During the COVID-19 crisis, cyber-criminals have not gone into quarantine. They continue to seek out system vulnerabilities, and they do not mercy the hospitals. Attacks against the healthcare sector have increased by 150% in the past month alone [1], as in the case of Brno University Hospital in the Czech Republic that has suffered a crippling cyberattack on March 19 that shut down its IT network [2]. Optimizing your hospitals’ cyber-security posture cannot wait; it is critical to act quickly to ensure patient safety, data confidentiality, and continuous healthcare service.

Today, hospitals are connected like never before with cloud, mobile, and IoT technologies that improve their efficiency and quality of service. However, these changes have punched holes in the “good old” security perimeter and have created more entry points for hackers to target. And they do…

With ~40M patient records exposed in 2019, healthcare organizations continue to experience an increase in the number of data breaches, year over year [3].

Ransomware is also a prevalent threat; In June 2019, five US healthcare providers reported ransomware attacks in a single week [4].

This alarming trend poses a significant financial risk to hospitals. The costs involved in recovering damaged reputation, as well as the risk of legal liability and fines for HIPAA noncompliance can be enormous. The average cost of a breach in the healthcare industry is $6.45M (which 65% higher than the average cost in all other industries [5]).

To learn more about healthcare security challenges and solutions, we invite you to join our live webinar on April 28th.

Click here to sign up for the webinar.

But what makes hospitals so vulnerable to cyber threats?

Medical Records are the crown jewel for hackers

Stolen Electronic Healthcare Records (EHR) can be sold on the darknet for up to $1,000. By comparison, social security numbers and credit card information usually sell for $1 and up to $110, respectively [6]. EHRs contain information that is harder to cancel/recover once stolen (PII, insurance, policy numbers, medical diagnoses, billing information). This information is often used by fraudsters to create fake IDs, to purchase medical equipment or drugs, or to file a false insurance claim.

Medical staffs are lacking cyber-security awareness

Saving lives and treating patients is the top priority for hospitals’ workforce, which makes them more prone to incautious behavior when it comes to their hospitals’ security regulations and policies. To make things even worse, nearly a third of the healthcare workforce (32%) said that they had never received cybersecurity training from their workplace but should have [7]. This lack of awareness, combined with increasing usage of mobile devices, tablets, and laptops, result in improper handling and storage of patient files, credential theft via phishing attacks, download/distribution of malicious files, and more.

Connected Devices are Hospitals’ weakest link

It is estimated that there are 15-20 IoT and connected medical devices per hospital bed, from infusion pumps and patient monitors to MRI machines. These devices are usually running on unpatched/legacy operating systems, which makes them highly vulnerable and easy to hack. This IoT security gap remains unattended as hospitals rarely can afford to have their systems down to be patched – even for just a few hours. Having 24×7 access to critical medical devices and patient data is crucial.

To learn more about healthcare security challenges and solutions, we invite you to join our live webinar on April 28th.

Click here to sign up for the webinar.

Zero Trust Security in hospitals is essential

The healthcare sector stands out due to the majority of breaches (59%) being associated with internal actors (while only 42% associated with external) [8]. That means – in hospitals internal human error and misuse occur much more frequently than hacking.

Therefore, traditional security approaches have become dangerously ineffective since they are based on the outdated assumption that everything inside the security perimeter can be trusted.

Today, an enormous amount of sensitive medical information transfers between connected medical devices, cloud-based electronic health records (EHR) systems, medical staff workstations mobile devices and tablets, and digital applications for patients.

To maintain optimal security posture in such a “Perimeter everywhere” environment, it has become essential to adopt the Zero Trust Security model. Proper Zero Trust implementation enables effective monitoring and flagging of unusual and/or inappropriate access to data that is not necessary for valid business use or required for patient care.

However, rebuilding your hospital security infrastructure around a Zero Trust approach using disparate technologies might lead to complexities and inherent security gaps. To avoid that, Check Point offers a more practical and holistic approach to implement Zero Trust, based on single consolidated cybersecurity architecture, Check Point Infinity.

We invite you to join our live webinar on Tuesday, April 28th, 2020, where we will cover best practices to implement Zero Trust Security in hospitals. Learn how to:

  • Segment the clinical network and block ransomware attacks
  • Secure critical medical devices to ensure patient safety
  • Protect cloud-based EHR systems and maintain compliance with HIPPA
  • Make medical staff more mobile without compromising on security

Click here to sign up for the webinar.

[1] Leaders-in-cybersecurity-have-united-to-combat-an-unprecedented-level-of-cyberattacks
[2] Brno University Hospital in Czech Republic Suffers Cyberattack During COVID-19 Outbreak
[3] U.S. Department of Health and Human Services
[4] Healthcare IT Security, June 19 2019
[5] Source: Cost of a Data Breach Report 2019, IBM
[6] Heres-how-much-your-personal-information-is-selling-for-on-the-dark-web/
[7] https://media.kasperskydaily.com/wp-content/uploads/sites/85/2019/08/16121510/Kaspersky-Cyber-Pulse-Report-2019_FINAL.pdf
[8] According to the Verizon Data Breach Report, 2019

You may also like