Worried about IT security?
You should be.
We live in a scary world, and the reality of it may be more discouraging than you know.
Around the world, access to our personal information – and our very identities – is under attack. Viruses, spyware, malware, hackers, disgruntled staff, aggressive competitors…we are surrounded by electronic threats.
And when data breaches occur, it can have far-reaching financial and reputational consequences – up to and including the loss of customers and revenue.
Consider:
- Hacking attacks occur every 39 seconds worldwide.
- Since 2013, there have been 3,809,448 records stolen every day – amounting to 158,727 per hour, or 2,645 files per minute, or 44 stolen records every second.
- One study found that more than 75% of health care industry had been infected with malware over the course of 2015-2016.
These issues are compounded in the life science industry, where careless management of information can have regulatory compliance implications, beyond privacy measures such as GDPR or HIPAA.
In the face of such threats, it’s common for pharmaceutical or medical device IT managers to worry about the role custom or bespoke software plays in security risk management, and whether it raises a company’s risk profile.
The reality?
Yes – of course it plays a role. But custom software doesn’t (or shouldn’t) live in a vacuum. It’s simply another element in your security planning puzzle.
Security must be both proactive and reactive.
Software developers should adopt a two-prong approach:
- Preventative Measures
Take all reasonable measures to prevent hacking. - Worst Case Planning
Assume you will be hacked eventually. Use encryption and other protection methods to make sure personal or clinical data is unusable if removed from your system.
The Security Three-Legged Stool
Best practices for IT security requires analysis of three key risk factors (or stool legs, for analogy-lovers):
- Software
- IT Infrastructure / Hardware
- Policies & Processes used by the company to ensure compliance
Software
It goes without saying, but good software security practices shouldn’t be an afterthought. Developers must bake them into custom software from the start of the design phase.
What constitutes a strong security practice for custom software? To start, each possible connection between the software and any data should verify the correct credentials. Another key element is information security, where information is only identifiable to parties with an established need-to-know.
In some industries (pharma, healthcare and finance, for example), the implications of lax information security can be severe – and regulatory agencies are watching.
Infrastructure
Hardware plays a critical role in IT security – from the firewalls used to protect systems to myriad backup activities designed to guarantee data protection during unforeseen events.
From a hardware perspective, one fundamental characteristic to system security is to restrict physical access to hardware. Only properly authorized people should be able to access or modify the infrastructure.
Hardware and all platform software must be patched regularly to defend against the latest vulnerabilities. Plans should be put in place to manage the patching process in order to maximize confidence in security.
Cybersecurity firm Tripwire discussed some of the specifics of configuration hardening (Configuration Hardening: Proactively Guarding Systems Against Intrusion) in a December, 2018 article:
Configurations are, in an almost literal sense, the DNA of modern information systems. “Configuration settings” are the attributes and parameters that tell these systems—from servers to network devices and from databases to desktops and applications—how to act and how to behave. Unfortunately, these systems are made to “do work” and not to “be secure.” In other words, they’re shipped infinitely capable but effectively insecure.
Policies & Processes
The third leg of our security stool is policies and processes. The strongest software in the world can be easily rendered vulnerable by weak or non-existent policies. (How can you tell if your policies aren’t up to snuff? The first rule of thumb: ‘password’ is not an acceptable password.)
“The Call is Coming From Inside the House”
Be defensive of user actions – don’t assume security violations only come from outside your organization. Minimizing the data exposure of each user to only the data they require can help lessen internal security weaknesses. This can also be required under certain regulatory statutes governing the protection of data records, such as FDA’s 21 CFR 11.
In a 2018 article at CSO, Webroot Chief Information Security Officer (CISO) Gary Hayslip discussed the infosec policies, documents and procedures needed for a comprehensive security program. These include:
- Acceptable Use policies
- Access Control policies
- Remote Access policies
- Business Continuity plans
We need to remember: people are the weakest link in IT security. With nearly all breaches attributable to human error, the policies and processes governing cyber security are of foremost importance. But remember, IT policies in your organization are only as valuable as their enforcement.
Do you have questions about custom software development and IT security?
Feel free to contact us or call us at 919-877-7977 to discuss your project.