CSF - gettectonic.com
Cyber Insurance

Cyber Insurance

Navigating Cyber Insurance in an Evolving Threat Landscape The rapidly shifting cyberthreat landscape presents unique challenges for healthcare organizations and underwriters navigating cyber insurance coverage decisions. Cyber liability insurance plays a crucial role in shielding healthcare providers from the mounting costs associated with data breaches and cyberattacks, which now average $9.77 million per incident in the healthcare sector, according to IBM. The Challenges of Retaining Cyber Insurance Healthcare, among other heavily targeted sectors, faces difficulties in securing and maintaining affordable cyber insurance. The constantly evolving threat landscape impacts risk profiles, which drives up premiums and complicates coverage retention. Although year-over-year premium growth plateaued in the U.S. in 2023, 79% of respondents in a Delinea survey still reported increased insurance costs, with 67% experiencing premium hikes between 50% and 100%. As high-profile healthcare cyberattacks and increasing cyber risks persist, navigating the insurance landscape remains a significant challenge. Additionally, the lag in processing claims makes it difficult to anticipate how underwriters will respond to these changing threats. How the Evolving Threat Landscape Impacts Cyber Insurance Obtaining adequate cyber insurance coverage can be challenging in today’s risk-heavy environment. Unlike traditional insurance, where risks remain static, cyber risks constantly evolve to counteract security controls. “Cyber insurance risk adjusters face a unique challenge; unlike fires, which aren’t actively trying to burn you in new ways, cyberthreats are constantly adapting to bypass existing protections,” said Christopher Henderson, senior director of threat operations at Huntress. This continuous adaptation often means that by the time underwriting is complete, a risk assessment may already be outdated. Shifts in the threat landscape are driving changes in cyber insurance questionnaires. While in 2023 insurers focused on remote access tools, vulnerability management, and administrative access controls, the focus in 2024 shifted to include multifactor authentication (MFA) and identity-based attack prevention. This shift highlights the need for organizations to adapt to new requirements in cyber insurance as cybercriminals add new tactics to their playbooks. Adapting Insurance to Emerging Threats As cyberthreat tactics evolve, insurers may adjust policy terms to keep pace with the latest risks. Henderson suggests that insurers could move toward shorter underwriting cycles, possibly even six-month periods, to better align with the rapidly shifting cyber landscape. Mitigating Risk and Controlling Cyber Costs Several factors influence cyber insurance premiums, including organizational size and security posture. For healthcare providers, adhering to industry standards like SOC 2 and ISO 27001 can demonstrate compliance with best practices, improving coverage terms and potentially lowering premiums. Healthcare organizations using the NIST Cybersecurity Framework (CSF) as their primary security standard reported lower premium increases compared to those without this framework, according to a 2024 report by KLAS Research, Censinet, and the American Hospital Association. Henderson emphasizes the importance of layering new strategies with proven, traditional ones: “While staying vigilant against newer tactics like social engineering and identity-based attacks, maintaining consistent, auditable identity verification and MFA protocols remains crucial.” Despite upfront costs, cyber insurance can significantly reduce financial impact during cybersecurity incidents. For example, a 2024 Sophos report found that organizations with cyber insurance saw an average ransomware recovery cost of $2.94 million compared to $3.48 million for those without coverage. Navigating cyber insurance can be complex for healthcare organizations, but careful attention to risks and proactive security measures can help them secure the right coverage at sustainable rates. Like Related Posts Salesforce OEM AppExchange Expanding its reach beyond CRM, Salesforce.com has launched a new service called AppExchange OEM Edition, aimed at non-CRM service providers. Read more Salesforce Jigsaw Salesforce.com, a prominent figure in cloud computing, has finalized a deal to acquire Jigsaw, a wiki-style business contact database, for Read more Health Cloud Brings Healthcare Transformation Following swiftly after last week’s successful launch of Financial Services Cloud, Salesforce has announced the second installment in its series Read more Top Ten Reasons Why Tectonic Loves the Cloud The Cloud is Good for Everyone – Why Tectonic loves the cloud You don’t need to worry about tracking licenses. Read more

