Skip to content
  • About
  • Contact
  • Contribute
  • Book
  • Careers
  • Podcast
  • Recommended
  • Speaking
  • All
  • Physician
  • Practice
  • Policy
  • Finance
  • Conditions
  • .edu
  • Patient
  • Meds
  • Tech
  • Social
  • Video
    • All
    • Physician
    • Practice
    • Policy
    • Finance
    • Conditions
    • .edu
    • Patient
    • Meds
    • Tech
    • Social
    • Video
    • About
    • Contact
    • Contribute
    • Book
    • Careers
    • Podcast
    • Recommended
    • Speaking

What keeps a hospital CIO up at night

John Halamka, MD
Tech
April 28, 2012
189 Shares
Share
Tweet
Share

Earlier this year, my team presented a list of risks to the Compliance, Audit and Risk Committee at BIDMC.   Here’s my list of top risks for 2012:

1. Old Internet browsers. Many vended clinical applications require specific versions of older browsers such as Internet Explorer 6, which are known to have security flaws.  We’ve worked diligently to eliminate, upgrade or replace applications with browser specificity.   At this point we are 96% Internet Explorer 8/Firefox 7/Safari 5 minimizing our risks to the extent possible.

2. Local Administrative rights. Of our 18,000 devices on the network, a few thousand are devices that require the user to have local administrative rights to run their niche applications (often the research community doing cutting edge research with open source or self developed software).   We have done everything possible to eliminate Local Administrative rights on our managed devices.

3. Outbound transmissions. Security has historically focused on blocking evil actors from the internet.   Given the current challenges of malware and infections brought in from the outside, it’s equally critical to block unexpected outbound activity.

4. Public facing websites. Any machine that touches the internet has the potential to be targeted for attack.  We’ve implemented proxy servers/web application firewalls on most public websites.

5. Identity and Access management. Managing the ever changing roles and rights of individuals in a large complex organization with many partners/affiliates is challenging.  If an affiliate asks for access to an application, how do you automatically deactivate accounts when users leave an affiliate, given the lack of direct employment relationships?

6. Anti-virus. The best anti-virus applications only catch about 50% of malware.  Thus, a multi-layered defense is required.  However, adding all those layers impacts performance and can result in false positives.   Balancing security, reliability, and performance is challenging.

7. Security awareness. When that phishing email arrives asking users for their username/password, social security number, and a DNA sample, some people still fall for it.   Many users surf sites that are known virus distribution sites.   Even social networking is a vector for malware.

8. Keystroke loggers and screen scrapers. Mobile devices and home computers beyond IT control may contain keystroke loggers that capture user credentials, bypassing encryption, VPNs, and other layers of security.

9. Forensics. Increasingly sophisticated security infrastructure implies more events to research which requires additional staff that are challenging to find, recruit and retain.

10. Third party desktop software. It’s no longer the operating system that presents the greatest risk, but security holes in Java and Adobe products such as Flash.

Security is journey and you’ll never be done.  The hope is that your risk profile improves over time as more  of the environment is locked down, creating a restrictive rather than permissive infrastructure which makes services available by exception to the minimum extent necessary while balancing security and ease of use.   As I’ve said before, this is a Cold War at a time when Meaningful Use encourages more data sharing and breach reporting/regulatory penalties are increasingly severe.   All you can do is your best, given fixed resources and time.   And try to get some sleep.

John Halamka is Chief Information Officer of Beth Israel Deaconess Medical Center and blogs at Life as a Healthcare CIO.

Submit a guest post and be heard on social media’s leading physician voice.

Prev

Every emergency medicine shift teaches something

April 28, 2012 Kevin 5
…
Next

Where do our wasted health dollars go to?

April 29, 2012 Kevin 6
…

Tagged as: Health IT

Post navigation

< Previous Post
Every emergency medicine shift teaches something
Next Post >
Where do our wasted health dollars go to?

More by John Halamka, MD

  • The future of EHR: Here are 5 predictions

    John Halamka, MD
  • 10 crucial guidelines for health care IT

    John Halamka, MD
  • 5 health care IT tips for President Trump

    John Halamka, MD

More in Tech

  • The pros and cons of using ChatGPT for your health care needs

    Liudmila Schafer, MD
  • A new era of collaboration between AI and health care professionals

    Harvey Castro, MD, MBA
  • What I think it means to be a medical student in the wake of AI

    Jackson J. McCue
  • The rise of generative AI in health care: Here’s what you need to know

    Anil Saldanha
  • Can AI solve the physician shortage crisis?

    Harry Severance, MD
  • Bridging the digital divide: How to bring trust back into the patient-physician relationship

    Arti Masturzo, MD
  • Most Popular

  • Past Week

    • It’s time for C-suite to contract directly with physicians for part-time work

      Aaron Morgenstein, MD & Corinne Sundar Rao, MD | Physician
    • What is driving physicians to the edge of despair?

      Edward T. Creagan, MD | Physician
    • The untold struggles patients face with resident doctors

      Denise Reich | Conditions
    • The psychoanalytic hammer: lessons in listening and patient-centered care

      Greg Smith, MD | Conditions
    • Breaking free from a toxic relationship with medicine [PODCAST]

      The Podcast by KevinMD | Podcast
    • Revolutionizing COPD management with virtual care solutions [PODCAST]

      The Podcast by KevinMD | Podcast
  • Past 6 Months

    • The real cause of America’s opioid crisis: Doctors are not to blame

      Richard A. Lawhern, PhD | Meds
    • The fight for reproductive health: Why medication abortion matters

      Catherine Hennessey, MD | Physician
    • The vital importance of climate change education in medical schools

      Helen Kim, MD | Policy
    • Nobody wants this job. Should physicians stick around?

