I’ve written several posts about the issues that keep me up at night. Here’s what I wrote in 2011.
Today, my team presented a list of risks to the Compliance, Audit and Risk Committee at BIDMC. Here’s my list of top risks for 2012:
1. Old Internet browsers – many vended clinical applications require specific versions of older browsers such as Internet Explorer 6, which are known to have security flaws. We’ve worked diligently to eliminate, upgrade or replace applications with browser specificity. At this point we are 96% Internet Explorer 8/Firefox 7/Safari 5 minimizing our risks to the extent possible.
2. Local Administrative rights – Of our 18,000 devices on the network, a few thousand are devices that require the user to have local administrative rights to run their niche applications (often the research community doing cutting edge research with open source or self developed software). We have done everything possible to eliminate Local Administrative rights on our managed devices.
3. Outbound transmissions – Security has historically focused on blocking evil actors from the internet. Given the current challenges of malware and infections brought in from the outside, it’s equally critical to block unexpected outbound activity.
4. Public facing websites – any machine that touches the internet has the potential to be targeted for attack. We’ve implemented proxy servers/web application firewalls on most public websites.
5. Identity and Access management – Managing the ever changing roles and rights of individuals in a large complex organization with many partners/affiliates is challenging. If an affiliate asks for access to an application, how do you automatically deactivate accounts when users leave an affiliate, given the lack of direct employment relationships?