| | April 20169UTLOOK Healthcare Tech scams. And while health systems like Piedmont are vulnerable to financial loss, we're also at risk of exposing patient information.To reduce cyber security risk factors, it's crucial to be proactive in following the National Institute of Standards and Technology (NIST) framework. A significant part of this is providing education and awareness training to employees and other allied staff. Some of our employees still hear the word "hacker" and envision quick-fingered coders staying up all night trying to break into the company system. We set out to show how anyone with a company email address is capable of getting hooked by the social engineering of a phishing scam.We brought in a third-party security firm to send a group of employees an email that looked like it came from a certified Microsoft partner and IT manager. The email contained a link, which when clicked asked users to enter their personal Piedmont login and password. If it were a real threat, the attacker would have obtained the credentials needed to log in to our system and access sensitive information.Behind the scenes, the exercise was implemented on a need-to-know basis. When the suspicious email arrived, the layers of defense were activated. Some unknowing security team members alerted others and tried to stop the email from going to employees' inboxes. Of course we had to let it survive--only then could we see what the behavioral response would be.The sample of selected recipients represented a range of employees, from C-level to clinical staff, and even some in the IS Department. Of those who received the baited email, 47 clicked on the link and 20 employees gave their unique Pied-mont username and password. As we anticipated, employees of all levels were tricked into clicking on the link and entering their information. Was my team really surprised by the percentage of users that linked on the link and provided credentials? No, but the data confirmed the need for education and training throughout Piedmont for staff and leaders alike. A system's technical integrity is critical to protecting patient health data, but as we invest in infrastructure and technology, we must also invest time and resources to educating the many individuals that make up an organization. Just like technology, human behavior can be predictable, and attackers will expose the vulnerability of even the most intelligent, successful and savvy.Conducting this phishing exercise allowed us to implement immediate tactical solutions, such as a header notification calling attention to all outside e-mails, and gain more traction with our key stakeholders and decision makers. The exercise illustrated the need for security budgets to keep pace with the increasing variety of threats, and proved the need for ongoing improvement strategies to transcend typical campaign limits, so cyber security becomes part of the Piedmont way of doing business and keeping patients safe. Cyber security is the hot topic of today, but it's also going to be the topic of the future. So if it's not being talked about in your organization's board room, I suggest you break the ice! HT"Behind the scenes, the exercise was implemented on a need-to-know basis. When the suspicious email arrived, the layers of defense were activatedGeoff Brown
< Page 8 | Page 10 >