Increasing number of cyberattacks a challenge for healthcare
Cyberattacks on healthcare are increasing. New research shows healthcare is the third most targeted industry in 2023, ahead of finance, insurance and communications. The attacks more than doubled in the US from 2016 to 2021. Zero trust is a security model that operates on the principle of, Never trust – Always verify, that should be implemented to secure patient data, argues Itai Greenberg, Chief Strategy Officer at Check Point Software Technologies, in a blogpost for World Economic Forum’s centre for cybersecurity.
“As healthcare organizations continue to evolve digitally, one thing has become clear – patient welfare cannot come first if the digital systems supporting it are threatened”, he writes.
Research from Check Point Software Technologies shows the healthcare sector experienced an average of 1,684 attacks per week in Q1 2023 – a year-on-year increase of 22%. That makes healthcare the third most targeted industry in 2023, ahead of finance, insurance and communications. Health care is the third most attacked sector after Education/Research and Government/Military.
The explanation, he writes, is that the healthcare sector is a veritable goldmine of data and much of it is managed through easily exploited legacy IT systems.
One survey by the Healthcare Information and Management Systems Society found that 73% of healthcare provider organizations use legacy IT systems, which are costly to support and often rife with gaps in security.
“This makes the sector an easy – and potentially lucrative – target for ransomware operators. But this vulnerability is not solely down to software and systems – it’s also down to how data and devices are managed within individual organizations.”
He argues that there is a division of responsibility when it comes to cyber resilience in sectors such as healthcare. On the one hand, security enforcement and on the other, network control and policies.
Users, devices, networks, workloads and data are five pillars that make up the enforcement element by requiring ongoing identity and verification checks. Two other pillars are visibility and analytics and automation and orchestration. These pillars are the control and policies element through real-time monitoring and automated response to security breach.
“These pillars, when brought together, enable companies to create a zero-trust environment. This is precisely what healthcare organizations need to implement to fend off the rising number of attacks.”
“As healthcare organizations continue to digitise their services, their network footprint is growing. Vulnerable devices (endpoints) now extend to homes and other offices, instead of a single site, so it’s important to ‘segment’ or separate the network into more manageable clusters using firewalls and device-level protection. Just as a hospital might place fire doors around its building to prevent the spread of fire, a network should have barriers in place to prevent the lateral spread of any malware.”
He writes that on average a 500-bed hospital might have as many as 10,000 connected Internet-of-Things (IoT) devices for monitoring, storing and relaying patient information and other sensitive data.
“Enforcing a zero-trust policy will start with the ‘discovery’ of these devices on the network and will then automatically apply a least privilege, zero-trust policy, so that only relevant systems, or those who require access to carry out their duty, will be able to access the devices.”
“For security controls to be effective, they must keep up with the pace of innovation. Retroactively deploying security controls to existing applications means that security is always one step behind innovation. To close the gap and ensure continuous security, security codes should be integrated into the application development process as early as possible.”
“The implementation of zero-trust principles is essential for healthcare organizations to ensure the security of patient data and critical infrastructure.”
He writes that zero trust can be implemented in any application on-premises or in the cloud, depending on the security needs of the organization. A central hospital, for instance, might have different needs to a nursing home or home-care provider, where employees roam with devices or devices are based in a range of locations.
“Data must also be classified to be protected in the right way. For instance, securing unstructured data, such as text, photos, video, audio and remote surgery with robotic systems, such as ‘Da Vinci’, will all require varying degrees of protection and controls.”
“The pillars of zero trust can be deployed and implemented in a variety of ways to secure data pathways and automate threat responses, but the underlying goal remains the same – ‘never trust, always verify.’ This is a ‘cyberculture’ that healthcare organizations need to adopt if they are to weather the incoming storm.”
Moonshot News is an independent European news website for all IT, Media and Advertising professionals, powered by women and with a focus on driving the narrative for diversity, inclusion and gender equality in the industry.
Our mission is to provide top and unbiased information for all professionals and to make sure that women get their fair share of voice in the news and in the spotlight!
We produce original content, news articles, a curated calendar of industry events and a database of women IT, Media and Advertising associations.
