Minimum quality standard for cybersecurity training in healthcare

In order to combat cybersecurity attacks in healthcare centres, many organisations invest in security awareness training. However, without a shared feeling of responsibility for cyber risk mitigation throughout the organization and minimum quality standard, this training is likely to fall on deaf ears (BITSIGHT, 2020).

Therefore, in order to provide a quality assurance report for future training actions in SecureHospital.eu project (e.g. workshops, webinars and summer school) a minimum quality standard has been developed, as shown in Figure 1. In particular, the minimum quality standard depicted is based on the quality points derived in trainer interviews and workshop reports (Oomen, 2019).

Furthermore, the minimum quality standard defined below has also been suspended on already available literature and knowledge on internal stakeholder alignment (Jalali, 2018), policies & regulations (EUca, 2019; GDPR, 2019; NSP, 2019), guides (Palkmets, 2014; ENISA, 2018; Calder, 2015), frameworks (Rajamaki, 2018; Bris, 2017) and quality standards (PCISSC, 2014; NIS, 2019).

The SecureHospitals.eu minimum quality standard is composed of four points (light blue squares), nine tools (green squares) in a continuous improvement approach (indicated with blue arrows).

In particular, the main points related to the relevant minimum quality standard have the following flow (Linkedin, 2020; Quigley, 2019; Ferrell, 2018): P1) Trainers – Determine the materials and knowledge for the trainers assuming the risk of the training program, P2) Content – Decide the raw adequate material and according to the importance of communicating cybersecurity awareness, P3) Context – Check the training program fulfils the expectations and needs of the particular healthcare organization with adequate workable material and P4) Audience – Receive and respond to receivers expectation by utilising a comprehensive language and sharing common experiences relevant to the training delivered.

In addition, potential tools/techniques to be used by the trainers are indicated and pinpointed for the specific quality standard point, which they apply to. Several tools are considered (Oomen, 2019; Aumayr, 2019; PHF, 2020; Andriotis, 2019; BITSIGHT, 2020): T1) Reviews, T2) Metrics, T3) IT standards and GDPR, T4 Training strategies, T5) Categorise threats, T6) Examples and stories (story-telling), T7) Synergies, T8) Evaluations, T9) Training repositories and T10) Feedback.

Finally, the minimum quality standard points are incorporated in a continuous improvement approach (indicated with blue arrows), to effectively and efficiently increase cybersecurity awareness in healthcare centres (Drougkas, 2020).

Cybersecurity standards for healthcare

Cybersecurity standardisation is an essential component of competitiveness (EC, 2020) and it is traditionally well established in the ICT sector. International, European, National and Regionals standards are of relevance to be taken into account in training programs curricula because they were created to assemble institutions’ information-security management. Standards help also to further organise or understand data storage, security, utilization and communications best-practices in institutional practices, allowing them to analyse current vulnerabilities and tailor contemporary solutions.

Updating standards knowledge keeps an institution constantly in the know of cutting-edge cybersecurity threats and solutions. It also bolsters compliance efforts and instils an all-hands-on-deck, interdepartmental attention to preventing breaches, hacks and data loss.

The following Table 1 provides an overview of the main standards, bodies and organizations relevant to the ICT and healthcare sectors at European and International levels.

In general, in terms of ICT processes and recommendations the vast collection of cybersecurity standards are impulsed and discussed by several International, European and Regional level bodies, organisations, and associations (CyberWatching, 2020; Quemard, 2018; ECSO, 2017; ETSI, 2019). CEN and CENELEC EN ISO 27799:2016 standard offers guidance on information security management and information security controls in the context of the healthcare industry and medical organizations of various kinds – hospitals, labs, surgeries, medical insurers (CENEN_2020). IEC 80001-1, which deals with the application of risk management to networks incorporating medical devices, provides the roles, responsibilities and activities necessary for risk management, and is particularly relevant in the context of smart hospitals and information security (IEC, 2010). ISO also published a series of technical reports with different emphasis, which provide guidance for the implementation of IEC 80001-1. The ISO/IEC 27001 series of standards, which deals with information security management, is relevant for smart hospitals as well as for different types and sizes of organisations (ISO, 2013; ISO, 2020). CEN has an agreement for technical co-operation with ISO, while CENELEC closely cooperates with its international counterpart IEC. Also, more general for ICT standardisations is the ETSI TR 103 370 which relates to security solutions which must include a reliable and secure network infrastructure, but they must also protect the privacy of individuals and organizations (ETSI, 2019). Finally, ITU Recommendation ITU-T X.1205 provides a definition for cybersecurity for industries, such as retail banking, health care and government (ITU, 2020).

Lastly, relevant European cybersecurity agencies that should be monitored as well are ENISA and ECSO. ENISA, European Network and Information Security Agency, helps the European Commission, the Member States and the business community to address, respond and especially to prevent Network and Information Security problems. Notably it operates the EU-CERT and provides support for the ECRG, NIS activities, including harmonization of national cyber security strategies (https://www.enisa.europa.eu/). ECSO, European Cybersecurity Organization, ECSO represents an industry-led contractual counterpart to the European Commission for the implementation of the Cyber Security contractual Public-Private Partnership (cPPP). The main objective of ECSO is to support all types of initiatives or projects that aim to develop, promote, encourage European cybersecurity (http://www.ecs-org.eu/). The latter two are related to European Commission executive body, together with other entities and platforms such as NIS (https://resilience.enisa.europa.eu/nis-platform) and (http://cert.europa.eu/cert/filteredition/en/CERT-LatestNews.html) and others indicated in (ETSI, 2019).

Author

Marc Jofre

Fundacion Privada Hospital Asil de Granollers, Spain