Towards a maturity model for health-care cloud security (M²HCS)

Abstract

Purpose The purpose of this paper is to propose a novel maturity model for health-care cloud security (M2HCS), which focuses on assessing cyber security in cloud-based health-care environments by incorporating the sub-domains of health-care cyber security practices and introducing health-care-specific cyber security metrics. This study aims to expand the domain of health-care cyber security maturity model by including cloud-specific aspects than is usually seen in the literature. Design/methodology/approach The intended use of the proposed model was demonstrated using the evaluation method – “construct validity test” as the paper’s aim was to assess the final model and the output of the valuation. The study involved a literature-based case study of a national health-care foundation trust with an overall view because the model is assessed for the entire organisation. The data were complemented by examination of hospitals’ cyber security internal processes through web-accessible documents, and identified relevant literature. Findings The paper provides awareness about how organisational-related challenges have been identified as a main inhibiting factor for the adoption of cloud computing in health care. Regardless of the remunerations of cloud computing, its security maturity and levels of adoption varies, especially in health care. Maturity models provide a structure towards improving an organisation’s capabilities. It suggests that although several cyber security maturity models and standards resolving specific threats exist, there is a lack of maturity models for cloud-based health-care security. Research limitations/implications Due to the selected research method, the research results may lack generalizability. Therefore, future research studies can investigate the propositions further. Another is that the current thresholds were determined empirically, although it worked for the case study assessment. However, to establish more realistic threshold levels, there is a need for more validation of the model using more case studies. Practical implications The paper includes maturity model for the assessment management and improvement of the security posture of a health-care organisation actively using cloud. For executives, it provides a detailed security assessment of the eHealth cloud to aid in decision making. For security experts, its quantitative metrics support proactive and reactive processes. Originality/value The paper fulfils a recognised requirement for security maturity model focussed on health-care cloud. It could be extended to resolve evolving cyber settings.

Cyber Risk in Health Facilities: A Systematic Literature Review

“…to propose a novel maturity model for health-care cloud security, which focuses on assessing cyber security in cloud-based health-care environments by incorporating the sub-domains of health-care cyber security practices and introducing health-carespecific cyber security metrics [72] 3.2 to use innovative technology in healthcare to treat, diagnose and monitor patients [43] 2.2 to investigate medical information security to gain a better understanding of trends in research related to medical information security [96] 1.2 to present a novel approach, called BotDet, for botnet Command and Control traffic detection to defend against malware attacks in critical ultrastructure systems [44] 2.2 to develop a model of factors associated with healthcare data breaches. Variables were operationalized as the healthcare facilities' level of exposure, level of security, and organizational factors [45] 2.2 to record public and physicians' awareness, expectations for, and ethical concerns about the use of EHRs [46] 2.2…”

“…to propose a novel maturity model for health-care cloud security, which focuses on assessing cyber security in cloud-based health-care environments by incorporating the sub-domains of health-care cyber security practices and introducing health-carespecific cyber security metrics [72] 3 to provide an overview of the current methodologies used to ensure data security, and a description of one successful approach to balancing access and privacy [37] 1.3…”

Respite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics

“…Juliadotter and Choo [119] 2015 Risk Theoretical Both Otero [120] 2015 Risk Theoretical Defender Solic et al [121] 2015 Risk Theoretical Defender Sugiura et al [122] 2015 Risk Theoretical Defender Wei et al [123] 2015 Risk Theoretical Defender You et al [75] 2015 Security Theoretical Defender Brožová et al [51] 2016 Risk Theoretical Defender Brynielsson et al [124] 2016 Awareness Theoretical Defender Granåsen and Andersson [125] 2016 Resilience Theoretical Defender Orojloo and Azgomi [126] 2016 Risk Theoretical Attacker Aiba and Hiromatsu [127] 2017 Risk Theoretical Defender Damenu and Beaumont [103] 2017 Risk Implementation Defender Ramos et al [41] 2017 Review -Defender Rass et al [52] 2017 Risk Theoretical Defender Alohali et al [128] 2018 Risk Theoretical Defender Li et al [82] 2018 Risk Theoretical Defender Morrison et al [43] 2018 Review -Both Pramod and Bharathi [129] 2018 Risk Theoretical Defender Proença and Borbinha [89] 2018 Maturity Implementation Defender Rueda and Avila [130] 2018 Risk Theoretical Defender Shokouhyar et al [104] 2018 Risk Theoretical Defender Stergiopoulos et al [131] 2018 Risk Theoretical Defender You et al [132] 2018 Maturity Theoretical Defender Akinsanya et al [133] 2019 Maturity Theoretical Defender Bharathi [134] 2019 Risk Theoretical Defender Fertig et al [135] 2019 Awareness Theoretical Defender Husák et al [31] 2019 Review -Defender Salih et al [136] 2019 Risk Theoretical Defender Cadena et al [34] 2020 Review -Defender Wirtz and Heisel [137] 2020 Risk Theoretical Defender Ganin et al [138] 2020 Risk Theoretical Defender Luh et al [90] 2020 Risk Theoretical Both Table A3. The in...…”

The impacts of the cyber-trust program on the cybersecurity maturity of government entities in the Kingdom of Bahrain

“…US energy sector and the DOE defined the MM as "a set of characteristics, attributes, indicators, or patterns that represent capability and progression in a particular discipline" (C2M2, 2021). According to Le and Hoang (2016) and Akinsanya et al (2019), a MM is a good tool that helps organizations evaluate performance and identify weaknesses to build improvement plans to attain their goals. Curtis and Mehravari (2015) mentioned that the MM provides standards used to assess the current level of capability and maturity of processes and practices that help the organizations put their goals based on their level of importance.…”

“…The hybrid, however, is a combination of both the progression and the MMs (Allen and Mehravari, 2014). In another study by Akinsanya et al (2019), the researchers define the cyber security MM as "a tool that can track improvements made over time from embedding security within an organization's daily and strategic workflows and between similar organizations in an industry." There is a big necessity for cybersecurity MMs, which can enable people to better manage organizations (Stevanovi c, 2011) and assist in evaluating their current procedures for cybersecurity assurance (Payette et al, 2015).…”