Where Is the Cybersecurity Poverty Line – Ep 569 

Think cybersecurity is all about how much money you throw at the problem? Think again. In this episode, we unpack the idea of the “cybersecurity poverty line” and why being under-protected isn’t always about having an empty wallet. From outdated technology to missing expertise and leadership roadblocks, you’ll discover why even organizations with healthy budg

ets can still leave the front door wide open to cybercriminals. If you’ve ever wondered whether your biggest security challenge is really your budget, or something else entirely, this conversation is for you.

In this episode:

Where Is the Cybersecurity Poverty Line? – Ep 569

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Episode Roadmap

Where Is the Cybersecurity Poverty Line?

Links for this episode:

https://www.youtube.com/watch?v=P8RP4QcygzY

https://www.sophos.com/en-us/blog/sophos-cybersecurity-poverty-line

https://healthsectorcouncil.org/on-the-edge-cybersecurity-health-of-americas-resource-constrained-health-providers/

https://www.cybersecuritydive.com/news/ceo-cyber-security-strategy-CISO/721102/

Last week we talked about several costly cybersecurity assumptions, including one of the biggest myths:

• Small organizations are too small to be targeted.
• Large organizations are protected because they have more resources.

We pointed out that size doesn’t determine your cybersecurity risk.

Healthcare is often described as “target-rich, resource-poor.”

But what does resource-poor actually mean?

That’s where Wendy Nather’s concept of the Cybersecurity Poverty Line gives us a useful way to think about cybersecurity.

The Poverty Line Creator

• Credit Wendy Nather for creating the Cybersecurity Poverty Line concept. The framing she used to describe it has held up for more than a decade since she first used it in 2011.
• Credit Sophos for revisiting and expanding on the concept in a recent article. That article really went along with some of the topics we covered and the work we do on the HSCC CWG.

What Is the Cybersecurity Poverty Line?

Definition:

The Cybersecurity Poverty Line is the point below which an organization cannot be effectively secured because it lacks one or more critical resources.

This is not about:

• A budget number
• Good vs. bad security
• Mature vs. immature programs
• Small vs. large organizations

It is about structural constraints that are created when money, expertise, capability, and influence act together.

The Four Forces

Money

Without funding you cannot obtain:

• Security tools
• Security staff
• Managed security services
• Training
• Incident response resources

Money matters – but it isn’t enough all by itself. You can get the funding and still not be secure.

Expertise

Even with funding, someone must know:

• What to buy
• How to configure it
• How to monitor it
• How to respond when something goes wrong

Money without expertise often becomes expensive shelfware. We often say throwing money at it will not make a problem like cybersecurity go away. Buying more stuff does not equal using the stuff nor does it mean you needed it in the first place!

Capability

Sometimes organizations literally cannot implement recommended controls.

Healthcare examples:

• Legacy medical devices
• Unsupported operating systems
• Vendor restrictions
• Patient safety concerns
• Clinical workflow requirements

Knowing what should be done doesn’t always mean you can do it. Sometimes, there are things out of your control that make a huge difference and no one is addressing.

Influence

Security doesn’t stop at your firewall.

Influence includes:

• Vendors
• Business Associates
• Cloud providers
• Medical device manufacturers
• Executive leadership
• Board governance

Sometimes the greatest limitation isn’t technology.

It’s getting someone else to change behaviors, policies, procedures, etc. because the right people support the mission to secure the organization.

These Four Forces Work Together

This is the real strength of the model.

These aren’t independent resources.

Examples:

• Money without expertise buys tools no one knows how to use.
• Expertise without capability creates recommendations that can’t be implemented.
• Capability without influence means vendors or leadership prevent needed changes.
• Influence without funding still doesn’t pay for security improvements.

The combination shows why the Cybersecurity Poverty Line is not a budget number that you should aim to achieve.

It is the result of these four forces working together.

The Interesting Point

In their article, Sophos points out that many people misunderstand the Cybersecurity Poverty Line. That is what made me think about the broader application of the term when we consider healthcare.

