Cyber security is everyone’s responsibility: building resilience across the HSE

Cyber security is an important part of protecting health services, supporting staff and patients, and enabling the safe delivery of Digital for Care.

As part of Cyber Security Awareness Month this October, Neal Mullen, Chief Information Security Officer with the HSE, spoke to Joyce Shaw for the Transforming Healthcare: The People Behind the Progress interview series.

The discussion focused on cyber resilience, the role staff play in keeping HSE systems and services secure, and the practical steps everyone can take to help protect services.

Moving from cyber defence to cyber resilience

Cyber security is no longer only about defending systems from attack. It is increasingly about helping services understand risk, prepare for disruption and continue to operate when technology is affected.

For Neal and his team, this means working with services early when new initiatives and systems are being developed. Building security and resilience in from the beginning is more effective than trying to address issues at the end.

The focus has also expanded from responding to cyber incidents to helping teams prepare for disruption, maintain services and recover more quickly.

Cyber resilience means being prepared for disruption and understanding what needs to happen in the first hours of an incident. The aim is to support a faster response, quicker recovery and limit the impact on services.

Every staff member has a role

Cyber security can sometimes be seen as a technical responsibility, but protecting health services depends on people across the organisation.

The way staff work has changed. Mobile phones, laptops, email and digital systems are now part of everyday healthcare, which means staff themselves are an important part of protecting the organisation.

Training and awareness are helping staff identify suspicious activity, report concerns and understand what action to take.

The aim is not to make every staff member a cyber security expert. It is to give people enough knowledge to pause, assess a situation and ask for help when something does not seem right.

As Neal explained, everyone has a part to play in building resilience.

Supporting Digital for Care

Digital for Care will increase the health service’s use of and dependence on technology.

As new digital services are introduced, cyber resilience is an important part of making sure those services can continue to operate safely and securely.

This includes planning for potential threats, understanding how services can continue during disruption and ensuring teams know how to respond when technology is unavailable.

That disruption may be caused by a cyber incident, but similar challenges can arise through events such as power outages, fires or floods.

Simulation exercises and training are taking place across the HSE to help clinical, medical and technology teams understand the impact of disruption and prepare their response.

Training to recognise risk

Staff across the health service work in fast-paced environments and often have to make decisions quickly.

Cyber security training is designed to make it easier for staff to recognise suspicious emails and other activity, understand common warning signs and know how to report a concern.

Threats are also changing. They are no longer limited to email and can include text messages, phone calls, voicemails and video calls.

The core message is simple: if something feels unusual or someone is putting pressure on you to act quickly, pause and assess the situation before taking action.

Training is also intended to be useful beyond the workplace. The same awareness can help people make safer decisions when using personal email, social media, banking and other digital services.

Mistakes can happen

An important part of building cyber resilience is making sure staff feel comfortable reporting something when it goes wrong.

People can click on the wrong link or open something suspicious. The important action is to report it quickly rather than close the window and hope nothing has happened.

The National Service Desk works with the cyber security team to assess concerns and escalate them where needed.

Staff who report a concern will be supported through the process.

Reporting something early can help the cyber team act quickly and may prevent a larger issue from developing.

Building resilience together

Cyber resilience is about more than systems and technology. It depends on people knowing what to look out for, understanding what to do when something goes wrong and feeling confident asking for support.

For staff, the key actions are straightforward: complete cyber security training, think before clicking, pause if something does not feel right and report concerns quickly.

As the HSE continues to deliver Digital for Care and develop more connected digital health services, that shared approach will be an important part of protecting services and maintaining care when disruption occurs.

Watch the full interview with Neal Mullen.

For more information on cyber security awareness and how staff can help keep the HSE cyber safe and resilient, visit the HSE cyber security .