1. Data Loss and Prevention: Securing Hospitals from Data Breach through End Point Security NJHIMSS Security, Privacy and Compliance Taskforce Tom Bartiromo Saint Barnabas Healthcare System, VP & CTO Livingston Services Corp, VP & CIO Co-Chair Vikas Khosla BluePrint Healthcare IT President and CEO Co-Chair vikas.khosla@blueprinthit.com November 23, 2010

2. Data Loss and Prevention: Securing Hospitals from Data Breach through End Point Security Moderator: Mike Maksymow, MBA/TM, CPHIMS Director, Information Services & Telecommunications Robert Wood Johnson University Hospital Hamilton Speakers: Hussein Syed Director, IT Security Saint Barnabas Healthcare System Phillip Curran Chief Information Security Officer Cooper University Hospital

3. Data Loss and Prevention: Securing Hospitals from Data Breach through End Point Security Agenda  Three areas of endpoint security  Endpoint health  Data security  Data Loss Protection/Prevention (DLP)  Endpoint Security Lifecycle Management  Helpful Links

4. Three areas of endpoint Security Endpoint health Data security Data Loss Protection/Prevention (DLP)

5. Endpoint Health What ?  Anti-Virus/Spyware  Malicious Code/poorly developed programs  Advance Persistent Threats (APT)  End User Misuse Why?  To prevent uninterrupted service  Data breach/exposure  Regulatory compliance  Loss of reputation  Financial impact Challenges  Awareness/Education  Cost justification  Support cost  Management Awareness  Metrics

6. Data Security What ?  Endpoint encryption  Removable media encryption  Asset tracking Why ?  To prevent unauthorized access  Breach notification exemptions Challenges  Adoption  Password/Key management  Endpoint performance  Cost

7. Data Loss Protection/Prevention (DLP) What?  Data at rest  Data in motion  Data in use Why?  Unauthorized access  Data accounting and classification  Visibility Challenges  Now you know, must do something  Business units’ buy-in

8. Endpoint Security Lifecycle Management Governance & Management  Policies  R&D to develop an acceptable solution  Intra-department collaboration  Marketing of security programs Operations  Maintenance of infrastructure  Incident handling

9. Useful Links  2010 HIMSS Security Survey http://www.himss.org/content/files/2010_HIMSS_SecuritySurvey.pdf  Ponemon Institute Data Security, Breach and Prevention Whitepapers and Reports http://www.ponemon.org/data-security