There's a moment in almost every first meeting I have with a hospital. The CISO is interested. The demo went well. Then the privacy officer leans forward and asks, "So where does our data go?"
Good. That's the right question. In fact, it's the question that should stop any security vendor in its tracks if they can't answer it clearly.
There's an irony here. You're bringing in a tool to make your hospital safer. But that tool sits on your network, sees your traffic, and in some cases can make changes. If it isn't built carefully, the cure becomes a new disease. So before you connect anything, from us or anyone else, ask these six questions and insist on clear answers in writing.
Six questions to ask before connecting
What will the report actually show me?
You want real findings with evidence, an explanation of what each one means, and a clear order for what to fix first. If a vendor can't show you a sample report, be cautious.
NetOps IQ’s answer for a passive assessment
Devices found within scope, relevant attack paths, evidence, and a recommended order for addressing the findings.
Is the value measured or estimated?
Plenty of vendors promise huge savings. Ask which numbers come from your own network and which are guesses. Good vendors keep the two apart and show you their assumptions.
NetOps IQ’s answer for a passive assessment
Observed findings are kept separate from estimates. Any estimate should show its assumptions; an assessment is not a guarantee of savings.
What exactly does the device do when I plug it in?
Does it only listen, or does it send anything out onto your network? Does it scan? Can it make changes on its own?
NetOps IQ’s answer for a passive assessment
It listens through an approved mirrored port. Passive assessment does not install agents on your devices or make changes to them.
Where does my data go?
What does it collect, where is it stored, how long is it kept, who can see it, and does anything leave the building? Does it rely on an outside AI service in the cloud?
NetOps IQ’s answer for a passive assessment
Findavi's AI analysis runs on the appliance. Assessment network data stays on site and is not sent to an outside AI service.
What are its own risks, and what has been independently checked?
Every product has weak points. Ask what they are and how they're protected. And make the vendor separate the certifications they actually hold from features that merely help you meet a standard.
NetOps IQ’s answer for a passive assessment
Review the appliance's access, controls, and current documentation with us before deployment. The book describes certifications as in progress; we do not present them as completed.
How much control do I keep?
Can it act without permission? Is every action recorded? Can you stop it, undo it, or shut it off whenever you want?
NetOps IQ’s answer for a passive assessment
Your team approves scope and access. The assessment observes and reports. Any later remediation requires separate approval and a record of the action.
That's the standard I'd want if I were sitting in your chair.
Questions for your team
Have you asked these six questions of the security tools already on your network? Does your privacy officer know which of your vendors send data off site? Which of your current tools could make changes without asking?