Recent incidents show that security breaches and cyber attacks have steadily increased across Canada and globally, with healthcare service providers seen as a prime target. Needless to say, healthcare organizations are greater targets for data theft than organizations in other sectors for various reasons. For example, there was a 37 percent increase in attack rate per healthcare organization throughout 2020 and the beginning of 2021. In effect, organizations need to implement proper security controls to prevent harmful and costly attacks.
Cyber Criminals Increasingly Targeting Healthcare Organizations
Healthcare service providers hold personal health and research information that possesses high value for cybercriminals. Subsequently, hackers have ramped up hijacking attacks on remote and on-premise workers to steal data and infiltrate networks using various tools and techniques.
Other than the crown jewel’s value, healthcare organizations run decentralized information systems to provide greater access. Unfortunately, such systems put patient care, information, and research at risk. At the same time, some hospitals have embraced the acceleration of digital technology and connectivity in their organizations to achieve significant improvements in care delivery. However, with the increased technology connectivity comes increased exposure to cyberattacks that can impact privacy and service delivery.
Meanwhile, while some healthcare service providers have taken steps to remediate specific security issues, the threat of new vulnerabilities is ever-present. Yet, the new risk environment is combined with the overall shortage of trained security personnel, which means that hospitals, now more than ever, need trusted partners to team up with to achieve continuous security and privacy.
At the same time, the COVID-19 pandemic has impacted cyber threats in the health sector. A 2020 Cyber Threat Bulletin on the impact of the pandemic revealed that national and international public health organizations would almost certainly continue to be targeted by cyber threat actors such as ransomware, information and credential theft, and distributed denial of service (DDoS) attacks. Even though the Canadian Center for Cyber Security (CCCS) does not assess that Canada is a high priority target for online influence activities, that could change quickly, especially in response to increased political tensions with some states. Additionally, many Canadian allies are now a target for online attack campaigns, and their information ecosystems are closely intertwined with that of Canada.
Impact of Cyberattacks in the Healthcare Sector
On November 1, health authorities reported a possible cyber-attack against the healthcare system in the Canadian province of Newfoundland disrupted services and forced the cancellation of some appointments.
Indeed, one of the most prolific threats healthcare providers face is double-extortion ransomware. In this attack, a cybercriminal launches a multi-stage attack, combining the traditional encryption of files with the exfiltration of sensitive data. Cybercriminals in this incident then threaten to release breached data publicly unless the victim pays the ransom within the designated timeframe.
Such attacks put additional pressure on hospitals to meet hackers’ demands. Over and above paying ransoms, the breaches expose the organizations to penalties from data privacy watchdogs and the need to alert affected patients and partners whose data was compromised.
Mitigating Cyber Risks in the Healthcare Sector
Healthcare service providers need immediate improvements and solutions to address existing and emerging cyber risks. Therefore, Sentia recommends actions and solutions hospitals and other health organizations can implement to focus their resources and start on the path to greater patient trust in the face of unparalleled security threats. The sector can take the following actions to enhance its security posture:
- Implement a risk-informed cybersecurity strategy: hospitals need a cyber risk management plan informed by an awareness of popular and emerging threats caregivers face. The initial step in such a strategy involves assessing threats against an organization’s digital assets and identifying potential security risks. Sentia’s cyber security consulting services feature best practices for conducting a risk assessment and implementing a cybersecurity strategy to provide the healthcare sector with a clear, actionable way to achieve the desired cybersecurity posture while persevering the organizations’ priorities.
- Monitoring healthcare systems: how well can your organization detect hackers’ movement once they infiltrate your systems? Healthcare service providers should be able to detect and take necessary action in response to cybercriminal activities. With most hospitals lacking strong internal monitoring capabilities across Canada, organizations can leverage managed security services that include system security monitoring. Such solutions review internal procedures to determine the alerts generated and the techniques used to respond to malicious activities.
- Employee security awareness: it is vital to improve security awareness among healthcare workers. Many employees still reveal their credentials through emails and operate insecure personal devices to access internal systems remotely. Such actions expose organizations to various risks that hackers can exploit to gain unauthorized access. Fortunately, security awareness training allows employees to detect and respond to sophisticated attacks and prevent unauthorized personnel from accessing sensitive information. For instance, hospitals should educate their staff on the risks of malicious emails and links, as it usually takes just one sketchy email to bring down an entire organization’s network.
- Leadership support: undoubtedly, the healthcare sector cybersecurity strategy can only succeed if senior leadership spearheads building resilience at all levels. Simply stated, a top-down process in managing cyber and privacy risks across the healthcare sector is indispensable. The approach promotes participation from various stakeholders, including the board that sets the security mandate, the management that enables teams to meet security objectives, and employees who comply with the security procedures.
- Compliance: other than the above recommendations, healthcare organizations can follow regulations like the Health Insurance Portability and Accountability Act (HIPAA) that requires them to perform security risk analysis across the full scope of the electronic health information within their IT ecosystems. The process involves identifying where sensitive data resides and enables effective control remediation through reliable risk management activities.
Taking Action with Sentia
Cyber attacks and data breaches are on the rise in the healthcare sector, and the reality is that lives and systems are now at stake. As a result, it’s time to take a comprehensive view of managing security risks to protect patients, systems, and data in the face of unprecedented security threats. Sentia works with healthcare service providers to assess the current state of their security capabilities, architect a future state of security, develop actionable roadmaps, and identify the procedures to achieve prioritized remediation objectives.
Contact Sentia today to start acting on these recommendations to ensure your organization mitigates cybersecurity and privacy risks.