Healthcare and Technology news
47.7K views | +11 today
Follow
Healthcare and Technology news
Your new post is loading...
Your new post is loading...
Scoop.it!

Information Security Risk Management

Information Security Risk Management | Healthcare and Technology news | Scoop.it

Information security risk management is a wide topic, with many notions, processes, and technologies that are often confused with each other.

 

Very often technical solutions (cybersecurity products) are presented as “risk management” solutions without process-related context.

 

Modern cybersecurity risk management is not possible without technical solutions, but these solutions alone, when not put in the context of correct risk management processes (and in the context of information-related processes) of an organization might not be enough to properly manage risks of information processing or might even cause a false sense of security.

 

In this new series of articles, I will explain some basic notions related to risk management, introduce and describe the phases of cyclic high-level process risk management, give more details on each of the phases and introduce the NIST and ISO standards related to risk management.

 

In this article, I will review the definition of risk, goals of risk management and list the main NIST and ISO standards related to information security risk management.

Cybersecurity risk management vs information security risk management

First of all, let’s discuss shortly the difference between “cybersecurity risk management” and “information security risk management”. Before “cybersecurity” became a buzzword, professionals dealing with information security used only “information security” and “IT security” notions.

 

Obviously “information security” is a wider term. It concerns the security of information, stored, processed or transmitted in any form (including paper). Information security also concerns people, processes, legal/regulatory matters and insurance. (Yes, insurance is also a way to reduce risk – by transferring it – and is thus a security measure.)

 

“IT security” is a term concerning “IT”, that is Information Technology. So it concerns information processed in IT systems. Sometimes these notions (“information security” and “IT security”) were used (and still are used!) interchangeably, but formally this is wrong because IT system is a part of information processing system.

 

“Cybersecurity” is a nice buzzword of recent years. Almost everything is “cyber” these days. Unfortunately this word has different meanings, depending on who uses it. The “cyber” part of this word suggests it concerns technology, so in my private opinion this word, “cybersecurity” is a younger brother of “IT security” (or, to be more precise, a younger clone  ). What is wrong with this word in my opinion is that it is often used to describe (or in) high-level documents like policies or process descriptions that have nothing to do with lower-level technology. But this is the trend we cannot change – the “cybersecurity everything” approach has been present in information/IT security world for some time already and it is doing very well. So we have to adapt and adjust.

 

But at the same time we have to be very careful when using the word “cybersecurity” (do we really mean what we are saying?) and also when reading it (what does this word really mean in the context of other information it is “served” with?).

The goal of information security risk management

The main goal of information security risk management is to continuously address the risks to information processed by an organization. These risks are to be addressed according to the organization’s risk management policy.

 

The information security risk management is a part of general risk management of an organization, so it should be aligned with general, high-level risk management policy.

 

The realization of the above-mentioned goal of information security is dependent on the following elements:

  • the information security risk management methodology;
  • the information security risk management policy and procedures;
  • the information security risk management process;
  • the information security risk management stakeholders.

I will be addressing all these in next articles in this series.

NIST and ISO standards

There are important (and practically applicable) NIST guidelines and ISO standards available on information security risk management.

The main high-level ISO standard on risk management is ISO 31000 (namely ISO 31000:2009: “Risk management — Principles and guidelines”; it is currently under review).

(It belongs to the same line of ISO standards as ISO 27000 line of standards, which I touched in my previous series of articles in Komunity.)

 

ISO 3100 introduces the risk management cycle that is applicable to (and should be used for) information security management, independent of risk analysis methodology used. I will use this cycle to introduce information security risk management process.

But before that, let me mention also other standards and guidelines on information security risk management:

  • ISO/IEC 27005: “Information technology — Security techniques — Information security risk management”;
  • NIST Special Publication 800-39: “Managing Information Security Risk: Organization, Missions and Information System View”;
  • NIST Special Publication 800-30 Rev 1: “Guide for Conducting Risk Assessments”.

I will come back to these standards after I describe the risk management cycle and its elements.

Risk definition

Let’s touch on another subject that is important and sometimes misunderstood – the notion of risk itself.

 

In common language, we often mix up all notions related to risk management: the risk itself, vulnerability, threat etc. We can’t do that if we want to run the risk management properly. It is not only the matter of notion mix-up. These notions are used in any risk analysis methodology and shouldn’t be mixed up, otherwise one will not be able to perform risk analysis correctly or understand and implement its results into the risk management process cycle.

 

ISO 31000 defines risk as “effect of uncertainty on objectives” (please remember that this standard is a high-level standard). This effect can be positive or negative, which means that in terms of this standard (and other risk-related standards, as you will see) risk is neutral. This, as can easily be seen, is not consistent with the common language, in which risk is almost always a negative notion.

 

I’ll come back to this definition and to the definitions o terms that are related to risk notion: vulnerability, threat etc.

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
No comment yet.
Scoop.it!

Are you doing your security framework right?

Are you doing your security framework right? | Healthcare and Technology news | Scoop.it
It turns out many healthcare organizations get more than a few things wrong about their information security frameworks – big time. Whether it's about properly integrating a framework or even appropriately tailoring a framework, there's a list of items organizations should pay attention to. 
 
