Healthcare Data Security

TigerText Announces Record-Breaking Year for Growth

Posted by HIPAA Journal

TigerText, the nation’s leading secure healthcare messaging platform provider, has announced it has recorded another record-breaking year for growth, signing up over 300 healthcare organizations in 2016.

The company now boasts more than 3,000 healthcare customers in the United States, including five of the top ten largest health systems in the country. More than 10 million secure messages are now being sent via the TigerText platform every day and the platform is used in over 5,000 healthcare facilities in the United States.

TigerText was originally developed as a standalone messaging platform, yet over the course of the past 6 years it has evolved into a comprehensive clinical communications platform. The platform has been tailored to meet the exacting needs of healthcare organizations, including the strict privacy and security controls required by the Health Insurance Portability and Accountability Act (HIPAA).

This year has seen two major new developments. Earlier this year, the TigerText platform achieved the prestigious HITRUST certification and in October the company launched a new healthcare workflow solution –TigerFlow.

TigerFlow incorporates a range of healthcare-specific features that allow healthcare organizations of all sizes to optimize and enhance communications workflows. As Brad Brooks, co-founder and CEO of TigerText, explained “TigerFlow is the first clinical communication platform built to be the central hub for care teams, thus truly enabling the last mile of care.” Brooks went on to explain that “Optimizing communication at the point of care frees physicians and nurses to do what they love – take care of patients.” The introduction of TigerFlow is seen as the biggest event in the company’s history since its 2010 launch.

The healthcare industry faces unique communications challenges and has historically struggled with integrating new technology. The pager has proved to be an invaluable and reliable tool for the healthcare industry for more than 60 years, yet many healthcare organizations have now accepted that the time has come for a modern replacement to be introduced. The launch of TigerFlow has spurred many healthcare organizations to finally make the transition to a new, and more efficient communication system.

The communications system incorporates a wide range of features to improve productivity, patient outcomes, provider satisfaction, and profitability. As Brooks explained, “The TigerFlow solution specifically improves collaboration and clinical communications by addressing and solving health systems’ concerns around integrating technology.” In addition to the messaging platform, healthcare providers benefit from enhanced data integration capabilities, end-to-end workflow consultation services, and on-demand data analytics.

The cost savings that can be generated are considerable. Brooks believes the potential savings could be excess of $100 billion across the healthcare industry as a whole. One of the company’s large healthcare clients has generated over $6 million in cost savings in 2016 alone, while another reported savings of more than $200,000 in just 8 weeks after implementing the TigerText platform.

The past few months have also seen the company bring in new talent with a wealth of healthcare experience to further accelerate growth in the healthcare industry. Kirk Paul Kirkman has been recruited to serve as President of the TigerText Client Organization while Kelli Castellano has been appointed Chief Marketing Officer. Both new hires have extensive experience in the healthcare industry and are highly focused on improving physician and nurse satisfaction and helping providers improve patient outcomes.

The post TigerText Announces Record-Breaking Year for Growth appeared first on HIPAA Journal.

FDA Issues Final Cybersecurity Guidance for Medical Device Manufacturers

Posted by HIPAA Journal

The U.S. Food and Drug Administration (FDA) has published final cybersecurity guidance for medical device manufacturers to help them better protect their devices from cyberattacks. The guidance will help device manufacturers implement a system for identifying and reporting potential security vulnerabilities to ensure vulnerabilities can be addressed before they are exploited by hackers.

The threat of hackers using vulnerabilities in medical devices to gain access to sensitive data or cause patients to come to harm has been widely publicized in recent years. This year, many cybersecurity professionals have called for device manufacturers to do more to ensure their products – including defibrillators, pacemakers, and drug pumps – are made more secure.

The FDA has previously issued warnings to device manufacturers and healthcare providers about medical device security risks. In 2015, the FDA warned of a vulnerability affecting Hospira insulin pumps, which could potentially be exploited by hackers to alter insulin doses to cause patients to come to harm.

Earlier this year, short-selling firm Muddy Waters issued a report on a number of security vulnerabilities that had allegedly been identified in certain St. Jude Medical devices. The FDA is currently investigating those claims, although St. Jude Medical has denied that those vulnerabilities exist. Johnson & Johnson also discovered a flaw in its insulin pump which could potentially be exploited by hackers.

