management, as well as outlining considerations for organizational decision making in the event of a cyberattack.

Comments

Be the first to comment on this!