Cybersecurity Challenges and the Academic Health Center: An Interactive Tabletop Simulation for Executives
Cybersecurity Challenges and the Academic Health Center: An Interactive Tabletop Simulation for Executives
复制标题
DOI：
10.1097/acm.0000000000003859
复制
发表时间：
2021-06-01
影响因子：
7.4
通讯作者：
Tully, Jeffrey
中科院分区：
文献类型：
--
作者：
Maggio, Lauren A.;Dameff, Christian;Tully, Jeffrey
学术健康中心（AHC）面临网络安全漏洞，这些漏洞可能会对机构的财务，声誉和提供护理的能力造成潜在成本。然而，许多AHC高管可能对网络攻击对临床护理、研究和教育等机构使命的潜在影响没有足够的了解。方法作者在2019年9月为AHC领导人举行的国际会议上开发并促成了桌面网络安全模拟，以提高对网络安全问题和威胁的认识，并为讨论CEO和C级高管的具体问题提供论坛。3.5小时的交互式模拟使用了一个不断发展的3阶段案例研究，描述了对具有勒索软件需求的AHC的假设网络攻击。来自25个州和11个国家的大约70名参与者组成团队，讨论了如果他们担任与现实生活中职位相似的角色，他们将如何反应。作者提供了完整的场景作为资源。结果这项练习受到了参与者的好评。在会后汇报中，许多与会者指出，网络安全准备工作没有得到机构对流行病或自然灾害等威胁的重视。在模拟过程中，团队行动方案的显著差异突出表明，在基本决策方面缺乏共识。与会者认为这是一个可以通过制定指导方针或协议来补救的领域。下一步随着医疗保健网络安全挑战的持续存在或规模的增长，AHCs将有更多的机会领导制定准备和响应的最佳实践。AHC有能力与临床医生、安全专业人员、监管机构、执法部门和其他利益相关者合作，开发工具和协议，以改善医疗保健网络安全并更好地保护患者。
ProblemAcademic health centers (AHCs) face cybersecurity vulnerabilities that have potential costs to an institution's finances, reputation, and ability to deliver care. Yet many AHC executives may not have sufficient knowledge of the potential impact of cyberattacks on institutional missions such as clinical care, research, and education. Improved cybersecurity awareness and education are areas of opportunity for many AHCs.ApproachThe authors developed and facilitated a tabletop cybersecurity simulation at an international conference for AHC leaders in September 2019 to raise awareness of cybersecurity issues and threats and to provide a forum for discussions of concerns specific to CEOs and C-suite-level executives. The 3.5-hour interactive simulation used an evolving, 3-phase case study describing a hypothetical cyberattack on an AHC with a ransomware demand. The approximately 70 participants, from AHCs spanning 25 states and 11 countries, worked in teams and discussed how they would react if they held roles similar to their real-life positions. The authors provide the full scenario as a resource.OutcomesThe exercise was well received by the participants. In the postsession debrief, many participants noted that cybersecurity preparedness had not received the level of institutional attention given to threats such as epidemics or natural disasters. Significant variance in teams' courses of action during the simulation highlighted a lack of consensus with regard to foundational decisions. Participants identified this as an area that could be remedied by the development of guidelines or protocols.Next StepsAs health care cybersecurity challenges persist or grow in magnitude, AHCs will have increased opportunities to lead in the development of best practices for preparedness and response. AHCs are well positioned to work with clinicians, security professionals, regulators, law enforcement, and other stakeholders to develop tools and protocols to improve health care cybersecurity and better protect patients.