Final FDA Cybersecurity Guidance for Medical Device Manufacturers

The new 30-page guidance document encourages manufacturers of medical devices to implement a system for monitoring their devices and associated software for potential security vulnerabilities that could be used by hackers to take control of the devices, obtain sensitive data, or used to launch attacks on healthcare networks.

The guidance has been a year in the making and follows the release of cybersecurity guidelines for device manufacturers in October 2014. The previous document makes recommendations for incorporating better cybersecurity protections into medical devices before they come to market.

The latest guidance is concerned with the continued protection of medical devices after they have come to market. The document suggests steps that should be taken by manufacturers of the devices to make it easier for vulnerabilities to be identified and reported by security researchers. The FDA suggests device manufacturers should develop channels of communications to allow vulnerabilities to be reported back to them by white hat hackers.

The FDA also recommends manufacturers join together in an Information Sharing and Analysis Organization (ISAO) to share cybersecurity threat information, including how they have responded to threats and made their devices more secure.

Dr. Suzanne Schwartz, associate director for science and strategic partnerships at the FDA’s Center for Devices and Radiological Health, helped develop the guidelines. She explained in a recent blog post that

“Protecting medical devices from ever-shifting cybersecurity threats requires an all-out, lifecycle approach that begins with early product development and extends throughout the product’s lifespan.” She also explained that device manufacturers need to develop “a structured and comprehensive program to manage cybersecurity risks.”

The cybersecurity guidance for medical device manufacturers can be used to develop and implement policies and procedures to better protect medical devices once they have come to market. Schwartz also strongly recommends device manufacturers to apply the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity.

The new guidance – Postmarket Management of Cybersecurity in Medical Devices –can be downloaded on this link.

The post FDA Issues Final Cybersecurity Guidance for Medical Device Manufacturers appeared first on HIPAA Journal.

Joint Commission Ban on Secure Messaging for Orders Remains in Place

Posted by HIPAA Journal

The Joint Commission on Accreditation of Healthcare’s (Joint Commission) ban on the use of secure text messaging platforms for patient care orders will remain in place, according to its December newsletter.

In April 2016, the Joint Commission took the decision to allow the use of a secure texting platform for sending orders. The ban was not totally lifted, as the Joint Commission required certain components to be in place and certain standards to be followed to ensure patient safety was not placed at risk.

The ban was originally put in place as SMS messages were not secure. It was also not possible to verify the sender of a message nor for original message to be retained for auditing purposes. Since the original ban was introduced, a number of companies developed secure text messaging platforms that incorporated all of the necessary security features to ensure messages could not be intercepted.

Those messaging platforms also allowed the identity of the sender to be verified, ensured that messages were retained for auditing purposes, and a slew of other privacy and security controls were incorporated to ensure compliance with the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy and Security Rules.

The advances made in secure text messaging technology led to the decision to lift the ban, which was announced in the May perspectives newsletter. Then in July 2016, the Joint Commission reversed its decision and reinstated the ban, calling for further guidance for healthcare organizations due to concerns over patient privacy.

Guidance for healthcare organizations on the use of secure text messaging platforms would be developed in collaboration with the Centers for Medicare & Medicaid Services (CMS). Those guidelines were expected to be released by September this year.

However, the Joint Commission said in its December newsletter that its position has not changed and the ban is to remain in place, although it will continue to monitor the advances in secure texting technology and may update its position in the future.

In the meantime, CMS and the Joint Commission continue to ban the use of unsecure SMS messages and secure messaging platforms for sending patient care orders, although clinicians are permitted to use HIPAA-compliant secure messaging platforms to send messages to each other.

The decision to further delay the lifting of the ban on secure text messaging for orders is due to the Joint Commission still having a number of concerns over privacy and security.

The preferred method for sending orders is a computerized provider order entry (CPOE), as this method allows providers to directly enter orders into their electronic health record system.

The Joint Commission says, “CPOE helps ensure accuracy and allows the provider to view and respond to clinical decision support (CDS) recommendations and alerts. CPOE is increasingly available through secure, encrypted applications for smartphones and tablets, which will make following this recommendation less burdensome.”

If a CPOE is not possible, orders can be communicated verbally, but not by SMS message or even a secure messaging platform. The Joint Commission said, “After extensive discussion weighing the pros and cons of using secure text messaging systems to place orders, the Joint Commission and CMS have concluded that the impact of secure text orders on patient safety remains unclear.”

