Healthcare Industry Underprepared for Cyber Attacks

Healthcare Industry Underprepared for Cyber Attacks – Report

A study from Merlin International finds that healthcare facilities and businesses are underprepared for cyber attacks, and that patient data remains at risk.

In a year when hospitals, clinics and outpatient facilities face an increase in threats and attacks, only half of them have an incident response program in place, according to new figures. Each attack costs an average of $4 million, placing security expense versus potential vulnerability loss under scrutiny.
A new report shows that such an apparent lack of preparedness for cybersecurity disruption and damage leaves healthcare professionals, their patients, extensive private data and IT infrastructures at risk with no clear resolution pathway.
Hackers have more opportunities and incentive than ever to target healthcare data, and the problem will only increase over time, said Brian Wells, director of healthcare strategy at Merlin International, a systems integration and services supplier to the US government, and author of the report:
2018 Impact of Cyber Insecurity on Healthcare Organizations
.
(Source:
Rawpixel via Pixabay
)

The report was conducted by the Ponemon Institute, and is based on interviews with 627 healthcare executives.
The medical and healthcare industry accounted for almost a quarter of all breaches in 2017, second only to the business sector, showing how much pressure these facilities are coming under.
Healthcare is underprepared
The US healthcare system is expecting an increase in challenges this year, with attacks focused on medical devices, patient records, billing information and clinical trial information, among other targets. Reports of attacks aimed directly at patient medical support systems in life-or-death situations are sparse, but have anecdotally started appearing. (See
IoT Use Complicates Security Landscape in Healthcare
.)
Merlin survey respondents seemed oblivious to the threat of attack and impairment of medical devices, many of which are directly attached to patients. The report found that 65% either werent sure or knew that they didnt have medical devices secured.
Almost a third of them dont have plans to include securing of such devices in the near future.
The majority of respondents have facilities with between 100 to 500 beds for patients and have up to 100,000 connected devices. About 60% of them experienced an attack in the last 12 months, with more than half of those resulting in a loss of patient data.
Interestingly, concern by these professionals about future attacks resides not only with external threats as with, equally, employee negligence or malicious insiders. These organizations see security danger on all sides, challenging their security focus. About three-quarters of respondents said they worried about the loss of patient records, fortunately though its here that defense seems best.
The risk (to patient safety is) real but actual impacts are not widespread, Wells told Security Now. The vast majority of hospitals are prepared for outages of their electronic medical record systems and while there may be delays or disruptions in care, the risk to patients is low.
Other worries in the survey ranked second with loss of patient billing information, then IT staff login credentials, other authentication credentials, and then worries about clinical trial and research information.
Healthcare software under threat
Shortcomings in software patching were discovered, with exploitations of vulnerabilities older than 12 weeks representing about 70% of attacks, closely followed by web-borne malware, at 69%. Ransomware, accounting for about 40% of attacks, has recently hit hard,
notably disrupting critical care systems
, and incidences are expected to grow.
The ability to monitor, understand and fix cyber damage is a major issue, with 74% of facilities reporting too few staff available as their biggest headache. Over half reported a lack of staff training and awareness was undermining their security posture, and about 60% acknowledged they lack any cybersecurity experience. About half of them dont have a CSO.
The fundamentals of network security are being redefined -- dont get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual
Big Communications Event
. Theres still time to register and communications service providers get in free!
Given these shortcomings are there advantages to taking security and outsourcing it to others?
Outsourcing is a challenge as there is little consistency across provider organizations with respect to the security toolsets in use, Wells said. An outsourcer would need staff on hand that are familiar with a broad collection of tools and technologies … and that creates a business that cannot achieve the efficiencies that come from one common set of tools used across all customers.
The threats, the attacks, the losses and the ability to defend on so many fronts are predictably hitting smaller organizations the hardest, and their recourse is limited. Independent facilities need the economies of scale of their larger cousins, and the advantages of more up-to-date solutions, but theres a silver lining.
One benefit of consolidation currently occurring in the healthcare provider industry is that smaller institutions are able to take advantage of advanced information technology tools and resources that exist at larger institutions, Wells said.
Related posts:
McAfee: Cryptocurrency, Healthcare Attacks Increased in Late 2017
Majority of Healthcare Companies Suffer a Data Breach
SamSam Ransomware Continues Making Hospitals Sick
— Simon Marshall, Technology Journalist, special to Security Now

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Healthcare Industry Underprepared for Cyber Attacks – Report