A common assumption is that it simply describes small organizations.

It doesn’t.

That’s the same myth we discussed last week.

• Small organizations can be above the line.
• Large organizations can be below it.

Size may influence available resources. It does not determine whether an organization is above or below the Cybersecurity Poverty Line.

Healthcare Perspective

Healthcare is often described as: Target-rich, resource-poor.

The Cybersecurity Poverty Line helps explain what “resource-poor” actually means and how it applies in the broader picture of healthcare specific cybersecurity requirements.

Resource-Constrained Healthcare vs. The Cybersecurity Poverty Line

While reading the Sophos article, it immediately brought to mind last year’s HSCC guidance on Resource-Constrained Healthcare Providers.

In the report, HSCC defined a resource-constrained provider as:

“A medical facility or individual practitioner encountering significant obstacles in providing comprehensive healthcare services and conforming to operational standards, often due to financial constraints, geographic isolation, or patient population characteristics.”

This is an important distinction.

A resource-constrained provider describes the organization.

The Cybersecurity Poverty Line describes the organization’s cybersecurity condition.

Those are related—but they are not the same thing.

Resource-constrained providers may struggle because of:

• Financial limitations
• Rural or isolated locations
• Workforce shortages
• Aging technology
• Challenging patient populations

The Cybersecurity Poverty Line asks a different question:

Do those constraints leave the organization without enough:

• Money
• Expertise
• Capability
• Influence

to adequately secure itself?

Resource-constrained providers are more likely to find themselves below the Cybersecurity Poverty Line—but not every resource-constrained provider is below it, and organizations with far greater resources can still find themselves there.

Leadership Is Also a Resource

One healthcare resource often isn’t discussed enough: Leadership commitment.

Sometimes the missing resource isn’t money. It’s organizational recognition. We discuss this issue in the boot camp, hangouts, assessments, and more.

Without leadership support:

• Budgets suffer.
• Priorities suffer.
• Governance suffers.
• Influence disappears.

This is where healthcare organizations often create constraints for themselves.

Reference the Change Healthcare Congressional testimony.

Observation from Congress during testimony: Cybersecurity expertise was not represented at the board level.

Regardless of anyone’s opinion about that organization, it illustrates how a lack of organizational influence can become a structural cybersecurity limitation.

This is one of the reasons we are going to start to see folks like Erik Decker appointed to boards.

Small, Large, Rural, Urban

This framework applies across healthcare.

Rural Practice

May struggle with:

• Budget
• Expertise

Community Health Center

May struggle with:

• Staffing
• Technology

Critical Access Hospital

May struggle with:

• Capability
• Vendor dependence

Large Health System

May struggle with:

• Complexity
• Legacy technology
• Organizational influence
• Governance

Different organizations.

Different constraints.

Same framework.

Look At The Bigger Picture

The Cybersecurity Poverty Line is not:

• A maturity score
• A budget number
• A measure of whether an organization is “good” or “bad” at cybersecurity

It is a way to identify what is preventing your organization from becoming more secure.

Ask yourself:

• Is money our limiting factor?
• Is expertise?
• Capability?
• Influence?

Once you identify the real constraint, you can begin solving the underlying problem instead of treating symptoms.

Last week we learned that size doesn’t determine cybersecurity risk.

This week we learned that resources – not just dollars, but expertise, capability, and influence – determine whether an organization has a realistic opportunity to become secure.

The goal isn’t to compare yourself to another organization.

The goal is to understand what’s keeping your organization below the Cybersecurity Poverty Line and begin removing those barriers one at a time.

The bottom line? Cybersecurity isn’t about chasing a magic budget number or buying the latest shiny security gadget. It’s about making sure the right mix of resources, expertise, capability, and leadership are working together to protect your organization. Take an honest look at where your biggest gaps are, because the sooner you identify what’s holding you back, the sooner you can move above the cybersecurity poverty line, and stay there.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.