How To Provide Lean Healthcare Cybersecurity Teams With the Right Support

M Physicians Turns to Always-On Security Monitoring

In Minneapolis, Tennelle Anderson, senior director of technology solutions and cybersecurity at M Physicians, has overseen a steady maturation of the security program for the past decade. As the group practice for University of Minnesota Medical School faculty, M Physicians owns five clinics and operates three more, with over 2,000 physicians and 300 employees. Anderson oversees IT infrastructure, applications and security, the latter with the help of three full-time and one part-time security professionals.

The year 2020 was pivotal: M Physicians made foundational investments in data loss prevention, endpoint protection and email security. It also engaged a security operations center (SOC) to provide managed detection and response (MDR) services.

“Some bigger organizations want that in house. They want that control, and they want to employ those people. But for our smaller organization, it’s been huge to outsource that,” Anderson says.

MDR ensures that someone is always paying attention to suspicious activity, while artificial intelligence–enabled pattern recognition continues to expand SOC capabilities. “They are getting so sophisticated in what they can detect that’s out of the ordinary or that fits the pattern of a typical ransomware attack. It’s pretty amazing,” Anderson says.

The SOC journey hasn’t been without bumps; it took a couple of tries to find the right partner. One former vendor used a shared-responsibility model in which M Physicians handled 40% of the alerts and the SOC handled 60%. But earlier this year, the organization partnered with a new SOC that costs about the same but handles all of the alerts, escalating to Anderson only as needed.

“That has freed my team up to work on projects and implement new controls,” she says. “It’s been a weight off my shoulders because our previous vendor wasn’t 24/7, so I always worried, if something came up in the middle of the night, would we be able to get the right people engaged? Now, they just handle it.”

CalvertHealth Builds Incident Response Readiness

CalvertHealth, an 81-bed hospital in southern Maryland, implemented MDR two years ago. As the only full-time security professional on a 31-member IT team, Cybersecurity Specialist Carl Behnke says the SOC has given him time to review a handful of alerts each week as opposed to hundreds.

“I would get alerts all day long and through the night,” he says. Now, the SOC handles most of them, giving Behnke more time for compliance documentation, as well as security initiatives and assessments.

Crucially, the SOC also increased visibility into CalvertHealth’s environment, creating a security information and event management capability that draws data from across the health system’s firewalls, networking devices and other systems. “That allowed us to see a bigger picture, to look at the whole system and to find errors sooner instead of waiting until something breaks,” Behnke says.

From a maturity perspective, CalvertHealth had already invested in solid security tools by the time Behnke came on board, so he initially focused on critical system updates and incident response planning — a best practice that isn’t off-limits to an organization just because it’s small.

RELATED: Optimize your cyberdefense with managed security services.

For three years, Behnke led the IT team in quarterly tabletop exercises. “I would come up with a scenario and ask questions that no one had ever asked the team before, so over the years, we were able to really improve. When we ran into questions that no one had an answer for, those became items for us to work on and include in our documentation,” he says.

More recently, as major projects have required systems downtime, the team has gained even more practice operating “in the dark.” CalvertHealth is now pursuing cyber resilience planning for the entire organization, from housekeeping to the emergency room, Behnke says. 

Such exercises are crucial regardless of organizational size, Rosen adds. They often surface issues that aren’t on anyone’s radar but are likely to occur during an outage, such as phone systems going offline and rendering user identity and access management tools inaccessible.

To Behnke, small teams have certain advantages. Because staffers perform multiple roles, they develop a broader understanding of operations.

“You can say, ‘Who knows about this?’ and someone can tell you how everything connects. That makes it easier than in a larger hospital, where you have one person who does one thing, and they don’t know how it connects to anything else,” Behnke says. 

A Maturing Security Program With User Awareness Backed by Controls

At M Physicians, Anderson strives to make security as frictionless as possible, from single sign-on to automated email controls that prevent users from taking risky actions. Because physicians work in multiple locations, she moved the group to a cloud-based endpoint detection and response tool that enables faster, easier security updates.

“We need to be constantly updating those computers with virus detection, new patches and things like that,” Anderson says. “In the past, physicians would have to connect to our network via VPN and then just wait for the patches to load, and that’s not realistic.”

She’s also mindful that any IT interruption could potentially impede care. For example, one clinic provides cancer radiation treatments, so an unplanned delay could jeopardize a patient’s entire treatment plan. 

“If the system is down or a physician can’t log in and see patients, that’s a problem. Everything is a balance between needing good security and ensuring that the doctors can do their jobs, so it’s a balancing act on a daily basis,” Anderson says.

By prioritizing training, M Physicians has achieved two clear wins over time: a significant decrease in the number of users who fail phishing simulation tests and an increase in users reporting suspicious emails to IT. What Anderson is most proud of, though, is strengthening the organization’s security posture while maintaining user support.

“In a lot of places, security is the team of ‘no.’ But even after 10 years of having more restrictions over how people do their jobs, they still see my team as valuable and want our input,” she says. “We’ve implemented a lot of tools, but we’ve done it in a way that has been as frictionless as possible.”