What Makes Cybersecurity So Challenging in the Healthcare Industry?
Written by Lindsay McKay
The healthcare sector is one of the most targeted industries in cyberattacks globally, with the energy and manufacturing industry as the next most targeted. Healthcare saw an increase of over 250% in cyberattacks in the last two months of 2020 according to cybersecurity company Check Point Software Technologies' year-end report. An increase in attacks involves a range of vectors, including ransomware, botnets, remote code execution and DDoS attacks. Ransomware, by far, remains the biggest threat to healthcare organizations which is especially devastating to hospitals and health care organizations because it can affect their ability to deliver care which can endanger lives. An attack can overwhelm a healthcare facility that doesn’t have adequate network security. It's not just downtime of IT processes that can be dangerous, data breaches can incur millions in penalties for non-compliance with regulations on privacy.
Why is the Healthcare Industry a Popular Target?
There are many reasons why cybercriminals are interested in targeting the healthcare sector. To start, in Canada healthcare is provincially run and each province has different regulations, security measures, and budgets making some provinces' healthcare systems more vulnerable than others. So, cybercriminals can potentially discover different vulnerabilities in different provinces.
Any organization that stores a high amount of sensitive data is a target, and I would argue that healthcare organizations store the most sensitive and confidential data. This patient data is valuable to cybercriminals as they stand to gain a great deal of money by withholding or selling said data. Additionally, healthcare organizations use a wide variety of devices to conduct procedures, store and distribute information, which gives more openings for cybercriminals to exploit.
In the past few years, the adoption of telehealth has had many doctors, patients, and cybersecurity experts concerned. Many of the applications used for telehealth have not undergone the highest assessments to test for security and privacy measures. With the overwhelming amount of new users, it has made it difficult to increase the security levels of telehealth services.
Specific Challenges in Healthcare
The black market for stolen data is growing, and as I have mentioned, hospitals and other healthcare faculties store a lot of data. Criminals can earn instant money by selling large databases of stolen information, including credit card numbers, Social Insurance Numbers, addresses, and phone numbers. Hackers can also use the ransomware technique known as the “double extortion”, where a hacker will threaten to leak stolen data asking for a ransom – even if they already sold it.
It was found earlier this year that there were nearly 4,000 medical devices, made by different vendors, that were running software with a known vulnerability. These devices were not only ones kept and used on hospital and clinic grounds, but also pacemakers, insulin pumps, and more personal medical devices used in patients.
What Can We Do?
Getting educated is the best way to protect against cyberattacks. Having hospital staff that deal with patient data undergo basic cybersecurity training can help against phishing and other human error attacks. Implementing ongoing vulnerability assessment and penetration testing would be a beneficial tool. Having someone on the team that has completed a PenTest+ training course can help with this. Additionally, encourage team members to develop their IT skills with basic certification training such as CompTIA A+ training, CompTIA Security+ training, and CompTIA Network+ training.
Disclaimer
The information contained in this post is considered true and accurate as of the publication date. However, the accuracy of this information may be impacted by changes in circumstances that occur after the time of publication. TechnoEdge Learning assumes no liability for any error or omissions in the information contained in this post or any other post in our blog.