How Healthcare Organizations Can Keep Active on Email Security

Photography By Kyle Carpenter

The IT staff implemented Forcepoint’s email security gateway in a hybrid cloud and on-premises configuration. When incoming email arrives, Forcepoint in the cloud first scans and blocks spam, viruses, malware and phishing attacks. Emails deemed safe are then sent to MRHC’s on-premises Forcepoint virtual appliance, which performs another security scan to look for issues such as spoofed email headers, he says.

As a precaution, the appliance adds an external email warning in the subject line for emails from outside the organization. “It notifies the recipient to use extreme caution when opening attachments or links,” Chelmowski says.

In addition, Forcepoint’s Secure Web Gateway tool inspects links and stops users from going to malicious sites, while Forcepoint’s DLP software checks to ensure that users do not accidentally expose sensitive information in email or on websites. “If they are on a webpage and try to enter something sensitive, it can alert them,” Chelmowski says.

An email encryption virtual appliance doubles as another DLP tool, checking outbound email for protected health information. If found, it automatically encrypts the email before sending it.

LEARN MORE: Why is layered security essential to healthcare systems’ incident response planning?

If malicious emails somehow get through the Forcepoint technology, MRHC’s traditional on-premises security tools, such as firewalls and anti-virus desktop software, defend against threats. A security information and event management tool also aggregates logs from network and security devices to look for malicious activity.

“We try to limit the threat landscape as much as we can,” Chelmowski says.

Healthcare Cybersecurity Defense in Depth

The reliance on digital communication has grown during the pandemic for the Moffitt Cancer Center in Tampa, Fla., a 7,500-employee nonprofit with five core clinical locations and a cancer research facility. Securing email is a top priority, says Cybersecurity Operations Manager Hugh Percy.

The organization scans emails three times before they reach users: with the cloud-based Mimecast Secure Email Gateway, a next-generation firewall with an…