The vulnerability of healthcare IT systems can be resolved.
INTERNET OF THINGS
Security and privacy issues
MOUNTAINWEST HEALTH SYSTEM AND CYBERSECURITY Environment
Cultural Influences
Economic Influences
Political Influences
Strategy Aim: Cybersecurity strategy that is inclusive of MHS‘s supply chain
Internal and external risk
Internal Processes Organizational Structure
Personnel
Mountainwest Health System (MHS)
Aim: Improvement of healthcare quality, safety, patient experience with focus on new innovations and growth
Indirect Direct Core Software Providers
Patients MHS Employees MHS Facilities
Government agencies
Tier ‘n’ suppliers Device Manufacturers
Non-MHS hospitals (in GPO)
MHS is part of a complex ecosystem.
§
§
§
Loosely structured healthcare system Unequal distribution of healthcare providers Lack of IT experts
§
§
§
§
Utilization of existing technologies Controlled data access Reduction of breach lifecycle Looser regulations
Threats
§
Maintaining and sharing patient information Efficiency: Digitization & automation
Opportunities
§
Weaknesses
Strengths
SWOT ANALYSIS OF THE HEALTHC ARE AND CYBERSECURITY LANDSC APE
§ Increase in cyberattacks § Trust (Patientside, in suppliers) § Hardware and software restrictions § Adverse government policies
MAIN THREATS
INTERNAL ACTORS
58 % of nearly 1,400 healthcare incidents analyzed in involved insiders
THIRD-PARTIES
56 % of organizations had a breach caused by their vendors
HARDWARE AND SOFTWARE
Companies blindly trust their hardware and software providers
MHS‘S VALUE PROPOSITION Supply by MHS
Customers
Partners
Experience
▪ Medical- and nonmedical related ▪ Hard- and software
▪ Aim: Quality, safety, patient experience (e.g. digital healthcare)
§ Affordable § Easy to access § Less bureaucracy
Wants
§ Dehumanization of healthcare § Theft of personal data
Fears
Fit Needs
Benefits ▪ Large geographical coverage ▪ Innovative care
Features ▪ Medical- and nonmedical related ▪ Hard- and software
Costs
§ Trust § Involvement § High quality
Revenue
EXTENDED ZERO TRUST STRATEGY
Fit ✚
Addresses main threats
✚
Guarantees patient privacy
✚
Proven in digital healthcare (e.g. DXC.technology)
MHS
CUSTOMERS
Zero Trust Strategy
- John Kindervag, Forrester Research
§ “Trust only what you know.“ §
Trust is seen as a vulnerability
§ “Never trust, always verify.” §
All users are equally verified and equally able to gain access
§
Eliminates the outsider-/insider-paradigm
Benefits ✚ Builds on existing architecture and technology ✚ Simple to implement ✚ Possibility for joint shared risk model with supply chain partners
Limitations −
Cost intensive
−
Complex
−
Long-term implementation (Google: 6 years)
1. Identify the protect surface II. Map the transaction flows D E P L OY I N G A ( E X T E N D E D ) Z E RO T RU S T S T R AT E G Y
III. Build a Zero Trust architecture IV. Create Zero Trust policy V. Monitor and maintain
MHS‘S SUPPLY CHAIN Upstream
Downstream
Inventory Management
Patients Information
Purchasing
Supplier ‘n‘
Cash Manufacturer/ Software Producer
Transport Management Physical flow Internal Supply Chain MHS
INTEGRATING “ZERO TRUST INTO “MHS‘S SUPPLY CHAIN
“Go from too many unknowns to trusting only what you know.” - Jeff Pollard, principal analyst in cybersecurity at Forrester Research §
Reduce number of suppliers, where possible
§
Create supply chain transparency è stronger supplier selection criteria
§
Integrate processes with partners
PROOF OF FUNCTIONALITY OF A ZERO“ZERO TRUSTTRUST" STRATEGY SUPPORT IN HOW TO IMPLEMENT Access policies
Kipling Method: Who, what, when, where, why and how
Cyber incident response plan Organizational structure
Training Partnerships
§ Companies offering zero trust platforms § American Hospital Association (AHA): Learn more about cybersecurity risks for hospitals
IMPLEMENTING ZERO TRUST: CYBER INCIDENT RESPONSE PLAN
1. Prepare for the possibility of a security incident 2. Identify the type of incident 3. Begin containment and cleaning-up of the incident 4. Eradicate the breach 5. Recovery for being back in production 6. Review lessons learned
Companies Offering “Zero Trust“ Platforms
PROOF OF FUNCTIONALITY OF A ZERO TRUST STRATEGY
“Zero trust as a viable option to support digital Healtchcare.“ - DXC.technology
ZERO TRUST STRATEGY § Securing the network’s most critical and valuable data, assets, applications and services (DAAS)
EXTENDED ZERO TRUST STRATEGY FOR MHS § Updating MHS‘s technology § More secure than only adding layers of protection
§ Continuous improvement Micro-Perimeter
DAAS
§ PDCA-circle
Additional suggestions 1. RFID 2. Private cloud 3. Hackathon
SUGGESTION I: IMPLEMENT RFID TECHNOLOGY
REASONS FOR IMPLEMENTING RFID Goal §
Increase patient safety by ensuring the products entering MHS facilities are genuine Reduction of gray market and counterfeit products in supply chain
