A recent report from Verizon investigated nearly four thousand data breaches and over 32 thousand other cybersecurity incidents over the last year. Among the data points included is an inauspicious one for healthcare security teams.
For the third year in a row, healthcare saw the largest percentage (48%) of incidents and breaches involving internal actors. When looking across 16 sectors included in the report, the average percentage of incidents and breaches involving internal actors was 30%.
Many healthcare teams will look at this data and plan to respond with a move to Zero Trust.
So, what are the top challenges they’ll need to solve on the road to Zero Trust?
Zero Trust Challenges
The move to Zero Trust is more than just a new security architecture. Implementing Zero Trust isn’t done all at once — or simply. It’s a journey with challenges to solve along the way.
Challenge 1: Asset Management
It’s impossible to implement an effective Zero Trust strategy without a comprehensive, up-to-date understanding of the assets, users, and software running on your network.
As the IT landscape has increased in complexity in recent years – with the proliferation of cloud applications, BYOD and IoT devices, and remote workforces — traditional IT asset management has become more difficult. This has been a particular issue at healthcare facilities, where there are now 10 to 15 connected devices per patient bed on average.
A cybersecurity asset management platform provides healthcare providers a unified view of all assets, users, vulnerabilities, and more. By connecting to the security and IT tools you already have, it provides you with the much needed visibility in today’s complex IT environment, and helps you along your Zero Trust journey by:
- Connecting to your existing security and IT management solutions via adapters, and then collecting and correlating information about assets to create a comprehensive view of all devices in your environment
- Identifying unmanaged devices so you can distinguish between devices that should and shouldn’t be managed
- Helping you understand which devices are missing security solution coverage, so necessary actions can be taken
- Creating alerts to notify staff or other solutions when something deviates from the security policy
- Helping extract additional contextual information about devices and users
Challenge 2: Identity and Access Management
Once you have a good understanding of the assets and software on your network, the next challenge to overcome is identity and access management.
Healthcare providers need a new way to make decisions about who can access what. Many are turning to identity and access management (IAM) solutions to help. A move from managing identity information in various user directories to a security assertion markup language-based single sign-on (SSO) is critical to Zero Trust. It gives security and IT teams a centralized mechanism to deploy appropriate privileges for each user on the network at scale — rather than relying on the network as the primary mechanism controlling access.
An SSO can also improve the end user experience. Users will no longer need to remember a password for each application. Also, because an SSO — combined with a secure connection from a web browser — can reduce the need for a VPN, remote and hybrid employees will have easier access to the tools they need to use everyday.
Challenge 3: User Training
In the Verizon report, the No. 1 cause of incidents with internal actors involved in healthcare wasn’t intentionally nefarious activity, but rather mis-delivery. Think of an email containing sensitive information delivered to the wrong person. While it's good news that staff members aren’t conspiring to steal information (for the most part), it indicates there are other challenges in addition to limiting access with Zero Trust.
Given the prevalence of mis-delivery, another challenge for cybersecurity teams to overcome is user training. User training can help employees understand the correct procedures for sharing information, and can help prevent unintended incidents — helping your team ensure compliance with regulations like HIPAA.
Where to Start?
The move to Zero Trust is a journey, not a technology migration. Solving key milestones of asset management, identity and access management, and user training will set you up for success. Improving visibility into the assets and users on your network is a great place to start.
