Written by:
Purandar Das The pharmaceutical industry is hot and not just because we are mid-pandemic. Unfortunately, it’s a hot target for cybercriminals, with attacks having increased by 50% between 2019 and 2020. No organization is immune; especially those creating vaccines for COVID-19, such as Pfizer/BioNTech and AstraZeneca, have been subjected to attacks during the pandemic. There’s no honor among data thieves.
Data thieves are all about the money. The most profitable cyberattacks are those where data is involved. Whether it be ransomware that prevents access to data or simple data theft with the intent to sell it on the Dark Web, data is the juiciest target.
Once organizations know what the prime target is, they can focus their resources on proactive protection. Learn how pharma can leverage a data-centric approach to boost their security posture and secure their most valuable asset — data.
Data-Centric Security for Pharma – What is it?
Data-centric security makes data the focal point for security practices. It prioritizes the protection of the data over that of networks, servers, and applications. This doesn’t mean omitting or overlooking everything else; rather, security is applied to these areas intending to improve the protection of the data. In this way, purposeful high-impact security decisions increase all security by design rather than using a scattered approach.
Data-centric security starts with identifying where all of the critical data resides. You have to know what you want to protect before you can even consider how to protect it. Once the data is identified with a data-centric security model, it is classified for risk to determine what security controls are needed. These controls generally focus on access, encryption, and auditing to protect the data and guard against being disclosed or altered inappropriately.
Data Security vs. Data-Centric Security
Data security is the foundation of controls on which data-centric security is built. Data controls are all of the practices used to protect digital information from unauthorized access, corruption, or theft throughout the entirety of its lifecycle. Data-centric security utilizes these controls for protecting data. But, data security extends beyond data-centric security and is used in many other security methodologies.
What is the CIA Triad?
The CIA triad is a core principle and model of information security built on the three crucial concepts of confidentiality, integrity, and availability. Information security works to deliver on all three of the principles without having the implementation of one inhibit another. For example, implementing controls to limit access to data and provide confidentiality when done poorly can make it harder for users to access their data, decreasing availability. Striking a balance between these concepts is needed for security to be effective.
C is for Confidentiality
Confidentiality is the first pillar of the CIA triad, and it is built on the concept of data privacy. Data privacy covers the proper handling of data and limiting how it is shared and with whom. This includes those outside of an organization as well as inside.
One of the guiding concepts of confidentiality is the principle of least privilege. It dictates that only those who require access to data to complete their job duties be granted access and only for as long as needed. This approach is designed to limit the amount of data individuals have access to, to minimize the amount exposed.
Maintaining Confidentiality
There are multiple ways in which to guarantee the confidentiality of data. Some methods, such as access controls, focus on minimizing permissions so that only a limited scope of individuals have access to different sets of data. Narrowing down the number of individuals to those that must have access makes it easier to keep data private.
Data encryption is another method of guaranteeing that data remains confidential. Encryption is a process of converting data into an unreadable format that can only be decrypted by the means of a secret key that is next to impossible to guess. This private key can be used to turn it back into its original form. Limiting access to this key allows those who need access to get it and keeps those who do not, including hackers, out.
Confidentiality for Compliance
Data privacy is not just a useful concept in the pharma industry, it is also a requirement. Pharma has several regulations that require the protection and privacy of data. This protection goes beyond patient records covered by HIPAA in the US and covers a wide variety of mandates worldwide. Compliance regulations such as GDPR, CCPA, and SoX look beyond only protecting research or patient data and can cover all personal information and business data. Failure to adhere to these compliance concerns can be costly or even lead to jail time.
I is for Integrity
Integrity is the pillar that focuses on safeguarding the accuracy of data throughout its lifecycle. It guarantees that the data is not inappropriately modified or deleted and can safely be recovered if it is accidentally deleted. Unintended changes are not always malicious and may come from both human error and failures in hardware.
The other aspect of integrity is the attribution of changes. The attribution of information often comes in the form of an audit trail. It contains information on who made the change, what was changed, when it was changed, and for what purpose. This immutable record is an essential resource in pharmaceuticals for investigations into product deviations, complaints, and recalls.
Integrity for Pharmaceuticals
In the case of the pharmaceutical industry, data integrity can have life or death consequences. The integrity of data is crucial to conducting relevant research and safely creating drugs. The FDA’s Current Good Manufacturing Practice (CGMP) guidelines outline specific guidelines for handling and protecting data to maintain accuracy, integrity, and confidentiality. These standards help to guarantee that every batch of medicine meets quality standards and is safe and effective.
A is for Availability
Data and resources are not of any use if they are inaccessible. Availability is the pillar that deals with providing authorized and timely access to resources. It covers everything from the accessibility of data or an application to the ability for authorized individuals to access resources. Without this concept, data can be highly secured and immutable but useless because it cannot be accessed.
One of the common missteps that healthcare and pharmaceutical organizations make is ensuring security by locking access down to the point that it is secure but inaccessible. To meet stringent compliance mandates for confidentiality and integrity, they err on the side of minimizing the availability of resources. This stifles productivity and slows down research, increasing costs.
Availability Drives Innovation
With advances in cloud computing and a global workforce, the need for sharing data and collaboration is imperative. Cloud computing allows scalable resources to assess large quantities of data and generate insights that can only be gathered from big data analytics. Open sharing allows top minds in the field to collaborate on projects worldwide.
The accessibility challenge is doing it while still maintaining the confidentiality and integrity of the data. Managing cloud infrastructure and remote workers is a daunting task, and it requires tools to help automate and oversee the process. Tying in technologies such as encryption, role-based access control, and management dashboards allows the oversight to monitor access while creating an in-depth audit trail.
Learn how Sotero can help your organization find balance in the CIA triad. Using cutting-edge encryption technology, Sotero is experienced in helping pharmaceutical companies improve productivity while still meeting compliance requirements. Schedule a demo today to discover how Sotero can gain complete control over their data privacy, compliance, audibility, and governance.
Header photo by: Kratom IQ.