Cyber Security Risk Assessment Methods for Smart Healthcare

Cyber security is essential for healthcare organizations in an ICT environment. They must protect electronic health records (HER) systems, e-prescribing systems, practice management and clinical decision support systems, radiology information systems, diagnosis software, and computerized physicians order entry (CPOE) systems. A security risk assessment identifies, evaluates, and prioritize securityrisks to an organizations’ assets, including mitigating application security vulnerabilities, its s a critical component of an healthcare organization’s risk management strategy and risks must be assessed before any action is taken to mitigate them. Generalized cyber risk assessment frameworks are available; however, they may not provide comprehensive mapping between assets, related threats, identified risks, impacts and mitigation controls. A more thorough examination is required to demonstrate a strong enough association between all of these. This paper reviews available generic cyber risk assessment frameworks including NIST, ISO and OCTAVE and discusses the methodology of assessment, comparison and limitations associated with these frameworks.