The State of Healthcare Security
October 21, 2020
Money. That’s what breaches and attacks dwindle down to – what data and information are the most valuable to hackers. Those threats drive the motivation for organizations to implement a security posture. As this week’s Cybersecurity Awareness Month theme is ‘Securing Internet-Connected Devices’, today’s blog is addressing healthcare security by breaking down why the industry is a target and the key security tools for a strong foundation.
The State of Healthcare Security (in Stats)
Let’s set the stage of healthcare security with a few stats. In 2019…
- The healthcare industry had the highest number of ransomware attacks
- 15% of breaches involved healthcare organizations
- The industry had an estimated $25 billion in losses due to cyberattacks[1]
What Makes Healthcare Different?
Clearly, the healthcare industry is an enticing target, but why? In simple terms, it’s because of the data documented and stored. Think about it. As a patient, you have to supply full name, birthday, social security number, address, phone number, email address, and then insurance and payment information. The sheer amount of personally identifiable information is lucrative to hackers.
The other significant aspect of healthcare security is the widespread adoption of internet-connected medical devices. From patient care to organizational efficiency, the use of more devices has created an increase in the number of endpoints. Without proper security tools and policies, each device leaves the organization vulnerable to attacks.
The Foundations of Healthcare Security
The foundations of healthcare security focus on managing and securing devices and protecting the areas where end-users are involved.
Visibility. We say it every time – you cannot protect what you cannot see. Visibility provides real-time insight into each connected device. Without proper visibility and subsequent policies to monitor devices, unknown devices can connect and be rogue anywhere on the network.
Endpoint + Email Security + End User Awareness Training. This trio of components helps significantly reduce risk, and all relate to the end-user. In security, end-users are both your biggest target and your best defense. Endpoint tools protect the devices users are operating. Email security protects against malicious email attacks that prey on human error. End-User Awareness Training equips all users with information to proactively identify attacks.
Identity Access Management. Building an IAM program is an organizational approach to security by clearly defining and managing access to data and applications. A proper IAM Program paired with user behavior analytics allows for better control of data. First, you want to ensure only those who should be accessing data can access it. Then, you want to detect unusual use in case a bad actor is accessing sensitive data.
Each foundation is a piece in a complete security plan to minimize risk of attackers accessing and exploiting data. While this blog focused on healthcare security, all industries can apply these foundations. Every organization needs the right tools and policies to proactively protect against cyberattacks.
Posted in Cybersecurity Technology, Security (Legacy)