Data Loss and Prevention: Securing Hospitals from Data Breach through End Point Security NJHIMSS Security, Privacy and Compliance Taskforce Tom Bartiromo Saint Barnabas Healthcare System, VP & CTO Livingston Services Corp, VP & CIO Co-Chair Vikas Khosla BluePrint Healthcare IT President and CEO Co-Chair November 23, 2010

Data Loss and Prevention: Securing Hospitals from Data Breach through End Point Security Moderator: Mike Maksymow, MBA/TM, CPHIMS Director, Information Services & Telecommunications Robert Wood Johnson University Hospital Hamilton Speakers: Hussein Syed Director, IT Security Saint Barnabas Healthcare System Phillip Curran Chief Information Security Officer Cooper University Hospital

Data Loss and Prevention: Securing Hospitals from Data Breach through End Point Security Agenda  Three areas of endpoint security  Endpoint health  Data security  Data Loss Protection/Prevention (DLP)  Endpoint Security Lifecycle Management  Helpful Links

Three areas of endpoint Security Endpoint health Data security Data Loss Protection/Prevention (DLP)

Endpoint Health What ?  Anti-Virus/Spyware  Malicious Code/poorly developed programs  Advance Persistent Threats (APT)  End User Misuse Why?  To prevent uninterrupted service  Data breach/exposure  Regulatory compliance  Loss of reputation  Financial impact Challenges  Awareness/Education  Cost justification  Support cost  Management Awareness  Metrics

Data Security What ?  Endpoint encryption  Removable media encryption  Asset tracking Why ?  To prevent unauthorized access  Breach notification exemptions Challenges  Adoption  Password/Key management  Endpoint performance  Cost

Data Loss Protection/Prevention (DLP) What?  Data at rest  Data in motion  Data in use Why?  Unauthorized access  Data accounting and classification  Visibility Challenges  Now you know, must do something  Business units’ buy-in

Endpoint Security Lifecycle Management Governance & Management  Policies  R&D to develop an acceptable solution  Intra-department collaboration  Marketing of security programs Operations  Maintenance of infrastructure  Incident handling

Useful Links  2010 HIMSS Security Survey  Ponemon Institute Data Security, Breach and Prevention Whitepapers and Reports