Cybersecurity can sometimes feel like something that belongs entirely to the IT department. We hear terms like firewalls, encryption, ransomware, governance, risk assessments, and network security, and it is easy to assume those things happen behind the scenes.
But some of the most important cybersecurity decisions
happen at your desk every day.
Opening an email, clicking a link, accessing patient
information, approving a multifactor authentication request, locking your
computer, reporting something suspicious, or deciding whether to share
information are all cybersecurity decisions.
In healthcare, those everyday decisions are especially
important because we are responsible for protecting sensitive information and
maintaining systems that people depend on.
For this September Cybersecurity Awareness training, we are
focusing on three things that work together:
Cybersecurity, governance, and risk.
You do not need to be an IT professional to understand them
- and you have an important role in all three.
What Is Cybersecurity Governance?
The word governance can make cybersecurity sound more
complicated than it really is.
Governance is essentially how an organization establishes
the rules, responsibilities, policies, and processes used to protect its
information and technology.
Think about some of the security requirements you encounter
at work:
- Using
multifactor authentication (MFA)
- Following
password requirements
- Locking
your computer when you step away
- Using
approved applications and equipment
- Protecting
patient and confidential information
- Completing
cybersecurity training
- Reporting
suspicious emails
- Installing
required updates
- Following
procedures for accessing organizational systems
These requirements are not random.
They are part of a larger process designed to manage
cybersecurity risk and protect our organization.
Governance also creates accountability. Leadership
establishes expectations, IT and security teams implement protections, managers
help reinforce policies, and employees follow established procedures.
Everyone has a role.
What Does "Risk" Mean?
We deal with risk every day, even when we do not call it
risk management.
In cybersecurity, risk is the possibility that something
could happen that negatively affects our information, technology, operations,
or the people we serve.
Imagine receiving an email that appears to be from someone
you know. The message says you need to review an urgent document and provides a
link.
You click the link.
A login page appears.
You enter your username and password.
Unfortunately, the email was a phishing message and the
login page was fake.
Your password may now be in the hands of an attacker.
That single action can create significant risk.
The attacker may attempt to access your email,
organizational applications, confidential information, or other systems.
This is why cybersecurity risk management is not limited to
technical systems. Our everyday decisions can either increase or reduce risk.
Stop Before You Click
One of the simplest cybersecurity habits is also one of the
most effective:
Stop and look before you click.
Cybercriminals want us to react quickly.
They frequently create messages designed to make us worried,
curious, excited, or rushed.
You might receive a message saying:
"Your password expires today."
"Your account will be disabled."
"You have an unpaid invoice."
"Review this confidential document immediately."
"Your package could not be delivered."
"Click here to listen to your voicemail."
The goal is to get you to react before you have time to
think.
Before clicking a link or opening an unexpected attachment,
look at the message carefully.
Do you recognize the sender?
Were you expecting the message?
Does the sender's email address look correct?
Does the request make sense?
Is the message creating unusual urgency?
Is someone asking for information they normally would not
request?
When something does not seem right, do not guess. Verify it.
Protect Your Password - and Your MFA
Your password is one of the keys to your digital identity.
Never share it with another employee, supervisor, coworker,
friend, or anyone claiming to be technical support.
You should also never provide your password through email or
in response to an unexpected request.
Multifactor authentication adds another layer of security,
but MFA only protects your account when you use it correctly.
Suppose you are sitting at your desk and suddenly receive an
MFA approval request on your phone.
You are not trying to log in.
What should you do?
Do not approve it.
An unexpected authentication request could mean someone has
obtained your password and is attempting to access your account.
Deny the request and report the suspicious activity
according to your organization's procedures.
Never approve an MFA notification simply because it appears
on your device.
HIPAA and Cybersecurity Go Together
In healthcare, cybersecurity also helps us protect protected
health information, or PHI.
HIPAA establishes requirements for safeguarding patient
information, including electronic protected health information.
But protecting PHI is not something that happens only
because a policy exists.
It happens because employees make good decisions throughout
the day.
Before accessing patient information, ask:
Do I need this information to perform my job?
