Musings of a Corporate Consigliere

Thoughts & Advice on Consulting Challenges

Home Archives for Mike Meikle

Leave a Comment

Technology Planning. 11 Tips for SMBs.

The model(s) behind technology spending has been changing dramatically over the last several years with virtualization, consumer devices and “as a service” offerings complicating the procurement process.  While they offer tremendous opportunities for astute technology consumers, there are also significant risk that the unprepared enterprise technology consumer may realize with insufficient information.

Add to this the increasing cybersecurity concerns, regulatory compliance regimens and staffing issues; even the largest firms are facing difficulty making informed decisions.

One of the questions I get from my small business clients is how can I perform technology audit to take stock of what it has, identify gaps, and create a plan for new tech purchases?

The first step would be to look at your enterprise strategic plan.  What are your business goals for the next three years?  What technologies would facilitate reaching those goals? Do you have technologies in house that fill that need currently? Can they be upgraded or configured to meet these objectives?  If not, what technologies are available (Cloud or on-premise) to meet your objectives?

These very high level steps fall into the basic strategic planning process, governance and portfolio management. [Read more…]

Leave a Comment

New Security Risks for 2016?

Not really.

Security risks for 2016 look a whole lot like those for 2015 and, if we are honest, 2005.

Alright, so nothing really new, but what are the biggest vulnerabilities and threats facing US businesses?

The top attack surfaces are going to be mobile devices (smartphones & tablets), cloud services, unpatched vulnerabilities and poor security risk management.  Unpatched vulnerabilities has been the top target of malicious actors since the beginning of computer hacking.  With the OPM breach and the details surrounding it, it provides malicious third parties the impetus to continue pushing in that direction.

Securing data in the Cloud can be problematic, before the added complexity of managing the data on a mobile device.  However, mobile platforms (phones, tablets, etc.) are becoming the access point of choice for the enterprise and so this issue needs to be addressed swiftly.

What should a companies’ leadership do to prepare for or thwart a cyber security attack and data breach? 

Defense-In-Depth.  That should be a phrase that all enterprise leadership should understand. [Read more…]

2 Comments

Rise of the Cyber-Industrial Complex?

Is there hype and hysteria around security breaches?  Is this going to give rise to a cyber-industrial complex?  These questions were recently posed to me by a client at a large insurance company.

Well, let’s look at the current situation. Security breaches are growing in scope and visibility due to the increasing automation and interconnected systems, mobile devices and the sharing of personal data.  The financial incentive is there for the criminal, nation-state, malicious actor to perpetrate these crimes.

Cyber-security preparedness in the business community, while becoming more visible in recent years, is still far behind the curve when compared to those who wish to commit cybercrime.  There is still a tremendous disconnect with employees and general public regarding the current security threats and what impacts their behavior have in propagating or thwarting a breach.

People should be concerned about security breaches since personal data can be used to damage or destroy an individual’s financial and even personal life.  An example of this is the OPM breach were millions of pages of security forms were stolen that contained intimate details of individuals.  These can and will be used for leverage against those federal employees in sensitive positions within the government by malicious actors.
Are cybersecurity companies using these incidents as a means to feed the hysteria behind breaches?  Of course they are.  You see this in any industry when a company sells a product or service that can remediate concerns faced by that industry. However, security is still a comparatively low priority at the executive level within corporations.  This is changing, but it remains bailiwick of technologists who have minimal say in enterprise decision making. [Read more…]

Leave a Comment

Endpoint Protection – A Few Tips

There are a few big misconceptions that companies have about endpoint security tools.  It starts with a belief by executive leadership that you can buy a product that will plug gaps without significant internal costs.  This of course leads shoddy product implementations, little to no training on the new product and lack of resources assigned to the product once it’s in production.

The end result of this philosophy is  IT and security are left with a piece of hardware or software that few know how to effectively use and do not have the staff to truly manage it.  It is important to note that poorly managed security tools  have lead to some of the largest security breaches (Target, Sony, Anthem).

