Security is everyone’s business. It can affect the user experience of everyone who has a stake in the organization’s data and the systems that collect and process it.

Chief security officers (CSOs) are tasked with maintaining data security. Their jobs are complex in commercial enterprises, but health care environments pose additional challenges due to the nature of the data, the wide range of users and the massive impact of federal regulations. CSOs need insight into the uses and possible abuses of their systems so they can meet all their obligations.

Shift the CSO’s Perspective to the User Experience

Technology professionals in general, and CSOs in particular, possess tremendous knowledge about the systems they manage. That level of insight is not just a byproduct of their work, it’s a requisite for them to perform their job functions.

The kind of understanding being used to protect health care data assets, however, typically comes from an inside-out view, resulting in highly technical and detailed understandings of processes and actions rather than the outside-in view that most nontechnical users experience. This shift in perspective can make a difference in how CSOs approach systems security.

CSOs understand the technical landscape and the current state of threats they are protecting against. What they may not understand as fully is the myriad ways in which users access the systems. It’s one thing to know what functions are technically possible, but users may be experiencing a variety of pain points that inhibit practical use. Limiting use or access due to security considerations can reduce the effectiveness of the systems. In a health care environment, it can even lead to dangerous consequences.

Identify the Workarounds and Vulnerabilities

People who need access to information through secure systems are generally more interested in accomplishing their tasks than managing security or protecting data. When they can’t get the information they need, they find alternative ways to get it.

CSOs may be able to secure the applications designed to deliver information to individuals securely, but they are often unaware of workarounds users have either discovered or created. CSOs need to meet with their health care users, whether they are employees or patients, to better understand the user experience so they can resolve issues and close any unknown entry points.

These stakeholders may be able to point the CSO to previously undiscovered vulnerabilities simply by talking about how they use their systems. They may not even be aware that their everyday activities are outside the scope of the carefully designed and secure system. CSOs should converse with and observe their users and instruct them accordingly to close up these vulnerabilities.

Apply Insights

CSOs have their own sets of insights that they bring to the table when investigating the security of their systems. Users also have insights to offer that are usually different from those of security professionals. Whether they understand the internal controls of the systems and the array of cyberthreats attacking them, users can make surprising observations by combining their own professional expertise with information they glean from conversations with the CSO.

After engaging in conversations with users, it’s still up to security leaders to make use of those discussions to enhance the work environment, improve access to secure systems and reduce or eliminate problems users encounter when trying to use the information to which they are entitled.

More from CISO

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Do You Really Need a CISO?

2 min read - Cybersecurity has never been more challenging or vital. Every organization needs strong leadership on cybersecurity policy, procurement and execution — such as a CISO, or chief information security officer. A CISO is a senior executive in charge of an organization’s information, cyber and technology security. CISOs need a complete understanding of cybersecurity as well as the business, the board, the C-suite and how to speak in the language of senior leadership. It’s a changing role in a changing world. But…

2 min read

What “Beginner” Skills do Security Leaders Need to Refresh?

4 min read - The chief information security officer (CISO) was once a highly technical role primarily focused on security. But now, the role is evolving. Modern security leaders must work across divisions to secure technology and help meet business objectives. To stay relevant, the CISO must have a broad range of skills to maintain adequate security and collaborate with teams of varying technical expertise. Learning is essential to simply keep pace in security. In a CISO Series podcast, Skillsoft CISO Okey Obudulu recently said,…

4 min read