The Joint Commission also believes the use of an additional method of transmitting orders may increase the burden on nurses to manually enter the orders into the EHR. It was also pointed out that transmission of verbal orders allows synchronous clarification and confirmation of orders in real time, and if alerts or a CDS recommendation is triggered during the order process, an individual manually entering the order into an EHR may need to contact the ordering practitioner to request further information.

The post Joint Commission Ban on Secure Messaging for Orders Remains in Place appeared first on HIPAA Journal.

Security Risks of Unencrypted Pages Evaluated

Posted by HIPAA Journal

Pagers are still extensively used in the healthcare industry even though the devices have been shown to pose a considerable security risk.

Trend Micro has recently demonstrated – in the company’s ‘Leaking Beeps’ series of reports – the extent to which pagers leak data and how easy it is for sensitive information to be intercepted by cybercriminals. The equipment needed to intercept unencrypted pages can even be purchased for as little as $20.

The third installment in the Leaking Beeps series has just been released, further highlighting the risk of exposure of healthcare data and how cybercriminals could attack the systems to which pagers connect.

Trend Micro draws attention to two tools in particular that could be used by hackers to gain access to systems and data: SMS-to-pager gateways and email-to-pager gateways.

SMS-to-pager gateways use specific numbers to receive SMS messages and forward them to pre-configured pagers. SMS-to-pager gateways are commonly used by healthcare organizations and the data transmitted is often unencrypted. Not only can messages be intercepted, SMS-to-pager gateways may also include systems that look up caller IDs. One healthcare provider’s system was discovered to have leaked 135 patients’ names, along with dates of birth, patients’ pregnancy status, phone numbers, and information about symptoms and contracted illnesses.

Email-to-pager gateways could potentially provide attackers with a range of information that could be used in future cyberattacks. Attackers could intercept and compile lists of contacts for use in spear phishing campaigns. Email-to-pager gateways could also be used to obtain information about the routers used by an organization and any downtime experienced. Armed with this information, an attacker could search for vulnerabilities affecting those routers and use them to conduct attacks on healthcare networks.

During the research, messages were intercepted that provided details of LDAP servers where authentication and account information were stored. Trend Micro notes that an attacker who has already gained access to a company’s system could use this information to move laterally within a network.

Other data exposed via unencrypted pages, SMS-to-pager gateways, and email-to-pager gateways included WINS names, Microsoft SQL Server and Oracle Database server names, types of databases used by organizations, server error messages, and information generated by intrusion detection systems showing the types of attacks that have been experienced and the vulnerabilities that attackers have attempted to exploit. Trend Micro researchers also discovered an “astonishing” number of passwords and passcodes that were transmitted in clear text.

One of the main threats comes from attackers using information gathered from unencrypted pages for future spear phishing and social engineering attacks. Trend Micro was able to gather a wide range of information that could be used such as employees’ names, birthdays, vacation time, and appointments. It was also possible to determine interpersonal relationships between staff members.

Parcel tracking numbers were gathered which could allow attackers to determine parcel delivery schedules. This information could be used to craft convincing phishing messages.

Due to the security risks that come from using pagers and concerns over HIPAA violations from sending PHI via unencrypted pages, many healthcare organizations have now ditched the pager in favor of secure, HIPAA-compliant messaging platforms on smartphones and other portable electronic devices.

Any healthcare organization still using these legacy devices should carefully consider the risks involved and weigh these up against the benefits that they provide. Healthcare organizations should conduct a thorough risk analysis on the use of pagers to communicate sensitive information.

If there are any reasons why pagers cannot be retired, at the very least, healthcare organizations should strongly consider organization-wide encryption of pages. If encryption is chosen in favor of a modern messaging platform, the method of encryption should meet the minimum standards outlined in NIST encryption guidelines.

Until such time that a more secure system is in place, healthcare organizations should refrain from sending PHI via encrypted pages and avoid transmitting highly sensitive information such as passwords and passcodes.

The post Security Risks of Unencrypted Pages Evaluated appeared first on HIPAA Journal.

ONC Issues Challenge to Develop a New Online Model Privacy Notice Generator

Posted by HIPAA Journal

The Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology (ONC) has challenged designers, developers, and health data privacy experts to create a new online Model Privacy Notice (MPN) generator.

At present, the MPN is a voluntary resource that helps health technology developers who collect electronic health data provide information to consumers about how health data is collected, used, and protected.

