Nationally coordinated security operations centre for health

NEWS - eHealthNews.nz editor Rebecca McBeth

The Ministry of Health is looking to create a nationally coordinated Security Operations Centre (SOC) capability to help detect and protect against cyber-attacks, as well as respond to incidents.

The Ministry has also confirmed that a review of the May 2021 Waikato DHB cyber incident is underway and should be completed in the first quarter of 2022.

Matthew Lord, information technology security manager, data and digital, says the SOC would not be a single organisation, but act like a centre of excellence to share knowledge and expertise and particularly to “help provide better support to primary care”.

Some DHBs and other health organisations already have SOC capabilities, but the idea is to coordinate and align SOC functions to allow monitoring and assistance across the health system during an incident, he says.

The government has committed up to $75.7 million in funding to improve cybersecurity in health over the next three years and the Ministry has worked with DHBs to assess the current risks and prioritise areas for improvement through a cybersecurity roadmap.

The first step in the roadmap is to build a set of core cybersecurity capabilities for hospitals, primary care and community services.

Lord says the roadmap has ten building blocks, focused on three areas, first of which is the nationally coordinated Security Operations Centre.

The second is capability and involves investment in leadership, such as the appointment of Chief Information Security Officers (CISOs) and creation of the National Cybersecurity Committee.

“What we need to do is add more cybersecurity people into the system and get them to work toward the whole system view,” says Lord.

A steering committee will run the programme of work, with oversight from the National Cybersecurity Committee, which will include the Ministry of Health, regional CISOs and a primary care CISO when they are appointed.

Both groups will also have clinician representation.

The third focus area is on the deployment of the Microsoft E5 security suite under the national agreement allowing DHBs to move on to a common platform.

Lord says moving services to the cloud is an important part of the equation as this provides an immediate uplift in security. In the Waikato DHB cyber incident, the online environment, in terms of Microsoft Exchange Online, was unaffected.

He says credible service providers have inherent protections in place to protect their infrastructure and it makes it much easier to roll-out cloud-based security technologies such as a vulnerability management service.

To comment on or discuss this news story, go to the eHealthNews category on the HiNZ eHealth Forum

To hear more from Matthew Lord on cybersecurity watch the HiNZ Member virtual event.

Read more Information Governance news

Return to eHealthNews.nz home page