§
A non-genuine product has the potential to both harm the patient and MHS’s reputation
PROOF OF CONCEPT Reduction occurrence of gray market and counterfeit products in various industries
ยง
Success Story of WaliMai ยง
Successfully reduced the occurrence of dangerous counterfeit baby formula by implementing RFID technology
− Older technology (Obsolescence risk) − Large initial investment − Supplier pushback − Additional devices connected to IoT, causing increased IT system vulnerability
Risks can be mitigated by implementing the extended zero trust strategy
L I M I TAT I O N S
BENEFITS OF RFID
Increased asset Increased labor utilization utilization
Reduced Higher visibility Identification Unique and shrinkage of assets in the and unduplicable supply chain differentiation chips of objects by using radio waves
Chips unremovable without causing damage
Reduction of gray market and counterfeit products
Justification of initial investment
REASONS FOR CHOOSING RFID OVER BLOCKCHAIN RFID
Blockchain
✚ Has been studied and tested for many years
−
Needs another 5-10 years before it is mature
Maturity as Cut-Off Criteria §
Implementation of untested and unproven technology is extremely risky and unpredictable è Higher cost
Innovation
Tradeoff
Feasibility
Blockchain
RFID
Partnership with the USbased company “Vizinex“
I M P L E M E N TAT I O N OF RFID TECHNOLOGY BY MHS
§ RFID tags on finished goods level of one supplier Pilot Project
Rollout § RFID tags on finished goods level of all 20 hospitals of MHS
§ RFID tags on the component level for all suppliers and facilities of MHS Ideal Future State
ROI ASSUMPTIONS §
§
Assumptions for average MHS hospital: § 300,000 square feet § 120 beds § 300,000 square feet § 670 employees § 4000 assets to be tagged (Only assets over $30 in value, e.g. pumps, gurneys, and defibrillators) Example cost: § Equipment costs § Training costs § Installation costs § Tag costs § Software costs § Maintenance costs
Cost for a full-scale RFID implementation per hospital:
$350,000
SUGGESTION II: ADAPTATION OF PRIVATE CLOUD
GOAL
OUTCOME
§ Securing patient data and PHI
§ Creation of processes that can be used to detect data breaches quicker
§ Creating awareness of the importance of “software updates” for upstream supply chain partners
§ Reduction of data breach life cycle
P RO O F O F C O N C E P T: AT M S Driving ATM software and operations into the cloud: ✚ Cuts costs up to 40 % ✚ Bank with 100 ATMs can have savings up to 800,000 USD a year ✚ Easy transactions processes: e.g. provision of omni-channel experience ✚ Design of the software to eliminate malware: e.g. remote control ✚ Ability of transactions and services to be shared and re-used elsewhere: e.g. UK
PROOF OF CONCEPT Application by CardTronics §
One of the largest ATM owner/operator of the world
§
More than 110,200 retail ATMs in U.S. and international locales
Why financial institutions? §
Containing sensitive information
§
ATMs’ being prone to cyber attacks due to easily accessible USB slots
BENEFITS OF A PRIVATE CLOUD ✚ Quickly available applications in the cloud platform ✚ Automatically synchronized data ✚ A “remote wipe” capability ✚ Reduction of costs ✚ Increased efficiency ✚ Optimized scalability
Not easily adapted by traditional hospitals (Being unsure, reluctant, resistance to adapt)
LIMITATIONS
Need to overhaul the infrastructure of hospitals − Requirement of better experience for selfservice system − Additional costs Risk Mitigation by: § Targeted communication strategy to overcome resistance § Implementation plan that takes, for example, traditional employees into account
IMPLEMENTATION OF A PRIVATE CLOUD BY MHS
Partnership with Microsoft Healthcare Azure API for Health Record Sharing
Protection Against Fake Updates
✚ Creation of a secure cloud API platform
✚ Impossible to update without visiting the website
✚ Usage of FHIR (Fast Healthcare Interoperability Resources)
✚ No “new update” emails from the company
✚ Successful application by banks, financial service providers, chemical industry, health services, medical technology, and insurance industries
✚ Avoidance of trojan horses with Microsoft Security Essentials (MSE) antivirus
✚ Automatic updates to keep the system current
IMPLEMENTATION OF A PRIVATE CLOUD BY MHS
Partnership with Microsoft Healthcare Microsoft 365 for Hospital Teams
Microsoft Healthcare Bot
✚ Secure communication
✚ Built-in symptom checker
✚ Delegation of important tasks through the platform
✚ Understanding of medical terminology ✚ Triaging patients
✚ Integration of electronic health records system
Utilizing Microsoft Healthcare‘s expertise in cybersecurity ensures that MHS can concentrate on their core competency: Patient care.
