HSOC Preso_Unbranded-Securis-9-11-19

y
Revolutionizing Data Security in Healthcare
Prepared For
Dana Foundation
Notice
Much of this document is specific to Sequris Group information systems, policies, procedures, and IT security posture. As such, the contents of this presentation are classified as CONFIDENTIAL and cannot be copied, reused,
or distributed without express written authorization from Sequris Group. Sequris Group, LLC Content All Rights Reserved 2011-2018
Current State
of the Industry
• IT professionals and Gartner believe there is a 60 % chance that organizations will have a
security breach/ suffer major service interruptions by 2020
• Too many rapidly evolving vulnerabilities
• A rise in social engineering attacks directly at targeted organizations What to do
about Ransomware
• Resources for organizations to deal with all of the cybersecurity concerns IoT
• Ransomware
Top Executive Concerns
• Attacks directly targeted at our organization Effort to stay in compliance
• Phishing social network exploits social engineering Accidental data leaks by end-users
• Effort to measure the organizations security posture Data theft by insiders
• Mistakes or attacks that cause organization to lose compliance with industry regulation
• Espionage
• Ransomware
• Employee Training and Awareness A Solid Security Plan

The Invitation
• The Governor requested that critical

infrastructure cybersecurity groups form
• The Michigan Healthcare Cybersecurity
Council is established
• Public/Private healthcare membership
organization
• Focused on protecting critical healthcare
infrastructure, institutions, and those they
serve
MiHCC Observations
• Get Together – quarterly face-to-face meetings work
best
• AdHoc Collaboration – implement simple mechanisms

for ongoing communication
• Focus – significant progress on a few items is better

than little progress on many items
• Trust – establish it early, reinforce it often
• Experience – the source for the best knowledge share

MiHCC Incident Response
• Inability to respond to security events – a top 3 issue
• Incident Response Plans – from check the box to tried

and true
• A willingness to share - willing is NOT always able
• Attempt: Broadcast when under fire. Result: After the

fact
• Attempt: Automate event sharing with Soltra Edge.

Result: Died on the vine.
Go Bigger!
Opportunity of a Shared Model
Elements of contract: Provides:

● Flexible vendor Operating ● Technology
● Commitment to Partner Expertise
Sector ● Flex/Surge
● Data Use Staffing
Agreement ● Intelligence
● Code of Ethics Visibility
● Governance ● Sector Outreach
● Intellectual
Property
● Publication
Rights
Operating
Partner
● SOC Staff Inaugural

● Technology Participant
Feeds
● Sector
Coordination
State
Operating
Partner
Inaugural
Participant
State
Operating
Partner Sector
Partner
Inaugural
Participant Sector Additional
Partner
Participant
Energy
Healthcare
State
&
Public
Safety
Manufacturing Transportation
Cyberhub Model (IDA L.A. ODell)
Guiding Principles
• Lead with the “Cyber Hub” concept in order to facilitate stewardship
• Create an enterprise framework with common technical standards and
processes as the default, leveraging existing models
• Optimize the use of data, information, and intelligence from existing
programs (including fusion centers and ISACs), platforms, and tools in order
to build and continually strengthen all operational outcomes
• Define and establish governance to promote transparency and cooperation
• Drive mission agility through communication and collaboration.
Opportunity of a Shared Model- Why Build?
• Cybersecurity is a team sport.

• Cyber crime is a team sport, and their team is ahead.
• Proactive information security requires real-time collaboration & new paths of
communication.
• Development of healthcare specific information security capability.
• The opportunity to contribute to the academic process/curriculum.
• Improve patient care, research, educational effectiveness and safety through
collaboration.
• Drive information security talent flow to the participating entities.
The Mi|HSOC
• Event Triage & Response
• Incident Investigation & Resolution
• Event Aggregation, Analysis, & Reporting
• Real world incident simulation and training
• Resource recruiting & retention

Healthcare SOC - What
Event Triage and Response
24x7x365 eyes on glass event monitoring
Event identification, triage, investigation, and response
Organizational event facilitation and escalation workflow
Daily briefings on observed events, mitigated incidents, and market threat
Founding entities will participate in site selection

Incident Investigation and Resolution
CERT-Certified incident handlers and incident response team
Data sharing amongst participating entities
Program integration and training within your cybersecurity team
Incident disposition and resolution reporting
Cross-entity correlation and alerting