So with all that said, endpoint protection is one of the bread-n-butter components of an effective security defense.  It is also one of the most poorly managed components due to the lack of  new technology “sparkle”, such as the latest IDS/IPS tools.

Here are a few tips to bounce against your (hopefully) current endpoint protection (EP) solutions:

  • Endpoint protection must have appropriately configured policies to effective.  Lax policies equal far less protection against aggressive malware.  Review your vendor’s best practices guide on this issue.
  • Your Endpoint protection must be monitored from a central server.  Trained security personnel must follow up on suspicious activity reported by the endpoint software.  You would be surprised how often this is not the case.
  • Endpoint protection is not a panacea for poor patching practices on the end user devices.  Devices that lag behind in patching can be easily compromised by malicious software.  There are too many zero-day and known vulnerabilities for antivirus/malware software to effectively protect against.
  • Employees can often subvert enterprise endpoint protection by uninstalling the software or killing processes depending upon what policies are in place.  Also, employees can respond to phishing emails that can bypass endpoint protection by cloaking malicious processes inside legitimate ones.
  • Keeping your A/V signatures updated isn’t the only challenge.  Ensure you are running current code for your scan engine, HIPS, DLP tools etc.  Maybe not the bleeding edge, but no more than two minor revisions behind.

This list was created based on issues I have found when working with my clients on updating their security program.  Drop a comment below if you have more to add or if you have a question.

Leave a Comment

Medical Device Madness. No Excuses

image by Colin

In my last post, I touched on the issue of cybersecurity vulnerabilities in medical devices and how the healthcare industry struggles to manage this risk.  We also mentioned the June 2013 FDA Safety Memo that outlined what it perceived as the new responsibilities for manufacturers, healthcare entities and the FDA itself regarding the securing of these devices.

Recently I published an online course in collaboration with the Financial Times / ExecSense on this topic.  I covered quite a bit of the problematic history of medical device security as well as some strategies on how to address this issue on the technology and business fronts.  Healthcare leadership push-back on recalcitrant medical device vendors  will be key in addressing this problem.   Painful cultural change will also be necessary.

Review the June 2013 safety communication, the FDA broke down the responsibilities of the healthcare organization, medical device manufacturer and the FDA itself. If you are in the healthcare arena, the document is short and well worth the read (Link Above), but I’ll put up some highlights:

Healthcare Providers
• Monitoring network activity for unauthorized use.
• Making certain appropriate antivirus software and firewalls are up-to-date.
• Protecting individual network components through routine and periodic evaluation, including updating security patches and disabling all unnecessary ports and services

Device Manufacturers
• Take steps to limit unauthorized device access to trusted users only, particularly for those devices that are life-sustaining or could be directly connected to hospital networks. Appropriate security controls may include: user authentication, for example, user ID and password, smartcard or biometric; strengthening password protection by avoiding hard-coded passwords and limiting public access to passwords used for technical device access; physical locks; card readers; and guards.
• Protect individual components from exploitation and develop strategies for active security protection appropriate for the device’s use environment. Such strategies should include timely deployment of routine, validated security patches and methods to restrict software or firmware updates to authenticated code. Note: The FDA typically does not need to review or approve medical device software changes made solely to strengthen cybersecurity.

FDA
• The FDA released a draft guidance on how manufacturers should address cybersecurity in their pre-market submissions. The FDA also has guidance on how manufacturers should address cybersecurity issues related to products that use off-the-shelf software.

The most interesting sentence in the document and the most powerful is The FDA typically does not need to review or approve medical device software changes made solely to strengthen cybersecurity . Of course the inclusion of the word “typically” provides device manufacturers with some significant wiggle room. However this statement begins to take the air out of the standard vendor re-certification argument when it comes to patching and endpoint protection.

