OCTOBER - 2020ENTERPRISE SECURITY| | 19appropriateness and effectiveness based on these new influences. Our adoption is not unique, many companies have moved in this direction.With pharmaceutical and biotechnology companies moving toward digitalization, what are the new cybersecurity threats they face? Also, do the security measures have to change according to the drug development stage?Many companies, industry nonspecific, face new challenges in the trend of digitization and borderless business. As data moves beyond the traditional datacenter, the threat profile changes, requiring re-evaluation of our data protection controls. What I didn't appreciate about Life Sciences industry and digitization is the rapidly increasing reliance on third parties and resultant third-party risk. At a high level, the Life Sciences value chain extends from early stage research, drug development, clinical testing, medical filings, manufacture to commercial distribution. The sheer number of third parties engaged throughout the value chain--CROs, CDMOs, Laboratories, Universities--open the company up to significant risk if intellectual property or patient data is compromised. To deal with this risk, contractual, technical and process controls are now necessary, where they were not beforehand. For example, three key contractual controls de jour describe data protection requirements, expectations on inspection/auditing to the requirements, and identifying liability limits if disclosure occurs. Joint processes should be developed in the event of a data disclosure, such as who is responsible for incident response and public notification. Technical controls around business-to-business connectivity and data transfer should be addressed. Lastly, cybersecurity insurance has been another area to revisit to ensure worse case event may be covered through risk transference.Is it fair to say that biotech and pharma companies are desirable targets for hackers due to the value of the intellectual property? Or are there other reasons for a hacker to target Life Sciences?Intellectual property is certainly the lifeblood of businesses in the life sciences industry; the intrinsic value of the research and development may represent $USD billions of investment and future revenue. So, we are naturally focused on preventing accidental or malicious data loss of our intellectual property. However, we are just as focused on the same universal cybersecurity risks that any company faces--mainly the loss of employee data or financial data. Hackers continue to target employee information with the goal of monetizing their personal data through fraud and likewise, to use business email to trick financial staff into fraudulent wire transfers. To combat these situations, we are heavily focused on employee awareness and training to identify and report if they suspect this type of activity.For years, the pharma industry has lagged behind in the cybersecurity aspect when compared to other industries. What would it take for this popular perception to change?I've observed changes for the better in the Life Sciences, particularly pharma, over the past 2-3 years. The way Mark Leary
< Page 9 | Page 11 >