      Katie Klingberg, MD | Physician
    • It’s time for C-suite to contract directly with physicians for part-time work

      Aaron Morgenstein, MD & Corinne Sundar Rao, MD | Physician
    • Resetting the doctor-patient relationship: Navigating the challenges of modern primary care

      Jeffrey H. Millstein, MD | Physician
  • Recent Posts

    • Breaking free from a toxic relationship with medicine [PODCAST]

      The Podcast by KevinMD | Podcast
    • Tom Brady’s legacy and the importance of personal integrity in end-of-life choices

      Kevin Haselhorst, MD | Physician
    • The hidden truths of hospital life: What doctors wish you knew

      Emily Stanford, DO | Physician
    • 10 commandments of ethical affiliate marketing for physicians

      Aaron Morgenstein, MD & Amy Bissada, DO | Finance
    • The heart of a Desi doctor: Balancing emotions and resources in oncology

      Dr. Damane Zehra | Physician
    • Safe sex for seniors: Dispelling myths and embracing safe practices [PODCAST]

      The Podcast by KevinMD | Podcast

Subscribe to KevinMD and never miss a story!

Get free updates delivered free to your inbox.


Find jobs at
Careers by KevinMD.com

Search thousands of physician, PA, NP, and CRNA jobs now.

Learn more

Leave a Comment

Founded in 2004 by Kevin Pho, MD, KevinMD.com is the web’s leading platform where physicians, advanced practitioners, nurses, medical students, and patients share their insight and tell their stories.

Social

  • Like on Facebook
  • Follow on Twitter
  • Connect on Linkedin
  • Subscribe on Youtube
  • Instagram

CME Spotlights

From MedPage Today

Latest News

  • Journal Shows Its Commitment to Exploring AI in Medicine
  • Do Away With 'Lockout' Period in iPLEDGE, FDA Advisors Urge
  • Cluster Headache, Migraine Linked to Circadian System
  • Smaller Liver Transplant Candidates Wait Longer, Less Likely to Receive Organ
  • A 'Double Whammy' for Gastric Cancer Risk

Meeting Coverage

  • Oral Roflumilast Effective in the Treatment of Plaque Psoriasis
  • Phase III Trials 'Hit a Home Run' in Advanced Endometrial Cancer
  • Cannabis Use Common in Post-Surgery Patients on Opioid Tapering
  • Less Abuse With Extended-Release Oxycodone, Poison Center Data Suggest
  • Novel Strategies Show Winning Potential in Ovarian Cancer
  • Most Popular

  • Past Week

    • It’s time for C-suite to contract directly with physicians for part-time work

      Aaron Morgenstein, MD & Corinne Sundar Rao, MD | Physician
    • What is driving physicians to the edge of despair?

      Edward T. Creagan, MD | Physician
    • The untold struggles patients face with resident doctors

      Denise Reich | Conditions
    • The psychoanalytic hammer: lessons in listening and patient-centered care

      Greg Smith, MD | Conditions
    • Breaking free from a toxic relationship with medicine [PODCAST]

      The Podcast by KevinMD | Podcast
    • Revolutionizing COPD management with virtual care solutions [PODCAST]

      The Podcast by KevinMD | Podcast
  • Past 6 Months

    • The real cause of America’s opioid crisis: Doctors are not to blame

      Richard A. Lawhern, PhD | Meds
    • The fight for reproductive health: Why medication abortion matters

      Catherine Hennessey, MD | Physician
    • The vital importance of climate change education in medical schools

      Helen Kim, MD | Policy
    • Nobody wants this job. Should physicians stick around?

      Katie Klingberg, MD | Physician
    • It’s time for C-suite to contract directly with physicians for part-time work

      Aaron Morgenstein, MD & Corinne Sundar Rao, MD | Physician
    • Resetting the doctor-patient relationship: Navigating the challenges of modern primary care

      Jeffrey H. Millstein, MD | Physician
  • Recent Posts

    • Breaking free from a toxic relationship with medicine [PODCAST]

      The Podcast by KevinMD | Podcast
    • Tom Brady’s legacy and the importance of personal integrity in end-of-life choices

      Kevin Haselhorst, MD | Physician
    • The hidden truths of hospital life: What doctors wish you knew

      Emily Stanford, DO | Physician
    • 10 commandments of ethical affiliate marketing for physicians

      Aaron Morgenstein, MD & Amy Bissada, DO | Finance
    • The heart of a Desi doctor: Balancing emotions and resources in oncology

      Dr. Damane Zehra | Physician
    • Safe sex for seniors: Dispelling myths and embracing safe practices [PODCAST]

      The Podcast by KevinMD | Podcast

MedPage Today Professional

An Everyday Health Property Medpage Today iMedicalApps
  • Terms of Use | Disclaimer
  • Privacy Policy
  • DMCA Policy
All Content © KevinMD, LLC
Site by Outthink Group

Leave a Comment

Comments are moderated before they are published. Please read the comment policy.

Loading Comments...