“Healthcare organizations have to prepare for the assumption that, at some point, preventive controls may fail,” says Heath Renfrow, Co-Founder and Chief Information Security Officer at Fenix24. “The question cannot only be, ‘How do we stop an attack?’ It also has to be, ‘How do we continue caring for patients and recover critical systems when an attack succeeds?’

“In healthcare, this problem extends well beyond IT. A prolonged outage can affect medication administration, diagnostic imaging, laboratory services, access to electronic health records, communications, scheduling and even the ability to move patients through emergency departments. At that point, cyber recovery becomes directly connected to patient safety.”

It isn’t hyperbolic to say a cyberattack on a hospital can quickly become life-threatening. With that concern looming over hospital IT teams, determining how to navigate such an emergency can’t wait for the moment of crisis — it needs to be planned ahead of time.

“Let’s be real, every crisis breeds chaos and panic no matter how prepared you are,” states Agnidipta Sarkar, Chief Evangelist at ColorTokens. “I have spent years auditing crisis plans. I talk about four indicators.

“The first indicator that I have looked at is the section that contains crisis communications. Not how detailed it is but how untangled and clear it is. Does everyone in the line of communication know their role during a crisis? When was it last rehearsed?

“The next is how well is the crisis leader enabled to guide during the storm. Would this person have the right information on demand? For example, has the board defined the thresholds of material impact and is the digital landscape designed to keep a related minimum viable digital enterprise operational during attacks. When was this last rehearsed?

“The third indicator must be the awareness of the security operations center about the tools and emergency procedures who would guide the rest of the digital teams. Are they empowered with abilities to ‘break glass’ and quarantine attacks using microsegmentation and or EDR within minutes? Do they know how emergency approvals work? Do they know where the backups are and how to trigger restoration? When was it last rehearsed?

“The fourth indicator is the awareness and arrangements with key suppliers. Do they know their role? Especially those responsible to repair or recover critical medical equipment in advance? When was it last rehearsed?”

“The question cannot only be, ‘How do we stop an attack?’ It also has to be, ‘How do we continue caring for patients and recover critical systems when an attack succeeds?’”

Pre-determined expectations can pave the way for effective crisis response. While in a cyber emergency, security leaders can help teams to keep their cool by communicating clearly and presenting themselves as a calm, dependable presence.

“Structure beats panic,” Renfrow explains. “During a major ransomware event there will be tremendous pressure from executives, clinicians, legal teams, insurers, patients and sometimes law enforcement. Everyone wants answers immediately. But moving quickly without structure can actually make recovery take longer.

“Strong leaders establish a clear command structure, create defined workstreams and give technical teams room to execute without constantly changing priorities. Decisions should be based on verified facts rather than assumptions or the loudest voice in the room.

“Communication cadence is also extremely important. Leadership should know when they will receive the next update so engineers are not interrupted every few minutes asking for status.

“I have seen repeatedly that the organizations that perform best in a crisis are not necessarily the ones with the most technology. They are the ones that establish discipline early, understand what needs to be recovered first and allow their teams to work methodically toward that objective.”