Seems like a week doesn’t go by with at least one or multiple healthcare systems being compromised by hackers. As we talk with hundreds of healthcare organizations, they’re all in universal agreement that healthcare organizations are under attack by hackers more now than they’ve ever been before and that trend seems likely to continue. Understanding all of the various ways your healthcare organization is being attacked today is the first step and then you can work to combat against it.
To get a better understanding of how healthcare institutions are being attacked and how to combat these attacks, we sat down with the following panel of cybersecurity experts in a discussion hosted by Proofpoint:
- Chris Baldwin- Chief Information Security Officer at Hartford HealthCare
- Ryan Witt – Managing Director, Healthcare Industry Practice at Proofpoint
One of the great comparisons in this discussion is how previously CISOs and CIOs were extremely worried about attacks to their network and now they are much less of a risk to a healthcare organization. While these types of physical device attacks are still happening today and are important to include in your cybersecurity efforts, the methods of combatting and preventing those attacks are now widespread and can largely be dealt with using the right strategy and technology. Put more simply, pretty much every healthcare organization now has a firewall, network segmentation, and other basic block and tackling cybersecurity.
While this is true when it comes to physical device security, the same level of security maturity isn’t there for many organizations when it comes to threats like social engineering and business email compromise (BEC). Plus, hackers have become wise to the fact that now it’s easier to use social engineering to spend a few hours researching a person than it is to spend days trying to find a device vulnerability. Plus, Ryan Witt, Managing Director, Healthcare Industry Practice at Proofpoint, aptly points out in the video above that many healthcare professionals jobs require that they do essentially risky things like clicking on links and opening attachments in emails.
The good news is that there’s a lot that can be done by CISOs and CIOs to be able to mitigate these risks now too. Check out the video above for all of the details, but some of the suggestions include: identifying high risk business email compromise (BEC) targets, staff education with focus on high risk individuals, email isolation technology, and a detailed mitigation plan.
The final point was highlighted by Chris Baldwin- Chief Information Security Officer at Hartford HealthCare, in the video above and is worthy of further explanation. I think we’ve largely come to realize that no cybersecurity strategy is perfect and so having the tools, technology, and plan in place to mitigate any compromise is extremely important. For example, having a tool that identifies an email compromise as it happens could mean the difference between a few patient records being compromised vs a few hundred thousand records compromised. That’s a big difference and is so important that we’ll be covering incident response in detail in our upcoming EXPO.health Healthcare Cybersecurity experience and how you can apply learnings from your pandemic response.
What’s been your experience with current healthcare security attacks and what are you doing to mitigate the impact of these attacks? Share your thoughts and experiences in the comments and on social media with @hcittoday and @proofpoint.
Learn more about Proofpoint: https://www.proofpoint.com/
Listen and subscribe to the Healthcare IT Today Interviews Podcast to hear all the latest insights from experts in healthcare IT.
And for an exclusive look at our top stories, subscribe to our newsletter.