If done right, information security frameworks can be used to meet an organization's risk analysis requirements under the HIPAA Security Rule, in addition to helping define a "baseline of protection," said Bryan Cline, senior advisor at HITRUSTAlliance, but that's only if they're properly selected and implemented. And many organizations don’t necessarily do this successfully. 
 
Cline, who will be speaking at the Healthcare IT News Privacy and Security Forumthis March in a session on data security framework need-to-knows, says the biggest oversight he sees organizations make "is in not tailoring the framework appropriately." Added Cline, "organizations either rely on the framework without tailoring the requirements to address all reasonably anticipated threats, or they tailor the framework's requirements – usually by removing some of them – without fully understanding the additional risk that's incurred."
 
Sure, a security framework will help in the compliance arena, but improper tailoring and failure to keep it updated will inevitably lead to information-related risks being inadequately addressed, he said. This up-to-date piece is crucial, Cline said, because "frameworks also grow stale over time, as it can take several years for most frameworks to be updated and released."
 
Another big oversight, as Cline pointed out? Failing to integrate the framework into everyday operational processes. "For example," he said, "personnel with security responsibilities – whether in the security organization or elsewhere (e.g., HR or IT) – should be tied to the framework's controls and the security services that support their implementation." This, he added, would allow organizations to manage risk through managing the security services.
 
Cline, who is also the managing partner for Cline & Shiozawa Professional Services and previously the chief information security officer at Catholic Health East and The Children’s Hospital of Philadelphia, at his forum session will go over security risk management frameworks and how they can be leveraged and used in an organization's data protection programs. This includes, as Cline pointed out, how they can use these frameworks to meet risk analysis requirements under the HIPAA Security Rule. 


more...
No comment yet.
Scoop.it!

Cybersecurity in the Spotlight 

Cybersecurity in the Spotlight  | Healthcare and Technology news | Scoop.it

Once again, cybersecurity issues will be in the spotlight at the Healthcare Information and Management Systems Society Conference, to be held Feb. 11-15 in Orlando, Florida.

 

This year's event at the Orange County Convention Center promises 1,300-plus exhibitors, including more than 70 vendors in the show's dedicated Cybersecurity Command Center.

 

The conference is expected to draw more than 45,000 attendees and offer more than 300 educational sessions spanning 24 topics - including cybersecurity and privacy as well as related regulatory updates.

Cybersecurity sessions will be weaved in throughout the week, with many taking place at the Cybersecurity Command Center. But the topic will also get special treatment on Monday, Feb. 11. A Cybersecurity Forum that day geared to CISOs and other health IT security leaders is among a handful of pre-show workshops before HIMSS19 officially opens on Tuesday.

Cybersecurity Forum

The Cybersecurity Forum has several key learning objectives for its attendees, HIMSS says, including:

  • Explain the types and details of recent cyberthreats;
  • Discuss what's new, what's different, what to look out for, and the impact on administrative, clinical operations and patient safety;
  • Describe how organizations can work better and smarter to enhance their cybersecurity program, despite resource and financial constraints.

Featured speakers at the forum include Ron Mehring, CISO at Texas Health Resources; Kevin McDonald, director of clinical information security at Mayo Clinic; Jason Hawley, director of information services and security at Yuma District Hospital & Clinics; Mitch Parker, executive director, information security and compliance at Indiana University Health; and James Brady, CIO of the Los Angeles County Department of Health Services.

Regulatory Updates

As usual, the HIMSS conference will provide opportunities to hear from government officialsabout the latest policy plans and other developments. Agencies to be featured include:

  • The National Institute of Standards and Technology, offering a session on Monday, Feb. 11, about its cybersecurity framework;
  • The Food and Drug Administration, which will describe its digital health software precertification program on Tuesday, Feb. 12;
  • The Office of the National Coordinator for Health IT, which will be featured in a number of sessions, including a standards and technology update slated for Thursday, Feb. 14.

I predict one of the best attended government sessions will be the HIPAA enforcement and compliance update on Tuesday, Feb. 12, featuring Roger Severino, director of the Office for Civil Rights at the Department of Health and Human Services.

Technology Spotlight

Among the emerging technologies to be spotlighted at the show is blockchain, which will be showcased at a four-hour forum on Wednesday, Feb 13, including a session about blockchain's privacy, security and compliance considerations in healthcare.

Machine learning and artificial intelligence are buzzwords that are guaranteed to be used by many of the exhibitors showcasing their health IT gear. But ML and AI will also be discussed at a variety of educational sessions, including a special all-day pre-show forum.

 

Many of the sessions at that forum appear to be heavily focused on the application of ML and AI for clinical applications. But the use of AI and ML for securing health data will also be showcased in a separate session, "AI in Healthcare: Ethical and Legal Considerations", at the Cybersecurity Command Center .

 

As usual, I'll be at the conference attending sessions as well as meeting with numerous healthcare CISOs, government leaders and other privacy and security experts. I'll share their insights in audio interviews, articles and blogs, so be on the lookout for daily updates on our HIMSS19 news site.

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
No comment yet.