Breach Response: Taking a 'Disaster Recovery' ApproachCISO Joey Johnson on How to Improve Preparedness
"The biggest thing missing so many times is organizations not testing [these breach response plans] out," says Johnson, who was a featured speaker at Information Security Media Group's Healthcare Security Summit in New York.
"Traditionally, if you test a disaster recovery plan, you learn things every time you try to recover your systems," he says. "Breach response and preparedness is really no different."
Organizations should test various scenarios, such as, for example, how a vendor breach would affect them, he says. And they should evaluate the role of cybersecurity insurance coverage.
In devising a breach response plan, organizations must spell out who is responsible for different components of the plan, he stresses. "There are internal components, which a technical team handles, but there's a whole other level ... such as who's responsible for responding to media outlets, what's legal [department's] responsibility and who makes the call on whether this is a breach and what and who to notify," he says.
In this audio interview (see link below photo), Johnson also discusses:
- Mistakes organizations should avoid in their breach response and recovery plans;
- Special breach challenges that Premise Health faces as a provider of healthcare services to other companies' employees at their worksites;
- Predictions about the cyber challenges the healthcare sector will face in 2017.
Johnson has more than 15 years of cybersecurity experience. As the CISO of Premise Health, a Brentwood, Tenn.-based provider of worksite healthcare services, Johnson leads all organizational efforts related to cybersecurity; IT and security compliance and policy development;, security audit; and vendor risk management. Previously, Johnson held technical and program leadership roles in the public and private sectors. He formerly served as chief security officer for the U.S. Department of Commerce - Office of Computer Services, and held various security and network architecture roles leading the design and implementation of complex enterprise networks for airports, hospitals, universities and federal agencies.