Read More
Adopting Salesforce Security Policies

Adopting Salesforce Security Policies

Data breaches reached an all-time high in 2023, affecting more than 234 million individuals, and there’s no sign of the trend slowing down. At the center of this challenge is how organizations allocate resources to safeguard customer data. One of the most critical systems for managing this data is CRM platforms like Salesforce, used by over 150,000 U.S. businesses. However, security blind spots within Salesforce continue to pose significant risks. To address these concerns, the National Institute of Standards and Technology (NIST) offers a strategic framework for Salesforce security teams. In February 2024, NIST released Version 2.0 of its Cybersecurity Framework (CSF), marking the first major update in a decade. Key improvements include the introduction of a new “Govern” function, streamlining of categories to simplify usability, and updates to the “Respond” function to enhance incident management. This framework now applies across all industries, not just critical infrastructure. For Salesforce security leaders, these changes will significantly affect how they manage security, from aligning Salesforce practices with enterprise risk strategies to strengthening oversight of third-party apps. Here’s how these updates will influence Salesforce security going forward. What is the NIST Cybersecurity Framework 2.0? The NIST Cybersecurity Framework, first launched in 2014, was developed after an executive order by President Obama, aiming to provide a standardized set of guidelines to improve cybersecurity across critical infrastructure. The framework’s objectives include: The newly updated NIST CSF 2.0, released in 2024, expands on the original framework, providing organizations with structured, yet flexible, guidance for managing cybersecurity risks. It revolves around three core components: the CSF Core, CSF Profiles, and CSF Tiers. Key Components of NIST Cybersecurity Framework 2.0 These components help organizations understand, assess, and improve their cybersecurity posture, forming the basis for risk-informed strategies that align with organizational needs and the evolving threat landscape. Key Updates in the NIST Cybersecurity Framework 2.0 and Their Impact on Salesforce Security The 2024 updates to NIST CSF offer insights that Salesforce security leaders can use to align their strategies with evolving cybersecurity risks. Implementation Strategies for Salesforce Security Leaders To incorporate CSF 2.0 into Salesforce security operations, leaders should: Conclusion: Embracing NIST CSF 2.0 to Strengthen Salesforce Security The 2024 NIST Cybersecurity Framework updates offer crucial insights for Salesforce security leaders. By adopting these practices, organizations can enhance data protection, strengthen incident response capabilities, and ensure business continuity—critical for those relying on Salesforce for managing sensitive customer data. Like Related Posts Salesforce OEM AppExchange Expanding its reach beyond CRM, Salesforce.com has launched a new service called AppExchange OEM Edition, aimed at non-CRM service providers. Read more The Salesforce Story In Marc Benioff’s own words How did salesforce.com grow from a start up in a rented apartment into the world’s Read more Salesforce Jigsaw Salesforce.com, a prominent figure in cloud computing, has finalized a deal to acquire Jigsaw, a wiki-style business contact database, for Read more Health Cloud Brings Healthcare Transformation Following swiftly after last week’s successful launch of Financial Services Cloud, Salesforce has announced the second installment in its series Read more

