Despite its undeniable importance, cybersecurity remains one of the biggest question marks across the pharmaceutical industry. CISOs need to be able to confidently and accurately report on business risk to the C-suite and board of directors, particularly when it comes to R&D and clinical trials, as well as on the supply chain, writes JUAN PEREZ- ETCHEGOYEN .

The role of CISO in the pharmaceutical industry is a position that comes with a great deal of responsibility. These leaders are tasked with piecing together a security strategy that will defend their organisations against an ever-evolving threat landscape that is not only looking for ways to monetise cyber attacks, but also looking to access extremely valuable IP. Designing and implementing a strategy that checks all the boxes is a tall ask for any CISO.

Between ensuring regulatory compliance, pursuing digital transformation projects and navigating an increasing number of cyberattacks facing the industry, the list of security considerations to juggle continues to grow for pharmaceutical CISOs. 

As companies continually push to innovate, R&D processes have gained more funding and complexity over time. Meanwhile, many CISOs across the industry are finding themselves with shrinking or stagnant security budgets, leading to a host of new concerns around securing data and understanding what segments of the company may be at risk.

CISOs are being asked to protect massive amounts of data – clinical data, patient information, sales operations figures, and more – while often lacking the necessary visibility into the systems supporting R&D, enterprise resource planning (ERP), and other business-critical operations. 

Let’s break down the top security concerns facing the pharmaceutical industry today and discuss how CISOs can remedy the issues that keep them up at night.

Keeping it running

Business applications are at the core of the industry’s most critical operations, including digital supply chains, R&D, clinical trials, and more. Any shutdown within these operations could have significant financial, safety, or regulatory ramifications, particularly as it impacts products designed for human consumption.

With that in mind, CISOs are concerned with keeping the wheels turning at every stage of the pharmaceutical journey. Any security issue, whether a breach that halts the clinical trial and development process, or unauthorised access that leads to an outage in the supply chain, ultimately hinders the company’s ability to deliver safe and quality treatments.

From an ERP application housing corporate financials to a CRM platform storing patient data, malicious actors know the value of the assets within these business applications. That is what makes It crucial for CISOs to ensure the resiliency of the systems that their organisations rely on.

Threat detection is the key to understanding where vulnerabilities lay, but CISOs must first have visibility across their full system landscape. Visibility ensures that threat indicators, unpatched vulnerabilities, and exploit activity can be detected in applications and their connections.

Locking things down

The business applications utilised by pharmaceutical companies are not inherently a target for cyber attackers. Rather, it is the data within them that makes these applications so lucrative. Therefore, CISOs must make combating data loss one of their top priorities when addressing their security posture.

The breach of sensitive IP, such as drug recipes and the personal identifiable information (PII) of patients and employees, could result in reputational damage, compliance violations, or even competitors learning recipes. According to a 2022 report, some 58 per cent  of Fortune 500 pharma executives reported that their data had been exposed.

Organisations need to be equipped with the appropriate tools, not only to identify potential vulnerabilities, but to respond to and mitigate threats that could result in data loss. If detection is the first step in the process, response must be the next. Data exposure is not uncommon, and when it does occur, CISOs ought to have incident response plans in place.

Incident response has evolved greatly and, in today’s landscape, it can be automated to allow security teams to react as quickly as possible when a threat emerges. Additionally, sophisticated threat intelligence is able to reveal and analyse the root cause of an incident. This helps CISOs better understand where gaps in their security posture may be, allowing companies to adjust their data protection strategies accordingly.

Facing the board

Despite its undeniable importance, cybersecurity remains one of the biggest question marks across the pharmaceutical industry. CISOs need to be able to confidently and accurately report on business risk to the C-suite and board of directors, particularly when it comes to R&D and clinical trials, as well as on the supply chain.

Understanding where vulnerabilities exist is one thing, but translating those vulnerabilities into business risk can be a unique challenge in and of itself. CISOs need to make the topic of security easily digestible for stakeholders and communicate to them what might be putting the organisation’s sensitive data at risk.

The world of cyber threats can be difficult to articulate, which is why CISOs should strive to provide stakeholders with a quantitative, actionable framework that can help inform specific cybersecurity and compliance initiatives. A sophisticated risk assessment tool should be able to identify and evaluate flaws in an organisation’s security posture. From there, CISOs can spell out for leadership exactly what is or is not working.

A better pharma future

Economic uncertainty is pushing pharmaceutical investors to focus more on obtaining tangible results and showcasing ROI more rapidly, as opposed to investing in longer-term potential as they once did.

Today’s CISOs have a crucial role to play, now more than ever before. Any security risk to business applications, data, or the supply chain has the potential for significant consequences to the organisation’s future.

In order to combat these challenges, prioritising system visibility and data security allows companies to protect and respond to potential issues as they arise, while keeping their organisational focus on innovating as expectations continue to soar higher.

• Perez-Etchegoyen is chief technology officer at Onapsis, where he leads the Research & Development teams. He is responsible for the design, research, and development of Onapsis’s innovative software solutions, and helps manage the development of new products, as well as the SAP cyber-security research.