Safeguarding the HSE - The Importance of Cybersecurity by Neal Mullen, CISO HSE

In the fast-paced environment of healthcare, where every second counts, it's easy to overlook the silent cyber threat lurking in the digital shadows. As the HSE continues to embrace digital transformation, the importance of cybersecurity awareness cannot be overstated.

Why me, what can I do?

Your role in maintaining cybersecurity is essential. With over 140,000 colleagues in the Health Service Executive working together with a unified objective of protecting our digital environment, we form one of the largest and most robust human firewalls globally. Every individual contribution counts. By maintaining your cybersecurity training, staying alert against cyber threats like phishing attacks and promptly reporting any suspicious activities or cybersecurity issues to the National Service Desk, you become a critical line of defence.

Remember, the power of one can indeed stop a cyber-attack, ensuring the safety and security of our patients, our services, and our organisation. Your vigilance and proactive actions make a significant difference!

Using the report function is the fastest way to report suspicious emails, it’s two clicks of a mouse and again could stop a cyberattack immediately. This button is found along the top tool bar in Outlook.

Why Cybersecurity Matters to the HSE

The Health Service Executive , Hospitals and step-down services are prime targets for cybercriminals due to the sensitive nature of the data we handle. Personal health information (PHI), and critical medical records are all valuable targets for malicious actors. As we learnt in 2021, a breach not only compromises patient privacy but can also disrupt patient services across hospital and community operations, potentially jeopardising patient care.

Common Cyber Threats

1. Phishing Attacks: These are deceptive emails designed to trick employees into revealing confidential information or installing malware usually by clicking on a link or opening an infected attachment. Despite their simplicity, phishing attacks are highly effective and remain the most common entry point for cyberattacks.
2. Ransomware: This type of malware encrypts health data, demanding a ransom for its release. Such attacks can halt HSE operations and risk patient safety.
3. Insider Threats: Threats from within the organisation, whether intentional or accidental, can cause significant damage. Ensuring that all staff understand their role in maintaining cybersecurity is crucial.

Building a Cybersecurity-Aware Culture within your Team

Creating a cybersecurity-aware culture within our organisation starts with regular training and clear communication. Here are some steps to foster this culture:

1. Regular Training: Ongoing cybersecurity training for all staff is essential. This training should cover the identification of phishing emails, proper password management, and protocols for reporting suspicious activity. In November 73% of our staff had completed our mandatory cybersecurity awareness training on HSeLand. To align with our international peer, this must hit 95% by the end of 2024.
2. Strong Password Policies: Encourage the use of strong, unique passwords and the regular updating of these passwords. Implement multi-factor authentication (MFA) where possible.
3. Incident Reporting: All cybersecurity incidents like receipt of malicious emails from an unknown source, or accidentally clicking suspicious link should be reported to the National Service Desk on 0818 300 300. Everyone should feel comfortable reporting any issues or incidents relating to cybersecurity, without fear of making mistakes.
4. Cybersecurity Policies: Be aware of cybersecurity policies and comply with them.

Conclusion

In the digital age, cybersecurity is just as important as patient care. By fostering a culture of cybersecurity awareness, we can protect our patients' data, maintain trust, and ensure that our organisation continues to provide the highest level of care. Let's work together to keep our digital environment as safe as our physical one.

Neal Mullen

HSE CISO

"Secure Today, Protect Tomorrow: Every Click Counts"