interviews

25.07.17

How NHS organisations can protect themselves against cyber crime

Source: NHE Jul/Aug 2017

On 12 May, a global cyber-attack occurred on an unprecedented scale. It affected organisations across the globe and, though it did not specifically target the NHS, the impact on UK health services brought cyber security to the top of the national agenda. NHE’s David Stevenson gets an update from the NHS Digital Data Security Centre on what steps NHS organisations can take to protect themselves from cyber crime.

The response to the attack on 12 May was a co-ordinated effort between a number of government organisations including NHS Digital, the Department of Health, NHS England and the National Cyber Security Centre (NCSC). 

The government is fully committed to defending against cyber threats and addressing the cyber skills gap to develop and grow talent. A five-year National Cyber Security Strategy was announced in November 2016, supported by £1.9bn of transformational investment. 

This joined-up approach was seen in practice during the attack, with these agencies offering close support for the NHS: alerting NHS organisations to known data and cyber security threats; advising them of appropriate steps to take to minimise these risks; resolving any issues as quickly as possible; and gathering feedback which can be used to further strengthen the response of the system and the ability to forewarn, forearm and respond. 

It isn’t just IT teams who have responsibilities regarding data and cyber security. It’s the responsibility of everyone in the NHS, or any organisation using IT systems and equipment, and there are plenty of ways to ensure a robust response to a cyber-security incident. 

What immediate steps can NHS organisations take? 

  1. Leadership is critical to ensuring data security is embedded across the organisation
  2. Invest in your people – across all disciplines, this isn’t simply a technology issue
  3. Get all staff to understand that data security has and will have an impact on citizen-facing services
  4. Prioritise the actions that make your biggest risks less likely to happen (for example, regular patching, getting rid of old operating systems)
  5. Prioritise the actions that make things less bad when risks do crystallise (for example, a regularly rehearsed incident management team, pre-agreed lines-to-take, alternative ways to deliver your service) 

To avoid becoming infected with ransomware and enable recovery, system users should ensure that: 

  • A robust programme of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails
  • All operating systems, antivirus and other security products are kept up to date
  • All day-to-day computer activities, such as email and internet, are performed using non-administrative accounts and that permissions are always assigned on the basis of least privilege
  • All critical data must be backed up, and these backups must be sufficiently protected/kept out of reach of ransomware
  • Multiple backups should be created including at least one off-network backup (e.g. to tape) 

What should you do if a suspected cyber-attack occurs? 

If you believe your systems have been attacked, contact your IT provider/help desk immediately. They should be the first point of contact and it is essential to seek their advice before taking any action that might affect your system. 

The NCSC was opened by the Queen in February and provides a useful central body for cyber security at a national level. It manages national cyber security incidents like these, carries out real-time threat analysis and provides tailored sectorial advice. 

The National Crime Agency encourages anyone who thinks they may have been subject to online fraud to contact Action Fraud at: www.actionfraud.police.uk. 

NHS Digital’s Data Security Centre offers advice and guidance to help health and social care organisations respond effectively and safely to cyber-security threats. To receive their regular high-severity alerts and security bulletins, email: carecert@nhsdigital.nhs.uk. 

How do we protect ourselves in the future? 

  • Ensure all systems are protected with the latest antivirus definitions
  • If your network becomes infected immediately report it to your antivirus provider for investigation and patching
  • Ensure your antivirus software is kept updated with the very latest security definitions, to detect current and evolving strains of this malware
  • Confirm with your antivirus provider that they have rolled out virus definitions which are supported by your organisation’s operating systems to protect you from the spread of this malware (especially if your organisation is running out of support operating systems)
  • Ensure your antivirus software is properly configured and automatically scans all files and file operations (including file reads, writes and renames) and manually run scans on critical areas such as servers and shared network file storage.

FOR MORE INFORMATION

W: www.digital.nhs.uk

W: www.ncsc.gov.uk

Comments

There are no comments. Why not be the first?

Add your comment

 

national health executive tv

more videos >

latest healthcare news

‘Damaging’ NHS targets ‘have had their day’ claims Lord Prior

15/02/2019‘Damaging’ NHS targets ‘have had their day’ claims Lord Prior

NHS targets “have had their day” according to Lord Prior as the head of the health service launches an attack on 25 years of flawed h... more >
Controversial shake-up of Kent stroke services given rubber stamp amid calls for judicial review

15/02/2019Controversial shake-up of Kent stroke services given rubber stamp amid calls for judicial review

A major reorganisation of stroke services across Kent and Medway have been approved following a unanimous decision by the Joint Committee of CCGs... more >
A&E waiting time performance hits all time low as NHS ‘buckles under the strain’

15/02/2019A&E waiting time performance hits all time low as NHS ‘buckles under the strain’

A&E waiting time performances in NHS trusts in England have hit their lowest level since regards began, according to the latest NHS statistic... more >
681 149x260 NHE Subscribe button

the scalpel's daily blog

Blog: 5 minutes with Dr Tracy Vell MBE, Associate Lead for Primary and Community Care, Greater Manchester, Health and Social Care Partnership.

14/02/2019Blog: 5 minutes with Dr Tracy Vell MBE, Associate Lead for Primary and Community Care, Greater Manchester, Health and Social Care Partnership.

Ahead EvoNorth we caught up with Dr Tracy Vell MBE, Associate Lead for Primary and Community Care, Greater Manchester, Health and Social Care Partnership. Dr Tracy Vell MBE shares her thoughts on the Northern Powerhouse, what it means to her and why she thinks it’s important to attend EvoNorth.  What does your role as ... more >
read more blog posts from 'the scalpel' >

comment

Maximising volunteer potential in hospitals

14/02/2019Maximising volunteer potential in hospitals

Sam Ward, director of commissioned services at the Royal Voluntary Service, argues that the right training can help harness the power of voluntee... more >
Leading and managing experts

14/02/2019Leading and managing experts

A coaching conversation is likely to yield the best results. Managing experts in the health industry can be a challenging and varying responsibil... more >
Mesothelioma in the UK: a growing fight

14/02/2019Mesothelioma in the UK: a growing fight

The health impacts of asbestos in the UK can cast a much wider net than those in the construction and building sector. Liz Darlison, head of serv... more >
ICO: Cyber security and the NHS

14/02/2019ICO: Cyber security and the NHS

Peter Brown, acting head of technology policy at the Information Commissioner's Office (ICO), explains the importance of good practice in data pr... more >

last word

Hard to be optimistic

Hard to be optimistic

Rachel Power, chief executive of the Patients Association, warns that we must be realistic about the very real effects of continued underfunding ... more > more last word articles >

editor's comment

25/09/2017A hotbed of innovation

This edition of NHE comes hot on the heels of this year’s NHS Expo which, once again, proved to be a huge success at Manchester Central. A number of announcements were made during the event, with the health secretary naming the second wave of NHS digital pioneers, or ‘fast followers’, which follow the initial global digital e... read more >

health service focus

Innovative mobile solution meeting NHS demand

07/01/2019Innovative mobile solution meeting NHS demand

EMS Healthcare report on the first fleet of m... more >
National Health Executive fuels the Northern Powerhouse with official partnership

21/11/2018National Health Executive fuels the Northern Powerhouse with official partnership

Cognitive Publishing, the home of leading hea... more >