February 16, 2017 By Scott Koegler 2 min read

Security is everyone’s business. It can affect the user experience of everyone who has a stake in the organization’s data and the systems that collect and process it.

Chief security officers (CSOs) are tasked with maintaining data security. Their jobs are complex in commercial enterprises, but health care environments pose additional challenges due to the nature of the data, the wide range of users and the massive impact of federal regulations. CSOs need insight into the uses and possible abuses of their systems so they can meet all their obligations.

Shift the CSO’s Perspective to the User Experience

Technology professionals in general, and CSOs in particular, possess tremendous knowledge about the systems they manage. That level of insight is not just a byproduct of their work, it’s a requisite for them to perform their job functions.

The kind of understanding being used to protect health care data assets, however, typically comes from an inside-out view, resulting in highly technical and detailed understandings of processes and actions rather than the outside-in view that most nontechnical users experience. This shift in perspective can make a difference in how CSOs approach systems security.

CSOs understand the technical landscape and the current state of threats they are protecting against. What they may not understand as fully is the myriad ways in which users access the systems. It’s one thing to know what functions are technically possible, but users may be experiencing a variety of pain points that inhibit practical use. Limiting use or access due to security considerations can reduce the effectiveness of the systems. In a health care environment, it can even lead to dangerous consequences.

Identify the Workarounds and Vulnerabilities

People who need access to information through secure systems are generally more interested in accomplishing their tasks than managing security or protecting data. When they can’t get the information they need, they find alternative ways to get it.

CSOs may be able to secure the applications designed to deliver information to individuals securely, but they are often unaware of workarounds users have either discovered or created. CSOs need to meet with their health care users, whether they are employees or patients, to better understand the user experience so they can resolve issues and close any unknown entry points.

These stakeholders may be able to point the CSO to previously undiscovered vulnerabilities simply by talking about how they use their systems. They may not even be aware that their everyday activities are outside the scope of the carefully designed and secure system. CSOs should converse with and observe their users and instruct them accordingly to close up these vulnerabilities.

Apply Insights

CSOs have their own sets of insights that they bring to the table when investigating the security of their systems. Users also have insights to offer that are usually different from those of security professionals. Whether they understand the internal controls of the systems and the array of cyberthreats attacking them, users can make surprising observations by combining their own professional expertise with information they glean from conversations with the CSO.

After engaging in conversations with users, it’s still up to security leaders to make use of those discussions to enhance the work environment, improve access to secure systems and reduce or eliminate problems users encounter when trying to use the information to which they are entitled.

More from CISO

Empowering cybersecurity leadership: Strategies for effective Board engagement

4 min read - With the increased regulation surrounding cyberattacks, more and more executives are seeing these attacks for what they are - serious threats to business operations, profitability and business survivability. But what about the Board of Directors? Are they getting all the information they need? Are they aware of your organization’s cybersecurity initiatives? Do they understand why those initiatives matter? Maybe not. According to Harvard Business Review, only 47% of board members regularly engage with their CISO. There appears to be a…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

C-suite weighs in on generative AI and security

3 min read - Generative AI (GenAI) is poised to deliver significant benefits to enterprises and their ability to readily respond to and effectively defend against cyber threats. But AI that is not itself secured may introduce a whole new set of threats to businesses. Today IBM’s Institute for Business Value published “The CEO's guide to generative AI: Cybersecurity," part of a larger series providing guidance for senior leaders planning to adopt generative AI models and tools. The materials highlight key considerations for CEOs…

Bringing threat intelligence and adversary insights to the forefront: X-Force Research Hub

3 min read - Today defenders are dealing with both a threat landscape that’s constantly changing and attacks that have stood the test of time. Innovation and best practices co-exist in the criminal world, and one mustn’t distract us from the other. IBM X-Force is continuously observing new attack vectors and novel malware in the wild, as adversaries seek to evade detection innovations. But we also know that tried and true tactics — from phishing and exploiting known vulnerabilities to using compromised credentials and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today