Access to information should be based on your job
responsibilities and legitimate business needs.
The fact that you can access something does not
necessarily mean you should.
The same principle applies when sharing information.
Always verify recipients before sending sensitive
information, follow approved procedures for transmitting confidential
information, and never use unauthorized applications or personal accounts to
store or share organizational information.
Lock It Before You Leave It
You are called away from your desk for what you think will
be thirty seconds.
Do you really need to lock your computer?
Yes.
It only takes a few seconds for someone to view information
displayed on an unattended screen or interact with an unlocked computer.
Make locking your workstation a habit.
Every time you walk away, lock it.
This is one of the easiest cybersecurity protections
employees can control themselves.
Don't Ignore Updates and Security Messages
Updates can be inconvenient, especially when you are busy.
However, many updates contain security fixes for
vulnerabilities that could otherwise be exploited.
When IT requires an update, restart, security application,
or other change, there is usually a reason.
Avoid delaying required updates unnecessarily, disabling
security software, or attempting to bypass security controls.
Also, do not install software simply because you found
something online that would make a task easier.
Unauthorized applications can introduce security
vulnerabilities, licensing problems, privacy concerns, or malicious software.
If you need software that is not currently available, follow
your organization's process for requesting it.
Report It - Even If You Made the Mistake
This may be one of the most important lessons in this
month's training.
If something happens, report it quickly.
Maybe you clicked a link and then realized the email looked
suspicious.
Maybe you entered your password before realizing the website
was not legitimate.
Maybe you accidentally sent information to the wrong person.
Maybe you approved an MFA request and then realized you were
not trying to log in.
Maybe your computer suddenly begins behaving strangely.
Do not wait to see what happens.
Do not try to hide the mistake.
And do not assume that because nothing happened immediately,
everything is fine.
Report the incident using your organization's established
process as soon as possible.
Quick reporting gives IT or cybersecurity staff an
opportunity to investigate and take action.
They may be able to reset credentials, disable an account,
block a malicious website, isolate a device, remove a suspicious email, or
prevent an attacker from moving farther into the environment.
A small mistake does not necessarily have to become a major
cybersecurity incident.
But delaying the report can give an attacker more time.
Cybersecurity Is Also About Patient Care
Cybersecurity in healthcare is about much more than
protecting computers.
Consider what could happen if a cyberattack suddenly made
important systems unavailable.
Employees might lose access to electronic health records.
Appointments could be affected.
Communication systems might become unavailable.
Clinical staff could have difficulty accessing information
they need.
Business operations could be interrupted.
A cybersecurity incident can become an operational issue
and, in some circumstances, a patient-care issue.
That is why protecting our systems is part of protecting the
people we serve.
Your September Cybersecurity Challenge
During September, challenge yourself to become more aware of
the small cybersecurity decisions you make each day.
Before clicking a link, stop and look.
Before sending sensitive information, verify the recipient.
Before approving an MFA request, make sure you initiated it.
Before walking away from your computer, lock your screen.
Before installing software, make sure it is approved.
Before accessing information, make sure you have a
legitimate business need.
And when something suspicious happens, report it quickly.
You do not have to understand every technical aspect of
cybersecurity to make a difference.
Cybersecurity governance establishes the rules.
Risk management helps identify what needs to be protected.
Technology provides important safeguards.
But employees provide another critical layer of defense.
Every suspicious email you report, every workstation you
lock, every unexpected MFA request you deny, and every moment you take to
verify before clicking helps reduce cybersecurity risk.
Remember
Stop. Think. Verify. Report.
Those four actions can prevent a small cybersecurity mistake
from becoming a much larger incident.
Cybersecurity is everyone's responsibility, and in
healthcare, protecting information is part of protecting the people we serve.
September Cybersecurity Awareness Knowledge Check
Complete the following questions after reviewing this
month's Cybersecurity, Governance, and Risk training.
1. Who is responsible for cybersecurity within a healthcare
organization?
A. Only the IT department
B. Only managers and supervisors
C. Every employee
D. Only employees who work with patient records
Correct Answer: C - Every employee
Cybersecurity is a shared responsibility. Every employee can
help protect organizational systems, confidential information, and the people
we serve.