Event Aggregation, Analysis, and Reporting
Data sharing infrastructure for multi-entity event analysis
Identification of anomalous behavior across a larger dataset
Incorporation of third party threat feeds
Monthly threat trend and participating entity statistics reporting
Capable of integration with NH-ISAC

Ongoing Customized Security Incident
Simulation and Training
Multi-entity drills, education, and perspective
Collaboration on exercises amongst entities and third party organizations
Utilizing entity event types, environments, and third-party threat data.
Integration of incidents mitigated by the Healthcare SOC
“Lessons learned “ are reinforced through developed curriculum and training

Resource Recruiting and Retention
Address the scarcity of healthcare cybersecurity professionals
Shortage of skilled resources
Inadequate undergraduate degree programs focused on information security
Healthcare specialization in information security virtually non-existent
Construct and execute programs creating extraordinary talent

Build awareness that securing a patient’s private information is a crucial role in
providing exemplary patient care
Provide optimal pathing opportunities for career advancement
The Benefits of a Physical Space
• The “enclave” concept is one that

all participants share a similar
culture and identity.
• All entities can then have trust and

reliance in the enclave.
• There is a level of value in the

informal ability to work alongside
cybersecurity professionals in like
industries.
• Out of this thinking the

CyberForce|Q Center was born.
Steering Committee Leadership
1. Common purpose and governance

2. Participants define and adhere to the rules of the game
3. Clear measurement, metrics, and accountability
4. Preservation of a higher purpose
About Sequris Group
Thank You!
Key Takeaways That Led to Success:
Munson Healthcare-Inaugural Participant

• Munson Healthcare
• 9 hospital system
• 12000 users
• 28000 network nodes
• 2000 devices connected to
patients
• Rationale for participation
• Learn from peers
• Protect the ecosystem
• Demonstrate openness and trust
• Cost effective monitoring
• Focus on the things that a
healthcare system must be great
at

HSOC Preso_Unbranded-Securis-9-11-19

Uploaded by

Copyright:

Available Formats

HSOC Preso_Unbranded-Securis-9-11-19

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

HSOC Preso_Unbranded-Securis-9-11-19

Uploaded by

Copyright:

Available Formats

y

Revolutionizing Data Security in Healthcare

• Attacks directly targeted at our organization Effort to stay in compliance

• Effort to measure the organizations security posture Data theft by insiders

• Employee Training and Awareness A Solid Security Plan

• The Governor requested that critical

• AdHoc Collaboration – implement simple mechanisms

• Focus – significant progress on a few items is better

• Trust – establish it early, reinforce it often

• Experience – the source for the best knowledge share

• Incident Response Plans – from check the box to tried

• A willingness to share - willing is NOT always able

• Attempt: Broadcast when under fire. Result: After the

• Attempt: Automate event sharing with Soltra Edge.

Elements of contract: Provides:

● SOC Staff Inaugural

Cyberhub Model (IDA L.A. ODell)

• Cybersecurity is a team sport.

• Incident Investigation & Resolution

• Event Aggregation, Analysis, & Reporting

• Real world incident simulation and training

• Resource recruiting & retention

24x7x365 eyes on glass event monitoring

Event identification, triage, investigation, and response

Organizational event facilitation and escalation workflow

Daily briefings on observed events, mitigated incidents, and market threat

Founding entities will participate in site selection

CERT-Certified incident handlers and incident response team

Data sharing amongst participating entities

Program integration and training within your cybersecurity team

Incident disposition and resolution reporting

Cross-entity correlation and alerting

Data sharing infrastructure for multi-entity event analysis

Identification of anomalous behavior across a larger dataset

Incorporation of third party threat feeds

Monthly threat trend and participating entity statistics reporting

Capable of integration with NH-ISAC

Multi-entity drills, education, and perspective

Collaboration on exercises amongst entities and third party organizations

Utilizing entity event types, environments, and third-party threat data.

Integration of incidents mitigated by the Healthcare SOC

“Lessons learned “ are reinforced through developed curriculum and training

Construct and execute programs creating extraordinary talent

• The “enclave” concept is one that

• All entities can then have trust and

• There is a level of value in the

• Out of this thinking the

1. Common purpose and governance

Munson Healthcare-Inaugural Participant

You might also like