Cybersecurity in Life Sciences: Preparing for the Inevitable
By John Giantsidis, President, CyberActa, Inc.
In an era where life sciences companies are increasingly embracing smart manufacturing, digital supply chains, and the transformative power of artificial intelligence (AI) and machine learning (ML), the landscape of cybersecurity has become more critical than ever. While these advancements offer remarkable opportunities for innovation and efficiency, they also expose organizations to a myriad of cyber threats. Cybercrime is a booming industry, and even minor attacks can inflict significant damage on an organization’s reputation, productivity, and intellectual property (IP) rights.
The Growing Threat Landscape
Life sciences organizations, including those in pharmaceuticals, medical devices, and healthcare, are not immune to cyber threats. In fact, they may be more attractive targets for cybercriminals due to the sensitive information they handle and the partnerships they maintain. The protection of life sciences data, management of third-party and supply chain risks, and strategic retirement of data-rich legacy systems must be prioritized.
The Importance of Cybersecurity Incident Management
A robust cybersecurity incident management approach is essential for safeguarding a company’s operations and ensuring it can harness the benefits of digital technology across its business domains. Cybersecurity incident management is not a linear process; it is a cyclical framework comprising preparation, detection, incident containment, mitigation, and recovery.
Many organizations may lack the in-house expertise to respond effectively to a cybersecurity incident. In such cases, it is crucial to have a plan in place that outlines how to engage external experts for containment and forensic investigations. However, proactive measures can be taken before an incident occurs. Developing a comprehensive cybersecurity incident response plan is a vital first step, and it is imperative that senior management validates this plan and participates in every phase of the incident management cycle.
Preparing for a Cybersecurity Incident
Draft a Cybersecurity Incident Response Plan
When a cybersecurity incident occurs, organizations must react swiftly and appropriately. A formal written plan can help limit damage, reduce costs and recovery time, and facilitate communication with both internal and external stakeholders.
Review and Update Your Plan Regularly
A cybersecurity incident response plan is not static; it should be integrated into business processes and reviewed regularly—at least annually and after any incident.
Establish Cybersecurity Incident Response Procedures
Building on your incident response plan, define standard operating procedures for common incidents that may arise within your organization. These procedures should provide step-by-step guidance on how to address specific issues and should be easily accessible to relevant personnel.
Key Components of a Cybersecurity Incident Response Plan
Know What to Protect
Identifying your assets and potential threats is crucial. When an incident strikes, the first questions will revolve around which assets are at risk and which are vital for business continuity. Documenting and categorizing your organization’s critical assets will help prioritize protective measures and facilitate quick decision-making during an incident.
Identify, Document, and Categorize Assets
- Identify Core Business Activities: Determine which activities are essential for your organization’s existence and revenue generation.
- Assess Supporting Systems: Identify the systems (databases, applications, control systems) that support these activities.
- Location of Assets: Know where these systems are hosted—on-premises or in the cloud—and consider the flow of information to third parties.
- Prioritize Recovery: Assign business priorities for recovery to determine the order in which systems will be restored.
Creating a Cybersecurity Incident Response Team
Clearly documenting roles and responsibilities in your incident response plan is essential. Key questions to address include:
- Who is the internal contact for cybersecurity incidents?
- What are the specific incident response tasks, and who is responsible for each?
- Who will manage the incident from both business and technical perspectives?
In an ideal scenario, every organization should have an incident response team that convenes during an incident. For smaller companies, designating a cyber first responder with decision-making authority may suffice.
Preparing Your Communication Strategy
Effective communication is a critical component of every step in the cybersecurity incident response process. Control the flow of information to ensure that the right messages are communicated at the right time to the appropriate audiences.
What to Communicate and With Whom
The nature of the incident and its potential impact will dictate the type of communication required. For instance, a hacking attempt may not necessitate media disclosure. Internal communication should generally be more transparent than external communication, adhering to a need-to-know principle.
Compile a list of stakeholders who will require information during an incident, including:
- Executive Management: What is impacted? What is the response?
- Employees/Contractors: What actions should they take?
- Media: A statement on the incident and its impact.
- Customers and Suppliers: Are they potentially impacted?
- Law Enforcement: Do you wish to file a complaint?
- Regulatory Bodies: Was there a reportable data breach?
Conclusion
The experience of suffering a cyber incident should not be the catalyst for better cyber preparedness. Every organization must be well-prepared to manage a cybersecurity incident proactively. Effective cyber incident management is fundamentally a business activity that requires active engagement from executive management. Given the prevalence of cyber threats in the modern life sciences environment, it is imperative for boards of directors and senior executives to take an active interest in their organization’s incident response strategies and to implement mechanisms to prevent similar incidents in the future.
About the Author
John Giantsidis is the president of CyberActa, Inc., a consultancy for heavily regulated industries and sectors, headquartered in Boston, MA, offering global data-driven digital, regulatory, cyber, and privacy solutions. He is the vice chair of the Florida Bar’s Cybersecurity and Privacy Law Committee and a Cyber Aux with the U.S. Marine Corps. He holds a Bachelor of Science degree from Clark University, a Juris Doctor from the University of New Hampshire, and a Master of Engineering in cybersecurity policy and compliance from George Washington University. He can be reached at john.giantsidis@cyberacta.com.