Adding more fuel to the fire is the recent release of the Health and Human Services (HHS) Office of Inspector General (OIG) Fiscal Year 2014 Work Plan, which outlines their intent of focusing on medical device security. The work plan states that OIG “will determine whether hospitals’ security controls over networked medical devices are sufficient to effectively protect associated electronic protected health information – ePHI – and ensure beneficiary safety.” The document then clarifies that “Computerized medical devices … pose a growing threat to the security and privacy of personal health information. Such medical devices use hardware, software, and networks to monitor a patient’s medical status and transmit and receive related data using wired or wireless communications.

With both the FDA and HHS OIG now in the act, healthcare clinical project managers and security professionals may finally get the ammunition they need to bend the ear of medical device manufacturers. At present it is primarily the healthcare organization that has to contort its requirements and security concerns to ensure they receive vendor support for their devices.

I’d like to hear some feedback from other healthcare PMs and security professionals on this topic. So please feel free to drop me a line in the comments below!

Leave a Comment

Medical Device Madness. Security Suffering

“We can’t add a virus scanner to our device or we’ll have to get re-certified by the FDA.” If you have any time in the trenches as a healthcare project manager, you have heard those words spoken by a medical device rep. Famous for falling back on the “FDA re-certification” argument, these words have clipped the wings of many a project security and usability requirement. Since many of these devices are sold by a few key players (Phillips, GE) healthcare providers had little choice but to grit their teeth and allow insecure hardware and software to be attached to their network. Then the real challenge begins as the quirky device(s) begins to show unexpected behaviors and generally fails to play well with standardized enterprise systems. If the healthcare organization deploys an operating system patch or places their standard endpoint protection on the device, they run the risk of the vendor halting support during a device issue until the offending patch or software is removed. This can quickly escalate into a patient safety issue, so many times organizations accept the risk and keep their medical devices unpatched and under-protected.

For years medical providers have petitioned the FDA to clarify the rules around cybersecurity and medical devices. Do device manufacturers have to re-certify every time they apply an operating system patch or install endpoint protection? The issue gained more urgency as HIPAA penalties for patient data breaches became more common. Organizations rightly questioned the re-certification argument from vendors since some of the most sensitive protected health information (PHI) is passed through or collected by these devices. How can organization’s effectively manage their security risks and protect against breaches if their key devices remain vulnerable to the most common security issues; outdated patches and endpoint protection? So healthcare IT had to get creative about protecting these devices. Separate medical VLANs, additional physical security, hamstrung endpoint protection and a lot of reluctant risk acceptance. While these steps help mitigate the risk of a breach, organizations still have to contend with similar issues that led to the recent Target credit card breach; default admin passwords, patching issues and third party system access.

Clarity on these concerns may finally be on the horizon. While not a strongly worded as some healthcare security and IT practitioners would like, the FDA has recently released (June 2013) a Safety Communication on the topic of medical devices and cybersecurity. It is the first series of memos and articles that point toward the FDA beginning to crack down on the issues of medical device security.

In my next post I will summarize the FDA Medical Device Safety memo as well as provide some additional thoughts on how to address this thorny problem.  As always please feel free to leave comments below!

Leave a Comment

Of Portals and Patient Care: Education and the Healthcare PM

Patient Education, Literacy and Patient Portals are Making Healthcare InroadsPatient Education and Literacy are among the key topics that are bandied about in the Preventative Medicine discipline and its quest to reduce healthcare costs.  Of course the fact that 42 percent of patients do not understand “empty stomach” guidelines for medication is a cause for concern and a data point for how effective healthcare and wellness education has been to date.With that in mind  AtTask  has published a short piece of mine that covers Patient Education and how it impacts healthcare professionals and the project managers tasked with implementing Patient Education-based projects.

Here’s a bit of the post and then follow the link for the remainder of the article:

I had mentioned in my last post, Hazards on the HIE Road – A Map for Project Managers, that I was going to discuss Patient Education and what projects that PMs were going to be exposed to in this space.

Like most things in healthcare, patient portals and education are linked to HIPAA, Meaningful Use and the Joint Commission. Project Managers must understand the various technological, business and healthcare related drivers that are moving these tools to the fore.

