February 16, 2017 By Scott Koegler 2 min read

Security is everyone’s business. It can affect the user experience of everyone who has a stake in the organization’s data and the systems that collect and process it.

Chief security officers (CSOs) are tasked with maintaining data security. Their jobs are complex in commercial enterprises, but health care environments pose additional challenges due to the nature of the data, the wide range of users and the massive impact of federal regulations. CSOs need insight into the uses and possible abuses of their systems so they can meet all their obligations.

Shift the CSO’s Perspective to the User Experience

Technology professionals in general, and CSOs in particular, possess tremendous knowledge about the systems they manage. That level of insight is not just a byproduct of their work, it’s a requisite for them to perform their job functions.

The kind of understanding being used to protect health care data assets, however, typically comes from an inside-out view, resulting in highly technical and detailed understandings of processes and actions rather than the outside-in view that most nontechnical users experience. This shift in perspective can make a difference in how CSOs approach systems security.

CSOs understand the technical landscape and the current state of threats they are protecting against. What they may not understand as fully is the myriad ways in which users access the systems. It’s one thing to know what functions are technically possible, but users may be experiencing a variety of pain points that inhibit practical use. Limiting use or access due to security considerations can reduce the effectiveness of the systems. In a health care environment, it can even lead to dangerous consequences.

Identify the Workarounds and Vulnerabilities

People who need access to information through secure systems are generally more interested in accomplishing their tasks than managing security or protecting data. When they can’t get the information they need, they find alternative ways to get it.

CSOs may be able to secure the applications designed to deliver information to individuals securely, but they are often unaware of workarounds users have either discovered or created. CSOs need to meet with their health care users, whether they are employees or patients, to better understand the user experience so they can resolve issues and close any unknown entry points.

These stakeholders may be able to point the CSO to previously undiscovered vulnerabilities simply by talking about how they use their systems. They may not even be aware that their everyday activities are outside the scope of the carefully designed and secure system. CSOs should converse with and observe their users and instruct them accordingly to close up these vulnerabilities.

Apply Insights

CSOs have their own sets of insights that they bring to the table when investigating the security of their systems. Users also have insights to offer that are usually different from those of security professionals. Whether they understand the internal controls of the systems and the array of cyberthreats attacking them, users can make surprising observations by combining their own professional expertise with information they glean from conversations with the CSO.

After engaging in conversations with users, it’s still up to security leaders to make use of those discussions to enhance the work environment, improve access to secure systems and reduce or eliminate problems users encounter when trying to use the information to which they are entitled.

More from CISO

CISOs drive the intersection between cyber maturity and business continuity

4 min read - The modern corporate landscape is marked by rapid digital change, heightened cybersecurity threats and an evolving regulatory environment. At the nexus of these pressures sits the chief information security officer (CISO), a role that has gained newfound influence and responsibility.The recent Deloitte Global Future of Cyber Survey underscores this shift, revealing that “being more cyber mature does not make organizations immune to threats; it makes them more resilient when they occur, enabling critical business continuity.” High-cyber-maturity organizations increasingly integrate cybersecurity…

CISO vs. CEO: Making a case for cybersecurity investments

4 min read - Ask CISOs why they think there is a cyber skills shortage in their organization, what keeps them up at night or what the most important issue facing the industry is — at some point, even if not the first response, they will bring up budgets.For example, at RSA Conference 2024, a roundtable discussion about issues facing the cybersecurity industry, one CISO stated bluntly that budgets — or lack thereof — are the biggest problem. At a time when everything is…

Making smart cybersecurity spending decisions in 2025

4 min read - December is a month of numbers, from holiday countdowns to RSVPs for parties. But for business leaders, the most important numbers this month are the budget numbers for 2025. With cybersecurity a top focus for many businesses in 2025, it is likely to be a top-line item on many budgets heading into the New Year.Gartner expects that cybersecurity spending is expected to increase 15% in 2025, from $183.9 billion to $212 billion. Security services lead the way for the segment…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today