Importance of Genetic Information Security:

Genetic information is being generated at an increasingly rapid pace, offering advances in science and medicine that are paralleled only by the threats and risk present within the responsible systems. Human genetic information is identifiable and contains sensitive information, but security genetic information is only recently gaining attention. Extensive development of laboratory security is required to realize the potential of this emerging field while protecting the bioeconomy and all of its stakeholders.

Security concerns relating to DNA:

Human genetic data contains a wealth of sensitive information. It can be used to identify an individual and predict their physical characteristics. Sensitive genetic data of humans and other entities and their respective systems must be secured to prevent private to global risks.

Genetic Information – Security breaches:

Security incidents surrounding genetic information systems are increasing rapidly. The most common reasons have been misconfigurations in cloud security settings, email phishing attacks, and the compromise of connected third-party systems. As a result, these groups may face legal action, penalties, reputational loss, and many other risks and consequences.

Genetic Information: Data Protection

Genetic information, which includes both biological material and digital genetic data, is the primary asset of concern, and associated assets, such as metadata (metadata is “data that provides information about other data”, but not the content of the data), electronic health records and intellectual property, are also vulnerable within these systems. Genetic information systems are distributed cyber-physical systems containing numerous stakeholders, personnel, and devices with extensive computing and networking capabilities. Software, hardware, and many other components introduce attack vectors that can be used to compromise these systems, including through purposefully adversarial activity and human error.

Basic security features and tools, such as antivirus software, are usually recommended with little support given, and they can also easily be subverted. Advanced and comprehensive controls and policies are not commonly implemented. On-premises or adjacent network attacks could lead to certain devices, stakeholders, and individuals being affected, while supply chain and remote attacks could lead to global-scale impact. Depending on the type and scale of a threat or exploit, hundreds to millions of people’s data could be compromised.

Conclusion:

Securing genetic information is a major challenge in this rapidly evolving ecosystem. Adequate national regulations are needed for security and privacy enforcement, incentivization, and liability, but legal protection is dictated by regulators’ responses and timelines. However, data originators, controllers, and processors can take immediate action to protect their data.

Genetic information security is a shared responsibility between sequencing laboratories and device vendors, as well as all other involved stakeholders. To protect genetic information, laboratories, and other data processors need to create strong organizational policies and reinvestments towards their physical and cyber infrastructure.

They also need to determine the sensitivity of their data and material and take necessary precautions to safeguard sensitive genetic information. Data controllers, especially healthcare providers and DTC companies, should reevaluate how their genetic data is generated and processed, with special consideration for the identifiability of human genetic data. Device vendors need to consider security when their products are being designed, implemented, and maintained throughout their lifecycles.