Healthcare & Pharma Virtual Cybersecurity Summit

Too often, we regard compliance as an anchor, not a sail to our goals. We will explore the types of compliance and the root causes of negative attitudes towards it. More importantly, we will discuss strategies around using compliance to your advantage and how you can balance it with security imperatives.

A disturbing trend should be top of mind for anyone following the security industry in recent years. We have seen a large uptick in investment in security tools by organizations, but we have not observed a corresponding decrease in breaches and ransomware attacks. This paradox should be raising a serious question among security leaders as to what we as an industry are strategically doing wrong. Why are we not getting improved outcomes against attackers with all of this increased investment? 

This presentation will answer the question by demonstrating an evidence-based framework for information security management that focuses on using emulation of attacker techniques as a means of quantitatively measuring control efficacy. Examples will be given to illustrate the evidence-based approach and how it readily reveals that security tooling alone does not often provide the level of protection that one might assume. The presentation will illustrate how to identify weaknesses in current tooling and control sets and develop needed compensating controls to ensure that security teams are providing actual security to their organizations and not just the illusion of security.

Some call it the wall of shame – the U.S. Government website that lists healthcare data breaches since 2009 – breaches which have put millions of patients’ Protected Health Information (PHI) at risk. The site, run by HHS, listed more than 5,000 events impacting nearly 438 million breached PHI records when we reviewed it in 2023. That averages to more than 86,000 PHI records exposed every single day for the past 14 years. The breach disclosures highlighted here are just an indicator --just one piece of the very complex reality of cyber security in the healthcare sector. 

In 2023, we saw record number of ransomware attacks, phishing, espionage and data breaches impacting healthcare organizations globally. The presentation will review these latest threats. 

Attendees will be provided access to Health-ISAC's Annual Cyber Threat Landscape Report and industry resources that can be used to improve cybersecurity in their own organizations.