REQUIRED INVESTMENT Loss Range of US-Hospitals due to Cyberattacks §
Between $ 3 million and $ 10 million
§
Average loss: $ 6.5 million
Microsoft Healthcare §
Combination of “Value-Based Care” and Fee-for-Service
§
Cloud flat rate per year: $ 658,972
$ 658,972 $ 6,500,000
1. Subscription Fee for Patients a. Fee-for-Service: Paying for each service separately b. Flat rates starting from 1 year up to 10 years
T H R E E WAYS TO MONETIZE
II. Bundle Price for Patients a. Episode-based payment b. Bundling similar services, e.g. blood analysis related services, otolaryngology – ENT services
III. Patient Specific Pricing a. Clustering patients based on services b. Depending on the type of the service, e.g. contagious diseases, hard-diagnosed diseases, rare diseases
SUGGESTION III: CONDUCTING A HACKATHON
Creative problem solving
MOUNTAINWEST HEALTH SYSTEM HACKATHON – EXTENDING “ZERO TRUST“
Goal Detecting points of vulnerability in MHS‘s supply chain è Incl. testing the potential benefits of: § RFID § Private cloud § Extended zero trust strategy
PROOF OF CONCEPT Top Industries for Hackathons
3,450 Hackathons in 2016
1,568 MHS Hackathon
470
230
Tech
33.4 %
Finance
10.0 %
Retail
8.6 %
Health
7.9 %
Manufacturing
7.9 %
Telecom
5.7 %
Other
26.5 %
REASONS FOR A STUDENT HACKATHON MHS Student Hackathon
75 %
✚ New and innovative ideas ✚ Testing new system and its vulnerabilities before its rollout ✚ Corporate MHS hackathon not feasible ✚ (e.g. Google has much bigger IT team) ✚ Employer branding ✚ Creation of brand awareness
25 % Public Hackathons
Internal Hackathons
PARTICIPANTS
This ensures the participants have adequate knowledge
BENEFITS FOR STUDENTS
Experience
Company insights
Parallel track for workshops, networking and mentor program
Winners can participate in RSA Conference
Travel expenses
External communication needs to emphasize student benefits è Clarify that MHS wants to give students a chance, not just use them for cheap labor
Chances for an internship, postgraduation job
IMPLEMENTATION AND ACTION PLAN Strategic decisions
Ideation process
Plan
Preparation of hackathon
Two-day hackathon
4 months before
Day Zero
Do
10 months before
6 months before
First idea & funding
Call for applicants
Award ceremony
Check
HR follow-up
Ongoing
Act
~ 1 month Preselection
Repeat
Proof of concept
Before roll-out Implement changes
IMPLEMENTATION: FIRST IDEA AND FUNDING Partnerships to reduce resources and cost for MHS University of Kansas ✚ One of the 20 best cybersecurity schools in the US ✚ Free/cheap venue ✚ Technical requirements given (e.g. Wifi, computers)
ChallengeRocket. com ✚ Experienced partner in organizing hackathons ✚ Less effort and resources required by MHS
Microsoft Health Care ✚
Vizinex
Proof of concept for MHS
Others §
Local suppliers (e.g. food, advertisement)
§
Media
✚ Cost savings
CALL FOR APPLICATIONS §
Extensive communication since it is a new event (e.g. campus marketing, direct contact with professors)
§
Team size: 2 – 4 individuals
Applications for one of three spectrums RFID - Application for Hardware I. II. III.
