Rajesh Maurya
Regional Director, SAARC, Fortinet

To successfully compete in the new digital economy, healthcare organisations need to implement a tightly coordinated security strategy that can see & govern data across an entire borderless network without compromising agility or performance, shares Rajesh Maurya, Regional Director, SAARC, Fortinet exclusively with Elets News Network (ENN)

We have lately seen an unimaginable 340 per cent increase in the number of targeted cyber attacks in healthcare sector. Keeping this in mind, please enumerate the measures undertaken by Fortinet to go beyond the Health Insurance Portability and Accountability Act (HIPAA) to ensure data protection?

Currently, healthcare networks are undergoing dramatic change. Organisations are simultaneously wrestling with issues, such as bring your own device (BYOD), the Internet of things (IoT), virtualisation, software-defined networking (SDN), cloud, the proliferation of applications, big data, and the expectations of the next generation of employees to blend their work and their personal lives on a single device of their choice, with instant access to any data, at any time, from any location.

This has exponentially increased the attack surface that organisations need to be concerned with. For example:

IoT and cloud solutions mean organisations need to worry about an attack surface that many times may not be visible to IT.

Many IoT devices are headless, run simple communications protocols, and are unable to run a client or even be patched. They rely exclusively on the access network for security.

Critical and proprietary business and patient data is being moved into the cloud and managed by third parties. Known as Shadow IT, this trend is expanding, with many organisations simply unaware of where data is currently located or what security measures are in place to protect it.

The transformation to a digital business model has extended the network beyond the perimeter, which means that todays networks and their related security are becoming borderless.

BYOD devices are highly mobile, blend personal and work profiles, and represent real risk as critical data is accessed from public locations, or when devices are lost or stolen.

The response to increasingly complicated networked environments needs to be simplicity. Securing these evolving environments requires three things:

Collaborative intelligence: Local and global threat intelligence needs to be shared between security devices, and a coordinated response between devices needs to be orchestrated centrally.

Segmentation: Networks need to be intelligently segmented into functional security zones. End-to-end segmentation, from IoT to the cloud, and across physical and virtual environments, provides deep visibility into traffic that moves laterally across the distributed network, limits the spread of malware, and allows for the identification and quarantining of infected devices.

Universal policy: A centralised security policy engine that determines trust levels between network segments, collects real-time threat information, establishes a unified security policy and distributes appropriate orchestrated policy enforcement.

This is the reason why Fortinet has introduced its new security fabric architecture. It is designed to integrate security technologies for the endpoint, access layer, network, applications, data centre, content and cloud into a single collaborative security solution that can be orchestrated through a single management interface.

In case of any IT disaster or electronic media errors, what technical measures have been put in place to ensure patient information is recovered accurately? How do you plan to leverage advanced cybersecurity technologies to provide a new level of defensegrade cybersecurity?

A clear detection and remediation process is an essential part of a good network security system, because no matter how much money companies spend on security, no organisation is 100 per cent secure from breaches. Every organisation needs a clear incident response plan to ensure you have processes, procedures and skilled resources to quickly identify and mitigate threats as soon as they hit your network.

Once an intrusion has been validated, users, devices and content should be quarantined, with automated and manual systems in place to ensure the safety of network resources and organisational data. Previously unknown threats should be forwarded and analysed in depth, resulting in updates being fed back to the different services in the network providing every layer with the right mix of up-to-date protection.

Prevention is better than cure and our Cyber Threat Assessment Program (CTAP) is designed to provide organisations with a detailed look into the type and amount of cyber threats posing risks to their networks, yet are going undetected by their existing security solutions. This new offering is part of a broader effort by Fortinet and its FortiGuard Labs threat research team to integrate risk and advisory capabilities with its end-to-end security platform to provide customers greater insight into dynamically changing cyber risks that threaten their businesses.

According to the statistics available, healthcare organisations have chronically underinvested in IT security measures to protect its data and electronic health records (EHRs). In the light of the above, do you see an increased investment in data protection in the Indian healthcare institutions?

Even within the healthcare industry, few people realise just how vulnerable many of our systems are to cyberattacks. We talk about protected health information (PHI) and HIPAA compliance, as well as worry about penalties, but few organisations see themselves as targets for the sophisticated attacks that have wreaked havoc for the likes of Anthem.

The reality, though, is that the black market for patient data is up to twenty times more valuable than that for credit card data often stolen in retail breaches. Healthcare data is detailed, rich and full of information that cybercriminals can use for identity theft and fraud. More importantly, it takes far longer for patients to know their information has been compromised “ it can take up to a year or more for someone to realise that their patient data has been compromised.

According to Frost & Sullivan, the expected spending in India on network security in 2016 by education vertical is US$ 20 million and manufacturing is US$ 38 million. The healthcare vertical lags far behind in terms of investment in network security, leaving it far more vulnerable than its peers in other industries.

The time to address healthcare security is not when medical record breaches like the Anthem start making headlines. The time is now. The healthcare industry as a whole needs to be proactive and begin deploying systems with security baked in, protected at both the network and application levels. The stakes are simply too high to wait.