2. You receive an unexpected email asking you to click a
link and immediately verify your password. What should you do?
A. Click the link because the request is urgent
B. Reply to the email and ask if it is legitimate
C. Verify the request through a trusted method and report the email if it
appears suspicious
D. Forward the email to a coworker and ask them to try the link
Correct Answer: C - Verify the request through a trusted method
and report the email if it appears suspicious
Cybercriminals frequently use urgency to encourage people to
act without thinking. Stop, examine the message, and verify unexpected requests
before taking action.
3. You receive an MFA approval request on your phone, but
you are not trying to log in. What should you do?
A. Approve it because it may be an automatic system request
B. Approve it and change your password later
C. Ignore it
D. Deny the request and report the suspicious activity
Correct Answer: D - Deny the request and report the suspicious
activity
An unexpected MFA request could mean someone has obtained
your password and is attempting to access your account.
4. True or False: If you have technical access to a
patient's information, you may view the information even when it is unrelated
to your job.
Correct Answer: False
Access should be based on your job responsibilities and a
legitimate business need. Having access to information does not
automatically mean you are authorized to view it.
5. Why should you lock your computer when stepping away from
your workstation?
A. It saves electricity
B. It prevents unauthorized access to information and systems
C. It automatically installs updates
D. It improves computer performance
Correct Answer: B - It prevents unauthorized access to information
and systems
Even a short period away from an unlocked workstation can
create an opportunity for unauthorized access.
6. Which of the following is an example of cybersecurity
governance?
A. Organizational password and MFA requirements
B. Policies governing access to information
C. Procedures for reporting cybersecurity incidents
D. All of the above
Correct Answer: D - All of the above
Governance establishes the policies, responsibilities,
expectations, and processes an organization uses to manage cybersecurity and
risk.
7. You accidentally click a suspicious link in an email.
Nothing appears to happen. What should you do?
A. Delete the email and forget about it
B. Wait until the next day to see if your computer behaves differently
C. Report it immediately using your organization's established process
D. Restart your computer and continue working
Correct Answer: C - Report it immediately using your
organization's established process
Do not wait for visible signs of a problem. Quick reporting
gives IT or cybersecurity staff an opportunity to investigate and respond
before a potential incident becomes more serious.
8. True or False: Software found online can be installed on
a work computer as long as it is free and appears legitimate.
Correct Answer: False
Only approved software should be installed on organizational
devices. Unauthorized software may introduce malware, vulnerabilities,
licensing issues, or privacy and security risks.
9. Which action can help reduce cybersecurity risk?
A. Verifying unexpected requests before responding
B. Reporting suspicious emails
C. Protecting passwords and MFA requests
D. Locking your workstation when you step away
E. All of the above
Correct Answer: E - All of the above
Cybersecurity is strengthened through everyday actions.
Small security habits can prevent much larger incidents.
10. Why is cybersecurity especially important in healthcare?
A. Healthcare organizations only need to protect computers
B. Cybersecurity protects patient information and helps maintain the
availability of systems used to support healthcare operations and patient care
C. Cybersecurity is required only when an organization experiences a breach
D. Cybersecurity applies only to electronic health record administrators
Correct Answer: B - Cybersecurity protects patient information and
helps maintain the availability of systems used to support healthcare
operations and patient care
A cybersecurity incident can affect confidential
information, business operations, communication, and access to systems
employees depend on to serve patients.
September Cybersecurity Takeaway
Remember these four actions throughout your workday:
STOP before clicking unexpected links or attachments.
THINK about whether a request makes sense.
VERIFY unusual requests using a trusted method.
REPORT suspicious activity or mistakes as quickly as
possible.
Final Reminder
Cybersecurity governance provides the policies and expectations we must follow. Risk management helps the organization identify and
address potential threats. Technology provides safeguards - but employees
remain an important part of our defense.
Stop. Think. Verify. Report.
Every employee has a role in protecting our systems, our
information, and the people we serve.
No comments:
Post a Comment