Private Cloud - Application for Software
Hack replica of system before new technology implementation Hack replica of system implemented in pilot phase Ideas for improvement
Business Processes - “Zero Trust“ Implementation Possible projects: § Data access policy § Supplier selection crieria § Cyber incident response plan § Organizational structure
3 teams per spectrum are invited for the 2-day hackathon (max. 36 participants)
REQUIRED BUDGET Currently unknown if proposed partners cooperate (physical goods and financial support) è After pre-selection, invite 3 teams per spectrum, max. of 4 people per group (36 participants) $50 per participant per day – food, misc. (2 days) $50 per participant per day – housing in a shared hotel room (2 days) $200 for travel expenses
Estimated đ??śđ?‘œđ?‘ đ?‘Ą = $50Ă—2 đ?‘‘đ?‘Žđ?‘Śđ?‘ + $50Ă—2 đ?‘‘đ?‘Žđ?‘Śđ?‘ Ă—36 đ?‘?đ?‘Žđ?‘&#x;đ?‘Ąđ?‘–đ?‘?đ?‘–đ?‘?đ?‘Žđ?‘›đ?‘Ąđ?‘ + $200 ∗ 36 đ?‘?đ?‘Žđ?‘&#x;đ?‘Ąđ?‘–đ?‘?đ?‘–đ?‘?đ?‘Žđ?‘›đ?‘Ą = $10,900 + Buffer = $15,000
OUTCOME MEASURES & Q U A N T I F I C AT I O N O F R E S U LT S
Tangible
Intangible
Spectrum I and II:
Overall hackathon:
Determine how often the replica system was hacked (Old and improved one)
Multiply by the estimated cost of a breach
§ Quality of ideas/innovations (Evaluation by judges) § Participant’s satisfaction (Survey) § Recruiting benefits – number of contacts made and response rate
IMPLEMENTATION AND ACTION PLAN Kotter‘s 8 Step Change Model I. Creating a climate for change §
Extensive communication to overcome resistance of change from employeees and patients
Three Phase IT Migration - recommended by Google‘s deployment team III. Implementing and II. Engaging and enabling the whole organization sustaining change Hackathon III. MHS-wide II. Early I. Core IT Adoption adopters
Set up of MHS‘s “Cyber Initiative“
1
2
3
Create urgency
Create a coalition
Develop vision and strategy
4 Communicate the vision 2 years
5 Empower action
6
Get quick wins
8
7
Leverage wins to drive change
Embed in culture
3-4 years
COMMUNICATION AND ENGAGEMENT STRATEGY MHS Employees §
Kickoff Information Event §
§
Short introduction at every MHS facility
Change ambassadors §
Intrinsic motivation of change to convince other employees of “Cyber Initiative“
§
Create feeling of “bottom-up“ change by involving them in decision making
Patients § Personas § Segment different degrees of “resistance“ by patients and train employees how to handle each one
§ Brochures, posters and newsletter § Information about the benefits and security side of the technologies
§ Information events § E.g. invitations for final pitch of Hackathon
Goal: Overcoming resistance, creating trust and engaging the most important stakeholders
OUTCOME MEASURES Hard KPIs
Soft KPIs
§ Reported incidents
§ Patient satisfaction (e.g. patient survey)
§ Number of major security incidents
§ Employee satisfaction (e.g. employee survey)
§ Number of small security incidents (To set priorities)
§ Employee involvement (e.g. workshops conducted)
§ Cost per incident § Amount of time to resolve an incident § Downtime during an incident § Employee turnover § Interactions of employee devices on network § Number of patients
By investigating these KPIs, the improvement achieved by MHS‘s “Cyber Initiative“ can be monitored
ROI OF MHS‘S CYBERSECURITY INVESTMENT
(Hypothetical loss from cybersecurity attacks – Investment to prevent) Cost of investment = % ROI of Cybersecurity investment
§ Hypothetical loss from cybersecurity attacks §
Average total cost of a data breach in the healthcare industry: $6.45 million
§ Investment to prevent §
Implementation of extended zero trust strategy, including cost for RFID implementation, private cloudservice and hackathon costs
FUNDING “Black Book’s annual cybersecurity survey reveals healthcare enterprises are not maturing fast enough, processes continue underfunded and understaffed,”
§
Government grants Global healthcare cybersecurity spending will exceed $65 billion cumulatively over next five years
§
§
Examples of organizations MHS could potentially receive funding from to undergo research §
European Commission
§
National Institutes of Health
§
Food and Drug Administration
Potential Grant:
SCALABILITY & TRANSFERABILITY
MHS
Transferability ยง
Other devleloped countries with similar healthcare structure
ยง
Develping countries critical since e.g. corruption makes it hard to build reliable bonds with partners
Scalability ยง
Zero trust strategies have a different scope depending on main threats of the healthcare system
ยง
High investment hindering factor, but business processes easy to adapt