Indias digital capabilities to protect crucial infrastructure and data lag significantly behind the regional and global players due to lack of investment & expertise. What measures are being undertaken by Fortinet to address this problem?

For 15 years, Fortinets dedicated security research team, FortiGuard Labs, is leading the industry in innovation powering all Fortinet top-rated security platforms. This accomplished group is composed of security threat researchers, engineers and forensic specialists tasked with outsmarting the cybercriminals and delivering cutting-edge protection tools to our customers.

FortiGuard Labs offers real-time intelligence on the threat landscape, delivering comprehensive security updates across the full range of Fortinets solutions. The team collaborates with the worlds leading threat monitoring organisations, other network and security vendors (leading the first multi-vendor cyberalliance), and law enforcement, both advising on new threats discovered by patented technology and examining new network trends. Based on this synergetic approach, the FortiGuard Labs team specialises in developing new adaptive defense tools to help protect against multivector targeted attacks.

In India, we have a Technical Assistance Centre (TAC) situated in Bengaluru (Bangalore). Besides providing Level 1, Level 2 and Level 3 phone support to Indian and the South Asian Association for Regional Cooperation (SAARC) customers, Fortinets team at the TAC will oversee professional services and technical account management, ensuring expert and timely deployment of local projects.

The company has also invested in highly skilled engineering resources to help customers solve difficult technical issues and deploy complex architectural designs and implementations. These resident engineers will have direct access to Fortinets developers and support resources for on-site or off-site implementations, and will ensure a timely, precise and complete service experience for customers.

Our professional & support services are designed to ensure critical replacements and technical assistance are readily available to customers at any point of time to ensure business continuity. Our support service complements our world-class technology solutions with enterprise-grade support to match our customers needs and expectations.

In terms of data protection, healthcare stakeholders are witnessing more challenges now than ever, as we now not only have vulnerable digital connected medical devices but also home-based digital health devices with no in-built security measures. How is Fortinet planning to confront this challenge in a largely unregulated country like India?

Today, everything from heart monitors to IV pumps can be networked, automatically interfacing with EHR systems and providing real-time alerts to healthcare providers. From the perspective of patient care and operational efficiency, this is a good thing. From a security perspective, its a potential nightmare.

Most of these devices, as well as magnetic resonance imaging (MRI) machines, computed tomography (CT) scanners and countless other diagnostic machines were never designed with security in mind. Many diagnostic systems use off-the-shelf operating systems, such as Microsoft Windows, while other devices use purpose-built software designed to collect data – not keep it safe.

Device proliferation isnt just occurring in hospitals. An increasing numbers of home health devices, mobile apps, wearables, and more are collecting and transmitting personal health information. Not only do these devices and apps potentially expose patient data (or at least fail to adequately protect it), but they also often interface directly with EHR and clinical data systems. When everything from a home glucose monitor to an iPhone app can become part of the attack surface, it should become clear just how badly exposed healthcare institutions are.

Fabric Security is Critical to Sustain Business Innovation in the Healthcare Industry

Todays digital-driven healthcare organisations connect more users, devices, applications and data than ever before to drive business value. Billions of new Internet Protocol (IP) enabled, non-user IoT devices are transmitting vast amounts of data traversing wired and wireless access points, through both public and private networks, and across traditional and cloud infrastructures. To successfully compete in this new digital economy, healthcare organisations need to implement a tightly coordinated security strategy that can see and govern this data across an entire borderless network without compromising agility or performance.

Fortinets Security Fabric Delivers Security Without Compromise

To address the challenges brought on by the digital economy and subsequent evolving enterprise IT infrastructure, Fortinets Security Fabric brings traditionally autonomous systems together into a single architecture, designed with five critical and interdependent attributes “ scalability, awareness, security, actionable and open.

In comparison to the major powers, such as the United States (US) & China, India confronts the problem of digital disconnection and density. What are your recommendations to address this problem?

An effective defense is often founded on building a cohesive and extensible protection framework. This framework is critical as it incorporates current security capabilities, emerging technologies and having a learning mechanism that creates actionable security intelligence from newly detected threats. Other measures include assessing the network environment and devising a response plan. It is important to secure potential bottlenecks, monitor the network, and ensure they look beyond large attacks and plan countermeasures.

A strong partnership with a security provider is also essential. The partner can provide up-to-date information and threat intelligence to the IT staff, as well as define an escalation path when an incident is detected. The government agencies should also proactively partner cyber security organisations and solution providers to share threat information, so that collectively, the industry can have a more comprehensive view of the global cyber threat landscape and respond better to attacks.

Lastly, while a comprehensive assessment and plan can be developed, it is crucial to educate government employees on cyber threats. Employees with access to sensitive information have to be specially trained to know how to deal with that data.

Like

Dislike

Be a part of Elets Collaborative Initiatives. Join Us for Upcoming Events and explore business opportunities. Like us on Facebook , connect with us on LinkedIn and follow us on Twitter , Instagram.