In the UAE’s rapidly evolving digital healthcare landscape, cybersecurity is no longer a
technical silo—it is foundational to public trust, operational continuity, and national resilience.
At the Department of Health, this realization has driven a significant shift in how
cybersecurity is approached and embedded across systems and services.
“Cyber resilience, especially in healthcare, isn’t just about stopping attacks—it’s about
maintaining care delivery no matter what,” says Amal Abbas Al Obeidli, Acting Section
Head of Information Security Operations. “We view security as the foundation of patient
trust.”
Recognizing the critical nature of healthcare operations, the Department has built a proactive
cybersecurity strategy centered around resilience. This includes tightly integrated business
continuity planning, advanced incident response capabilities, and a forward-looking threat
hunting posture. These are not just technical measures—they are organizational principles.
The Department’s strategy is informed by leading international frameworks such as NIST
CSF, MITRE ATT&CK, and CIS Benchmarks, and aligned with national standards including
UAE IA, ADHICS, and NESA. Amal emphasizes that this alignment has helped ensure both
operational rigor and regulatory trust.
“Global best practices give us a strong foundation, but local context matters. Aligning with
UAE-specific standards ensures we’re not only compliant—we’re relevant,” she explains.
As the healthcare sector rapidly digitizes, the attack surface has expanded significantly. One
of the key challenges identified by the Department was maintaining consistent visibility and
governance across hybrid and cloud environments. This challenge sparked a broader
transformation—moving from static tools to adaptive, cloud-native security models.
“We quickly realized that visibility couldn’t be an afterthought in a hybrid setup. We had to
rethink governance entirely,” Amal notes.
The Department responded by investing in cloud security posture management (CSPM),
automating compliance monitoring, and establishing unified policies across platforms. But
more than the tools, the cultural shift proved just as critical. By training DevSecOps
champions across teams, security was integrated early into the software development
lifecycle—improving outcomes and reducing risk.
Artificial intelligence and machine learning have played an increasingly strategic role. The
Department uses AI to support anomaly detection, threat prediction, and automated incident
triage, reducing dwell time and allowing teams to prioritize complex threats.
“AI has helped us scale our response without scaling our teams. It’s not about replacing
people—it’s about enabling them to focus where it matters most,” says Amal.
At the same time, the Department has moved away from viewing compliance as a one-time
milestone. Instead, compliance is now treated as an ongoing process—continuously
monitored, audited, and adjusted as standards evolve.
“We don’t see compliance as a checkbox exercise. It’s embedded in how we operate every
day,” Amal states.
Classification:
Public
This dynamic compliance posture has helped ensure the Department remains both agile and
audit-ready, even as digital services expand.
Crucially, cybersecurity is tightly interwoven with the Department’s broader digital
transformation agenda. As patient expectations grow and services become more digitized,
trust in the security of healthcare systems has become a strategic differentiator.
“In healthcare, people aren’t just users—they’re patients. Their data is deeply personal. That
makes security not just a technical issue, but a human one,” Amal adds.
By embedding cybersecurity into every digital initiative—from mobile apps to AI-powered
diagnostics—the Department ensures that innovation does not come at the cost of safety or
privacy.
Looking to the future, Amal sees rising complexity in threats, regulations, and technology.
Yet this is also where opportunity lies.
“We’re preparing for a world where AI-driven attacks, data sovereignty, and regulatory
intensity will all converge. To stay ahead, we’re investing in adaptive security, ethical AI
governance, and continuous resilience testing,” she says.
As the healthcare sector continues to transform, the Department of Health’s cybersecurity
leadership offers a model for how resilience, trust, and innovation can move
forward—together.