Patient Learning and the tools associated with that discipline have gained considerable traction in the healthcare field. Driven by regulatory, technological, and patient forces, healthcare providers are launching suites of tools that allow patients to access their medical records online, order tests and interact with providers. Medical professionals are relying more on patient portals and other tools to drive better results for their practice and efficiently facilitate patient visits.

Not only do patient learning tools and portals educate the client, they provide risk management and business process management benefits. These tools help coordinate the distribution of clinical, administrative, and financial activities including multi-disciplinary and multi-care settings, plans of care, active care coordination, and the automation of compliance management with a healthcare provider.

– See more at: Of Portals and Patient Care: Education and the Healthcare PM

Leave a Comment

Hazards on the HIE Road – A Map for Project Managers

Quite a few pitfalls await the Project Manager

Quite a few pitfalls await the Project Manager

Health Information Exchanges are at the  forefront of information security and general news these days.  Since HIEs play an important role within the overall state and federal Health Insurance Marketplaces and the security controls within these marketplaces are looking a bit dubious; the overall discussion of HIEs and how they impact healthcare project managers is a timely topic.

With that in mind my latest AtTask Work Management blog post is up.  I cover the HIE technical, regulatory and process backgrounds and how it impacts healthcare project managers.

Here’s a bit of the post and then follow the link for the remainder of the article:

In my last post, “Healthcare’s Creative Destruction & the Project Manager” I mentioned that I would outline Health Information Exchanges and what a project manager should know about the current state of this local, state and federal initiatives.  Why is this topic so important?  In the scale of software development and database integration, few projects like the Nationwide Health Information Network (NwHIN) have been so sweeping in scope; no matter the industry.

One facet that defines the scope of this massive effort is the dollars spent.  The Affordable Care Act mandates (Meaningful Use) that healthcare providers shift to Electronic Medical Records (EMR). Without EMRs, a NwHIN would not be possible.  In order to facilitate this, the Federal government has doled out $12.6 billion in subsidies to providers since 2012.  For the first two months of 2013, $425 million has been handed out for EMR meaningful use.  These large numbers do not take into account the vast sums that will be spent on local, state and federal HIE/HIX promotions, setup and operations (currently estimated at $5 billion).

– See more at: Hazards on the HIE Road – A Map for Project Managers

Leave a Comment

Healthcare’s Creative Destruction and the Project Manager

My latest AtTask Work Management blog post is up.  I cover the current creative destruction that is ongoing in healthcare and how this is impacting the project manager and the discipline as a whole.

Here’s a snippet and then follow the link for the remainder of the article:

“It’s already here; the churn of healthcare change.  Small physician practices are being swallowed up by large healthcare organizations. Older practitioners are retiring sooner, rather than slog through the tremendous business process and regulatory changes that are buffeting healthcare. Local, state and the federal government are embarking on a massive data sharing project with Health Information Exchanges.

These issues all lead to a tremendous amount of risk for the healthcare project manager. To combat this, a PM in healthcare will have to have contract, technology, regulatory, and business savvy when piloting an outreach or new clinic project.”

– See more at: Healthcare’s Creative Destruction & the Project Manager

Leave a Comment

Navigating the Churn of Healthcare Project and Work Management

Work Management Blog from AtTask

Joining AtTask’s Work Management Blog as a Guest Author

I have done some work in the past for AtTask such as Podcasts and Webinars.  They recently invited me to become a guest blogger for their Work Management blog.  I will be writing on the topics of healthcare, project management and cybersecurity.

My first article was recently posted.  Here is a snippet with a link to the remaining piece:

So, back to the healthcare priorities, what are they? Well, that’s part of the problem. There are so many priorities at the moment in the healthcare space, it’s almost impossible to get a clear direction. There is an alphabet soup of healthcare initiatives that are pressing down on the industry (HIPAA, HITECH, ARRA, ACA, HIE, HIX, ICD-10, Meaningful Use) that, like a tsunami, has engulfed all resources available in many organizations. – See more at:  Navigating the Churn of Healthcare

Share!

ContactUs.com