CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

Better, Faster, Cheaper: Changing the Economics of
Responding to Cyber Attacks in the Healthcare Sector
By John Attala, Director, North America, Endace
The healthcare sector has been and continues to be under attack. As long as malicious criminals
and hackers have the upper hand in agility, healthcare organizations, frequently under-resourced,
face a never-ending struggle to defend themselves and their data.
Hardware appliances constitute the majority of security solutions required to defend healthcare
companies from cyber-attacks. They are expensive to buy and maintain—and can become
obsolete before being fully depreciated. The result is that NetOps and SecOps teams are
habitually stuck with outdated security solutions during what is often a time-intensive upgrade or
replacement process. Getting approval, raising budget, evaluating vendors, running proof-ofconcept
tests, deploying and configuring new solutions can often take months or years. Cyber
thieves don’t have the same constraints, often using their victims’ own infrastructure to attack
them.
For a healthcare organization to be truly agile and able to respond more quickly and more
effectively to attacks, it must be able to move beyond hardware-based security solutions. A
common platform that allows security analytics solutions to be deployed as virtualized applications
removes dependence on specific hardware and allows agile deployment of new functionality as
needs evolve.
Virtualizing security functions has the potential to deliver the same benefits that virtualization has
delivered in the data center, removing the overhead of managing huge numbers of individual,
hardware-based servers and making deployment inexpensive, fast, and relatively easy.
Healthcare security teams face another challenge: the challenge of dealing with a flood of security
alerts that their security tools raise. The sheer number of security alerts, and the time it takes to
triage, prioritize and investigate each alert is overwhelming. Research from McAfee states that
93% organizations can’t adequately triage relevant threats and are unable to sufficiently
investigate 23% of the alerts that are raised.
The fact is, investigations simply take too long. Traditional investigation methods involve a slow,
cumbersome, and often inconclusive, process of collecting and collating evidence from multiple