The purpose of the MPN is to improve transparency and clearly display information about an organization’s privacy practices to enable consumers to make an informed decision about whether to use a particular product.

While the ONC, in conjunction with the Federal Trade Commission (FTC), developed a Model Privacy Notice in 2011, technology has moved on considerably in the past five years. The MPN was intended to be used for personal health records, but the range of products that collect health data is now considerable, and include wearable devices and mobile applications. The current MPN is therefore somewhat dated.

ONC notes that the number of consumers that are using devices that record electronic health information has grown considerably since 2011. It is has now become increasingly important for consumers to be able to make decisions about products based on how their information will be used and stored. In particular, how their data will be protected and with whom health information will be shared. The current MPN does not make it easy for consumers to find out this information.

While many consumers are aware of the Health Insurance Portability and Accountability Act and know that HIPAA covered entities are required to implement controls to protect stored data and limit disclosures of health information, many product developers that collect and store health information are not in fact HIPAA-covered entities.

Fitness trackers for example may record data types that are classed as protected health information (PHI) when collected and stored by a HIPAA-covered entity, yet are not subject to HIPAA Rules when collected and stored by a product developer.

It is therefore essential to clarify privacy and security policies to ensure consumer are aware what will happen to their data so they can make an informed decision about whether to use a particular product.

To make it easier for developers to use the MPN and easier for consumers to understand the information provided via the MPN, the ONC has launched The Privacy Policy Snapshot Challenge.

The Challenge involves creating “an online tool that can generate a user-friendly snapshot of a product’s privacy practices.” ONC explains that submissions must include “code for an open source, web-based tool that allows health technology developers who collect digital health data to generate a customized privacy notice.”

The first prize is $20,000, the second prize $10,000, and third prize is $5,000. Entries must be submitted by April 10, 2017

Designers, developers, and health data privacy experts can find out more and sign up for the Privacy Policy Snapshot Challenge on this link.

The post ONC Issues Challenge to Develop a New Online Model Privacy Notice Generator appeared first on HIPAA Journal.

Phishing Emails Used in 91% of Cyberattacks

Posted by HIPAA Journal

A recent study conducted by PhishMe indicates 91% of cyberattacks commence with a spear phishing email. Phishing continues to pose a major threat and organizations and can all too easily result in attackers gaining access to networks and sensitive data, even when organizations have developed highly sophisticated cybersecurity defenses. A single spear phishing email can see those defenses bypassed.

For the study, PhishMe assessed response rates from more than 40 million phishing email simulations that were sent to around 1,000 organizations over the past 12 months. The study revealed that even though healthcare organizations conduct security awareness training, healthcare employees have a phishing email response rate of 31%.

Cybercriminals use a range of social engineering techniques to fool end users into clicking on malicious links, opening infected email attachments, or revealing sensitive information such as login credentials.

End users are often fooled into opening fake order confirmations, job applications, notifications of failed deliveries, security updates, and legal notices, but in many cases the phishing emails are even more basic. PhishMe reports that employees commonly respond to blank emails containing malicious links and attachments.

However, the most effective phishing emails were those used by the actors behind Locky ransomware. Locky has fast become one of the biggest threats since it was first discovered in February this year. The email campaigns used to spread the ransomware are particularly successful because they are highly targeted and have been developed specifically to attack businesses. An analysis of phishing emails used to distribute Locky ransomware showed that the Insurance and healthcare industry response rates were particularly high, with response rates of 34.7% and 24.9% respectively.

The phishing emails are personalized, which increases the likelihood of the target responding to the email. Personal information such as the recipient’s name is included in the emails to improve response rates and the emails closely resemble orders and requests that are received on a daily basis by office workers. Whereas phishing emails used to be fairly easy to identify due to the number of spelling and grammatical errors, the quality of phishing emails has improved considerably in recent years. Phishing emails are now much harder to identify and unless employees receive training – and that training is put to the test – response rates are likely to be high.

The report indicates the main reasons why employees open phishing emails are curiosity, fear, urgency, and the offer of a reward or recognition. Fear of job loss drives many individuals to open phishing emails, click on malicious links, or open infected email attachments. Busy workloads also make employees more susceptible, with time-pressured employees failing to stop and think before opening emails.

Technical solutions to prevent the delivery of phishing emails should be used to reduce risk; however, it is essential to train all workforce members how to identify phishing emails and to condition workers to report suspected phishing attacks.

