Key points
- FortiBleed vulnerability remains active in the wild.
- Cylerity CISO Drew McCombs advises hospitals to vet fintech vendors.
- Multisfactor authentication is a low-cost fix for small practices.
The FortiBleed vulnerability remains active, prompting security leaders to review their defenses. According to Help Net Security, this ongoing threat coincides with new guidance for hospital chief information security officers on evaluating financial technology vendors. The outlet’s weekly review highlights these developments alongside other industry updates.
In plain English
Drew McCombs, who serves as both CTO and CISO at Cylerity, explains how he manages these dual roles. He states that security work is scheduled into every development sprint at his company. Issues that touch patient data or funds disbursement are prioritized above other tasks. This approach ensures that critical security concerns are addressed consistently throughout the software development lifecycle.
The background
McCombs details how Cylerity keeps protected health information separate from its bank partner. He also explains why artificial intelligence models at the company are designed to recommend actions rather than perform them automatically. These structural choices help limit risk exposure. The interview covers specific strategies for maintaining security boundaries between healthcare data and financial systems.
What changes now
Turning on multifactor authentication for email is described as the cheapest fix for small medical practices. This simple step can significantly reduce the risk of unauthorized access. The guidance comes as organizations continue to grapple with the FortiBleed threat. Security leaders are urged to implement these basic controls while reviewing broader vendor security protocols.
What to do and how to stay safe: FortiBleed
- Enable multifactor authentication for all email accounts, especially for small medical practices.
- Review current financial technology vendor security protocols and question their data handling practices.
- Ensure that security tasks are integrated into every software development sprint.
- Verify that patient data is kept separate from bank partner systems.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the current status of the FortiBleed vulnerability?
FortiBleed remains active, according to Help Net Security’s weekly review.
What role does Drew McCombs hold at Cylerity?
He serves as both the Chief Technology Officer and the Chief Information Security Officer.
How does Cylerity handle AI models in their security operations?
AI models are designed to recommend actions but never act on them automatically.
