Healthcare is one of the sectors that’s most vulnerable to cyber-attack. According to Breach Level Index, a platform that tracks publicly exposed breaches, healthcare organizations encountered the highest number of breaches in 2017.
The healthcare sector in the US faced the highest number of breaches, with over 400 reported incidents. As an example, the WannaCry and NotPetya international cyber-attacks have constituted significant security incidents in healthcare organizations.
The increasing adoption of digital healthcare services, such as online patient portals and health-related mobile apps, has made sensitive information such as credit card numbers and personal health information vulnerable to malware, hacking and misuse. With limited security measures in place for protecting valuable healthcare data, the industry seems to be a preferred target for cyber-attack.
With growing security concerns, global spending in healthcare cybersecurity is set to increase. According to Netscribes research, healthcare contribution to cybersecurity revenues will continue to grow at a CAGR of over 12 percent to reach 26.24 billion by 2022.
For a comprehensive healthcare cybersecurity market research report, contact info@netscribes.com.
Contrary to most sectors, healthcare faces most threat from internal sources. According to a data breach investigation report by Verizon, this is largely due to the fact that the healthcare companies are susceptible to data misuse and error in the form of data misdelivery, misplacement, misconfigurations, publishing, and disposal errors.
Ransomware is a major concern – accounting for 85 percent of all malware in healthcare. Social attacks (mostly phishing and pretexting) appear in approximately 14 percent of incidents in healthcare.
Cyber-attacks are strategically perpetrated by unlawful individuals or entities seeking to exploit existing loopholes in their security framework. The difficult part of the problem is the sheer nature of healthcare fraud- it is complicated and isn’t easily detectable. Hackers who target healthcare institutions operate anonymously on the Internet from disparate locations around the world. Their activities are nuanced and sophisticated, and they use nefarious tools and methods while committing crimes, which in most cases, renders them untouchable by law enforcement agencies.
While cybersecurity programmes are improving, there are several factors keeping organizations from achieving robust vulnerability management.
According to a survey report by HIMSS North America, the top five barriers for remediating and mitigating cybersecurity incidents were:
- Lack of appropriate cybersecurity personnel: Over 50 percent of the respondents said that that finding and recruiting skilled IT security professionals is a challenge for effective risk management. This comes as no surprise, given the fact that the demand for trained cybersecurity professionals exceeds the supply of available talent.
- Lack of financial resources: It was found that most organizations spend 6 percent or less on IT security, which points at a larger problem – lack of buy-in from the top management. Staying ahead of attackers requires continuous and systematic security investments to meet training and risk management needs. The lack of budgets could restrict IT departments from meeting this objective.
- Too many application vulnerabilities: Flaws in software programs allow hackers to compromise machines and steal information. This is common in old software applications or ones that have not been updated in a long time. Too many unpatched flaws or bugs can put company machines and data at significant risk.
- Too many endpoints: As healthcare organizations have multiple endpoints and several types of devices (medical devices, operating systems, mobile devices etc.), keeping track of all of them is extremely complicated. Organizations rely on several specialized products/agents, which makes it even harder to find a comprehensive solution to endpoint security.
- Too many emerging and new threats: Cyber threats are evolving in terms of their strategy while becoming increasingly complex in nature. This poses the challenge of continuous upgrades and investment in advanced cybersecurity solutions.
The healthcare industry is still getting used to the looming cyber threat targeting organizations. Many professionals are used to old methods of handling data, which makes cyber threat intelligence even more critical.
For cybersecurity to improve, organizations require:
- Strong IT security practices, which include comprehensive and frequent risk assessments and penetration testing
- Adoption of new and improved security management processes and systems
- Regular installation of software updates
- Robust collaborative endeavors among industry equals, government regulatory authorities, commercial organizations, and law enforcement agencies to address cyber vulnerabilities
- Established counter-intelligence programs to deal with potential insider threats
- Intuitive predictive modeling and automated data analytics which detect anomalies in the security framework
- Protected systems for pre-payment monitoring, claim integrations, and third-party data
- Strong forensic and investigative resources capable of identifying theft patterns and pre-empting them
- Pre-set models for inbound and outbound monitoring
The measures enlisted above aren’t comprehensive and are only representative of a solution which is part of the bigger picture concerning medical data integrity. The recommended measures cannot ensure the elimination of cyber threats but can definitely make for the creation of a cybersecurity landscape where attackers find it difficult to operate. This would simultaneously make for the adoption of a pre-emptive strategy as well.