PhishMe claims susceptibility to phishing emails falls to 20% after one failed phishing simulation. The more practice employees get, the better they become at detecting threats. PhishMe points out, “With repetition, a sustained and well-executed phishing simulation program, focused on conditioning employees to report, provides a significant reduction in overall exposure to risk from this ever-changing attack vector and improves the security posture of an organization.”

It is also possible to significantly reduce the time taken to identify breaches from days to minutes if employees are conditioned into reporting potential threats. The average time taken to identify a breach is 146 days, although with conditioning this can be reduced to an average of 1.2 hours according to the study.

The post Phishing Emails Used in 91% of Cyberattacks appeared first on HIPAA Journal.

Phishing Emails Used in 91% of Cyberattacks

Posted by HIPAA Journal

A recent study conducted by PhishMe indicates 91% of cyberattacks commence with a spear phishing email. Phishing continues to pose a major threat and organizations and can all too easily result in attackers gaining access to networks and sensitive data, even when organizations have developed highly sophisticated cybersecurity defenses. A single spear phishing email can see those defenses bypassed.

For the study, PhishMe assessed response rates from more than 40 million phishing email simulations that were sent to around 1,000 organizations over the past 12 months. The study revealed that even though healthcare organizations conduct security awareness training, healthcare employees have a phishing email response rate of 31%.

Cybercriminals use a range of social engineering techniques to fool end users into clicking on malicious links, opening infected email attachments, or revealing sensitive information such as login credentials.

End users are often fooled into opening fake order confirmations, job applications, notifications of failed deliveries, security updates, and legal notices, but in many cases the phishing emails are even more basic. PhishMe reports that employees commonly respond to blank emails containing malicious links and attachments.

However, the most effective phishing emails were those used by the actors behind Locky ransomware. Locky has fast become one of the biggest threats since it was first discovered in February this year. The email campaigns used to spread the ransomware are particularly successful because they are highly targeted and have been developed specifically to attack businesses. An analysis of phishing emails used to distribute Locky ransomware showed that the Insurance and healthcare industry response rates were particularly high, with response rates of 34.7% and 24.9% respectively.

The phishing emails are personalized, which increases the likelihood of the target responding to the email. Personal information such as the recipient’s name is included in the emails to improve response rates and the emails closely resemble orders and requests that are received on a daily basis by office workers. Whereas phishing emails used to be fairly easy to identify due to the number of spelling and grammatical errors, the quality of phishing emails has improved considerably in recent years. Phishing emails are now much harder to identify and unless employees receive training – and that training is put to the test – response rates are likely to be high.

The report indicates the main reasons why employees open phishing emails are curiosity, fear, urgency, and the offer of a reward or recognition. Fear of job loss drives many individuals to open phishing emails, click on malicious links, or open infected email attachments. Busy workloads also make employees more susceptible, with time-pressured employees failing to stop and think before opening emails.

Technical solutions to prevent the delivery of phishing emails should be used to reduce risk; however, it is essential to train all workforce members how to identify phishing emails and to condition workers to report suspected phishing attacks.

PhishMe claims susceptibility to phishing emails falls to 20% after one failed phishing simulation. The more practice employees get, the better they become at detecting threats. PhishMe points out, “With repetition, a sustained and well-executed phishing simulation program, focused on conditioning employees to report, provides a significant reduction in overall exposure to risk from this ever-changing attack vector and improves the security posture of an organization.”

It is also possible to significantly reduce the time taken to identify breaches from days to minutes if employees are conditioned into reporting potential threats. The average time taken to identify a breach is 146 days, although with conditioning this can be reduced to an average of 1.2 hours according to the study.

The post Phishing Emails Used in 91% of Cyberattacks appeared first on HIPAA Journal.

Malvertising Campaign Highlights Importance of Patching Browsers

Posted by HIPAA Journal

The importance of ensuring browsers and plugins are kept up to date has been highlighted by the discovery of a malverstising campaign that is targeting readers of popular news websites such as Yahoo and MSN.

In the past two months, millions of individuals have been exposed to malicious adverts which automatically redirect users to websites where malware is downloaded.

The campaign – termed Stegano – is being used to distribute a range of malware and spyware including keystroke loggers and Trojans. The aim of the attackers is to capture email login credentials and other sensitive information that can be used for further attacks.

The campaign uses a technique called steganography – The hiding of messages (or code) inside images. In this case, malicious scripts are embedded in the code that controls the transparency of images displayed by third party advertising networks on popular websites.