Read More
Confidential AI Computing in Health

Confidential AI Computing in Health

Accelerating Healthcare AI Development with Confidential Computing Can confidential computing accelerate the development of clinical algorithms by creating a secure, collaborative environment for data stewards and AI developers? The potential of AI to transform healthcare is immense. However, data privacy concerns and high costs often slow down AI advancements in this sector, even as other industries experience rapid progress in algorithm development. Confidential computing has emerged as a promising solution to address these challenges, offering secure data handling during AI projects. Although its use in healthcare was previously limited to research, recent collaborations are bringing it to the forefront of clinical AI development. In 2020, the University of California, San Francisco (UCSF) Center for Digital Health Innovation (CDHI), along with Fortanix, Intel, and Microsoft Azure, formed a partnership to create a privacy-preserving confidential computing platform. This collaboration, which later evolved into BeeKeeperAI, aimed to accelerate clinical algorithm development by providing a secure, zero-trust environment for healthcare data and intellectual property (IP), while facilitating streamlined workflows and collaboration. Mary Beth Chalk, co-founder and Chief Commercial Officer of BeeKeeperAI, shared insights with Healthtech Analytics on how confidential computing can address common hurdles in clinical AI development and how stakeholders can leverage this technology in real-world applications. Overcoming Challenges in Clinical AI Development Chalk highlighted the significant barriers that hinder AI development in healthcare: privacy, security, time, and cost. These challenges often prevent effective collaboration between the two key parties involved: data stewards, who manage patient data and privacy, and algorithm developers, who work to create healthcare AI solutions. Even when these parties belong to the same organization, workflows often remain inefficient and fragmented. Before BeeKeeperAI spun out of UCSF, the team realized how time-consuming and costly the process of algorithm development was. Regulatory approvals, data access agreements, and other administrative tasks could take months to complete, delaying projects that could be finished in a matter of weeks. Chalk noted, “It was taking nine months to 18 months just to get approvals for what was essentially a two-month computing project.” This delay and inefficiency are unsustainable in a fast-moving technology environment, especially given that software innovation outpaces the development of medical devices or drugs. Confidential computing can address this challenge by helping clinical algorithm developers “move at the speed of software.” By offering encryption protection for data and IP during computation, confidential computing ensures privacy and security at every stage of the development process. Confidential Computing: A New Frontier in Healthcare AI Confidential computing protects sensitive data not only at rest and in transit but also during computation, which sets it apart from other privacy technologies like federated learning. With federated learning, data and IP are protected during storage and transmission but remain exposed during computation. This exposure raises significant privacy concerns during AI development. In contrast, confidential computing ensures end-to-end encrypted protection, safeguarding both data and intellectual property throughout the entire process. This enables stakeholders to collaborate securely while maintaining privacy and data sovereignty. Chalk emphasized that with confidential computing, stakeholders can ensure that patient privacy is protected and intellectual property remains secure, even when multiple parties are involved in the development process. As a result, confidential computing becomes an enabling core competency that facilitates faster and more efficient clinical AI development. Streamlining Clinical AI Development with Confidential Computing Confidential computing environments provide a secure, automated platform that facilitates the development process, reducing the need for manual intervention. Chalk described healthcare AI development as a “well-worn goat path,” where multiple stakeholders know the steps required but are often bogged down by time-consuming administrative tasks. BeeKeeperAI’s platform streamlines this process by allowing AI developers to upload project protocols, which are then shared with data stewards. The data steward can determine if they have the necessary clinical data and curate it according to the AI developer’s specifications. This secure collaboration is built on automated workflows, but because the data and algorithms remain encrypted, privacy is never compromised. The BeeKeeperAI platform enables a collaborative, familiar interface for developers and data stewards, allowing them to work together in a secure environment. The software does not require extensive expertise in confidential computing, as BeeKeeperAI manages the infrastructure and ensures that the data never leaves the control of the data steward. Real-World Applications of Confidential Computing Confidential computing has the potential to revolutionize healthcare AI development, particularly by improving the precision of disease detection, predicting disease trajectories, and enabling personalized treatment recommendations. Chalk emphasized that the real promise of AI in healthcare lies in precision medicine—the ability to tailor interventions to individual patients, especially those on the “tails” of the bell curve who may respond differently to treatment. For instance, confidential computing can facilitate research into precision medicine by enabling AI developers to analyze patient data securely, without risking exposure of sensitive personal information. Chalk explained, “With confidential computing, I can drill into those tails and see what was unique about those patients without exposing their identities.” Currently, real-world data access remains a significant challenge for clinical AI development, especially as research moves from synthetic or de-identified data to high-quality, real-world clinical data. Chalk noted that for clinical AI to demonstrate efficacy, improve outcomes, or enhance safety, it must operate on real-world data. However, accessing this data while ensuring privacy has been a major obstacle for AI teams. Confidential computing can help bridge this “data cliff” by providing a secure environment for researchers to access and utilize real-world data without compromising privacy. Conclusion While the use of confidential computing in healthcare is still evolving, its potential is vast. By offering secure data handling throughout the development process, confidential computing enables AI developers and data stewards to collaborate more efficiently, overcome regulatory hurdles, and accelerate clinical AI advancements. This technology could help realize the promise of precision medicine, making personalized healthcare interventions safer, more effective, and more widely available. Chalk highlighted that many healthcare and life sciences organizations are exploring confidential computing use cases, particularly in neurology, oncology, mental health, and rare diseases—fields that require the use of

Read More
gettectonic.com