Over ten years ago, my journey in cybersecurity began at the National Institutes of Health (NIH), an operating division of the Department of Health and Human Services (HHS). The Department didn't often make front page cybersecurity news like the National Security Agency or the Pentagon, but I soon learned that it was one of the most targeted organizations in the world by hackers. The recent attack on HHS demonstrates how under threat our healthcare system is. So why does this matter for a startup?
Certainly, startups don't attract the attention or face the same threats as U.S. Federal Departments, but there are still three big reasons to think about cybersecurity before you launch:
- The Health Information Portability and Accountability Act (HIPAA)
- Relationships with customers and partners are built on trust
- Sustainability of the ecosystem in which you exist
What I learned at HHS
In my time at HHS, I deployed identity and access management systems, giving me an interesting perspective on the security risks and priorities healthcare organizations face. While the security operations center (SOC) was doing the day-to-day defense necessary to block, hunt and remove intruders from the network, I was forced to think more holistically about systems and consider how security might impede users or affect user behavior. My biggest takeaway for anybody working in healthcare is that it is critical to design with security as a requirement. When thinking through the design requirements, three factors are helpful to keep in mind:
| People | Processes | Technology |
Food for Thought
If You Can't Stand the Heat, Don't Blame the Oven
This brings us back to the factors above. Technology by itself can handle security in transit and at rest, but people and processes must also be accounted for. While my colleagues in the SOC were on the front lines at HHS, I was developing processes and managing people's access to systems, facilities and data. Security is a property of a system, which means it is more like strategic thinking than slinging code. It is not a means to an end, but a system of design. To use a metaphor, it's more like baking than cooking. When baking, the ingredients, proportions, order and tools matter much more.
Recipes for Success
In light of this, I thought I'd include the two fragments of "recipes" that I get asked about most. The first is the ingredient list for good identity management and the second a process for secure code development. Components that make for good identity management:
| Components for good identity management: | Secure development process: |
|
Reliable method of identification |
architecture analysis |
| Strong authentication system | control design |
| Dynamic authorization process | code review (manual and automated) |
| Infallible record of accountability | application security testing |
| change management | |
| penetration testing |
Trust in Communications
At this point you're probably thinking, "OK, that sounds like a lot!" So let's bring it back to why this matters; HIPAA, relationships and sustainability. In a regulated space, you're going to be pressed on whether you've taken the proper precautions. There is no HIPAA compliant stamp that HHS can give you. Made up, for profit, standards like HITRUST, are just that, made up. What it all comes down to is whether you've planned accordingly and executed faithfully. More important than the regulations are the relationships you have with your customers and partners. In the Digital Health space, you're likely to be working a number of partners, who have entrusted their brand to you. Again, they will want to see your plan and have some assurance that you're executing it as expected. Finally, sustainability. If you are not a reliable partner, acting in good faith, with the approval of regulators, you may be able to get started, but you will not scale. Design your system securely, communicate your efforts effectively and security will become a flywheel that can smooth the intermittent progress that all startups face.