The inclusion of the code changes the appearance of the banner images making them appear slightly pixelated, although the change is hardly noticeable to an untrained eye. Unlike other malvertising campaigns that require the user to click on the advert in order to be redirected to a malicious website hosting an exploit kit, this campaign redirects the user automatically.

The campaign is highly targeted to prevent discovery by security researchers. Checks are performed to prevent Stegano from running in a virtual environments or sandboxes, and scans are performed to assess the security software used to protect each device.

The campaign is being used to target individuals using Internet Explorer with unpatched Adobe Flash versions containing one of three vulnerabilities (CVE-2015-8651, CVE-2016-1019, CVE-2016-4117).

The ad banners – which display images of security products such as ‘Browser Defense’ and ‘Broxu’ – will only be displayed if Stegano determines that it is not under surveillance and if the vulnerabilities exist.

The banner ads contain a 1-pixel iframe containing malicious code. The pixel is displayed off screen to avoid detection and will redirect the user to a website hosting an exploit kit where malware will be silently downloaded. The campaign is currently being used to distribute keystroke loggers from the Ursnif family, Ramnit malware. The former can steal any information from an infected computer, including keystrokes and files. However, an infected computer could also by compromised by other malicious payloads such as backdoors which give the attackers access to the device.

Organizations can protect themselves against attack by ensuring the latest version of IE is installed and ensuring that plugins and browsers are patched promptly.

The post Malvertising Campaign Highlights Importance of Patching Browsers appeared first on HIPAA Journal.

Half of IT Pros Most Concerned About Insider Threats

Posted by HIPAA Journal

A considerable proportion of IT security budgets are directed to securing the network perimeter and with good reason. Hackers are breaking through security defenses with increasing frequency and this year has seen some of the biggest cyberattacks ever reported.

However, internal threats should not be ignored. According to a recent Dimensional Research/Preempt study, most IT security professionals believe internal threats have increased over the past few years to the point that they are now of greater concern than cyberattacks by hackers.

For the study, 317 independently verified IT security professionals from organizations that employed more than 1,000 staff members were asked a range of questions about insider threats, including the barriers preventing organizations from mitigating risk and the measures employed to deal with the threat.

When asked about whether they were concerned about internal threats, only one respondent out of 317 said they had no concerns and 49% of survey respondents said they were more concerned about internal threats than they are about external attacks.

The biggest cause for concern – rated by 87% of respondents – was a lack of security awareness and employees bending company rules to get the job done. Other top concerns were accidental malware downloads (73%), theft of user credentials (66%), data theft (65%), and abuse of admin privileges (63%).

Tackling insider threats is proving problematic due to a lack of skills, appropriate technology, and a lack of resources. 10% of respondents said members of the security staff lacked the necessary skills and 64% of respondents said they had staff members with sufficient skill levels to address the risk, but were so overworked that they have been unable to respond to the insider threat.

Risk can be minimized by ensuring that end users only have access to data and systems necessary for them to perform their work duties, yet 91% of respondents said insiders had access to systems that they shouldn’t. Unfortunately, organizations lack the time and resources to address that problem.

A lack of resources and the appropriate technology to monitor data access was also an issue. 70% of respondents said they were unable to effectively monitor the activities of privileged users.

Training end users on security best practices and improving cybersecurity awareness can help organizations reduce risk. 95% of respondents said training was provided to staff, mostly via newsletters and email alerts (68%), online training (61%) and in-person training (47%). However, training programs were not seen as being particularly effective.

Seven out of ten respondents said their training was somewhat effective and only one in ten felt training programs were very effective. One of the main issues was getting end users put effort into learning. The majority of respondents said their organization’s employees were willing to take part in security training, but only 25% said end users actually put any effort into learning about security best practices.

With the threat from within growing, organizations must do more to mitigate risk; however, without an increase in investment, insider breaches are likely to increase. Organizations must also do more to improve their security training and engage end users in training programs.

According to Ajit Sancheti, co-founder and CEO of Preempt, “Without real-time prevention solutions and improved employee engagement, these threats will not only increase, but find more sophisticated ways to infiltrate and navigate a network. The future of security practices relies on the ability to not only understand users and anticipate attacks, but also how to mitigate threats as quickly as possible.”

The post Half of IT Pros Most Concerned About Insider Threats appeared first on HIPAA Journal.