Cyberthreats are no joke, and an attack can have detrimental effects on a health-care organization and its patients. Although numerous providers are working to keep external entities out of their IT infrastructure, patient information can often be exposed by internal players in a hospital.
In April, HIMSS Media conducted a survey on behalf of SailPoint, a software company, to learn more about this topic. In total, 101 individuals from hospitals, IDNs and health systems took part in the survey. The respondents held various roles in both the IT and business/clinical settings.
Participants were asked to rate their level of concern about insider cybersecurity threats, with 1 being not at all concerned and 10 being extremely concerned. The mean score was 8.2.
Diving deeper, the study found that depending on their job, respondents had a slight difference in concern level. For instance, 52 percent of those in business/clinical roles rated their worry about insider threats at a 9 or a 10. But 42 percent of individuals in IT positions rated their concern at the same level.
The survey also had respondents compare their concern for internal breaches against their concern for external ones.
Among all participants, 34 percent said they’re more concerned about insider events than external threats, while 26 percent indicated they are less concerned with insider threats than external breaches. Forty-one percent said they’re equally bothered by both.
But of those implementing and managing cybersecurity solutions, the numbers changed a bit. Forty-three percent said they’re more worried about insider threats than external ones, and 22 percent noted they’re less concerned with insider threats than external breaches. Thirty-five percent indicated they are equally worried about both types of threats.
Training appears to be a top strategy for preventing harmful insider events. Seventy-eight percent of respondents said they use training and awareness programs for employees and non-employed users to thwart such situations. Other actions include using data-loss prevention tools (58 percent of participants), using identity governance (56 percent) and behavior monitoring and analytics (48 percent).
Survey respondents seem to see the value in being able to monitor and analyze user access behavior. When asked to rate its importance on a scale of 1 (not at all important) to 10 (extremely important), 43 percent of individuals gave it a 9 or 10. Another 42 percent gave it a 7 or 8 rating.
“While training and awareness programs remain a commonly deployed tactic, organizations are falling short of providing the proper tools and technology that enable best practices,” the survey concludes. “Healthcare providers seeking to mitigate insider risks would be wise to consider adopting a truly comprehensive, intelligent identity solution as a foundation for governing and protecting on-premises or cloud applications and data files.”
This article was written by Erin Dietsche from MedCity News and was legally licensed through the NewsCred publisher network. Please direct all licensing questions to legal@newscred.com.
