2 min read

The four pillars of security awareness

Kirsten Peremore December 11, 2023

Cybersecurity

Security awareness revolves around understanding and adherence to various security practices and policies to safeguard against threats. This concept is built upon four essential pillars: Security reminders, protection from malicious software, log-in monitoring, and password management.

Pillar 1: Security reminders

Security reminders are a proactive approach to keep an organization's security policies and practices at the forefront of employees' minds. They serve as frequent and strategic prompts that reinforce adhering to established security protocols. These reminders can take various forms, such as electronic alerts, printed notices, topics in meeting agendas, or posters in key areas. The main points to remember include:

Focus on security aspects relevant to healthcare, like patient data privacy and protection against malware.
Tailor the content to address specific threats and scenarios healthcare professionals might encounter.
Use clear language for easy understanding and quick recall.
Incorporate visuals, infographics, or brief videos to make the reminders more engaging and memorable.
Distribute the reminders through various channels like email, intranet, physical posters in common areas, and staff meetings.
Include quizzes or interactive elements to make the learning process more engaging.

Pillar 2: Protection from malicious software

This pillar focuses on safeguarding an organization's digital assets from various forms of malicious software, such as viruses, worms, and Trojan horses, which can compromise patient data and disrupt healthcare operations. The cornerstone of this pillar is education: training healthcare staff to recognize and avoid potential malware threats, whether they arrive via email, downloads, or other digital avenues. It also involves:

Implementing antivirus
Maintaining anti-malware tools
Ensuring regular updates
Establishing protocols for immediate response if an infiltration is detected

Pillar 3: Log-in monitoring

Log-in monitoring involves tracking and analyzing login attempts to an organization's information systems to detect unauthorized access and potential security threats. This process is necessary in the healthcare sector, where protecting sensitive patient data is paramount. Methods of implementing log-in monitoring include:

Configure information systems to send automatic alerts for unusual login activities, such as multiple failed attempts or logins at odd hours.
Keep comprehensive records of all login attempts, successful or failed, along with timestamps and user details.
Set policies that temporarily lock accounts after a certain number of failed login attempts to prevent brute force attacks.
Track logins from unusual geographic locations or unknown devices could indicate unauthorized access.
Perform periodic audits to assess the login monitoring system's effectiveness and identify improvement areas.

Pillar 4: Password management

Password management is vital in maintaining information systems' security, particularly in sensitive environments like healthcare. It involves creating and handling passwords to ensure they remain robust and secure. The process starts with setting strong password creation guidelines, such as using a mix of characters, numbers, and symbols, and avoiding common words or easily guessable combinations.

Password management can be made easy with the use of password management apps. This option does still come with its own set of risks, therefore organizations should look for HIPAA compliant, reputable services.

A few features of a HIPAA compliant software management option include: