Security is everyone’s business. It can affect the user experience of everyone who has a stake in the organization’s data and the systems that collect and process it.

Chief security officers (CSOs) are tasked with maintaining data security. Their jobs are complex in commercial enterprises, but health care environments pose additional challenges due to the nature of the data, the wide range of users and the massive impact of federal regulations. CSOs need insight into the uses and possible abuses of their systems so they can meet all their obligations.

Shift the CSO’s Perspective to the User Experience

Technology professionals in general, and CSOs in particular, possess tremendous knowledge about the systems they manage. That level of insight is not just a byproduct of their work, it’s a requisite for them to perform their job functions.

The kind of understanding being used to protect health care data assets, however, typically comes from an inside-out view, resulting in highly technical and detailed understandings of processes and actions rather than the outside-in view that most nontechnical users experience. This shift in perspective can make a difference in how CSOs approach systems security.

CSOs understand the technical landscape and the current state of threats they are protecting against. What they may not understand as fully is the myriad ways in which users access the systems. It’s one thing to know what functions are technically possible, but users may be experiencing a variety of pain points that inhibit practical use. Limiting use or access due to security considerations can reduce the effectiveness of the systems. In a health care environment, it can even lead to dangerous consequences.

Identify the Workarounds and Vulnerabilities

People who need access to information through secure systems are generally more interested in accomplishing their tasks than managing security or protecting data. When they can’t get the information they need, they find alternative ways to get it.

CSOs may be able to secure the applications designed to deliver information to individuals securely, but they are often unaware of workarounds users have either discovered or created. CSOs need to meet with their health care users, whether they are employees or patients, to better understand the user experience so they can resolve issues and close any unknown entry points.

These stakeholders may be able to point the CSO to previously undiscovered vulnerabilities simply by talking about how they use their systems. They may not even be aware that their everyday activities are outside the scope of the carefully designed and secure system. CSOs should converse with and observe their users and instruct them accordingly to close up these vulnerabilities.

Apply Insights

CSOs have their own sets of insights that they bring to the table when investigating the security of their systems. Users also have insights to offer that are usually different from those of security professionals. Whether they understand the internal controls of the systems and the array of cyberthreats attacking them, users can make surprising observations by combining their own professional expertise with information they glean from conversations with the CSO.

After engaging in conversations with users, it’s still up to security leaders to make use of those discussions to enhance the work environment, improve access to secure systems and reduce or eliminate problems users encounter when trying to use the information to which they are entitled.