Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/21/2016
09:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

5 Reasons Cybercriminals Target Healthcare

Cybercriminals are increasingly targeting healthcare institutions and successfully deploying malware and ransomware to exploit hospitals' need to recover quickly.

The healthcare industry has recently come under heavy fire as a target of cybercrime. Ransomware attacks on hospitals in California, Indiana, Kentucky, and Maryland, forced some officials there to make quick decisions in order to get their systems back up and running to avoid disruption of patient care.

The research team at Duo Security today released a report on the current state of healthcare endpoint security that compared the company's healthcare industry customers’ device cybersecurity to that of other industries. According to the findings, the healthcare sector has yet to come up to speed on information security.

Here’s a look at the key reasons cybercriminals are targeting healthcare institutions.

1.     Healthcare is historically not very secure.

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act that required hospitals to switch from paper to electronic health records (EHRs). With this came a flood of new health information technology and concerns that some of these vendors were bypassing security measures in order to get their products to market quickly, leaving the already newly digital healthcare institutions open and susceptible to cyberattacks.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Healthcare institutions are still holding on to legacy pieces of software, which makes them a much easier target, says Mike Hanley, director of Duo Labs. He adds that educating users about when it’s time to update software and systems or making them aware of phishing emails can be difficult.

2.     It’s life or death.

Because lives are at stake, healthcare professionals and their patients often can’t afford to have systems down or wait for an incident response team to come in and clean up the mess. This makes them prime targets for ransomware attacks. They often pay the ransom in order to get their systems back up and running, Hanley says.

It’s front page news if a hospital in a major metropolitan area goes dark due to a cyberattack, he says, which is bad for the hospital’s reputation and as well as patient well-being – you can’t have people avoiding the hospital for fear of having their patient records stolen or compromised.  

3.     The data is lucrative.

In addition to being ripe for the ransomware-picking due to the need for fast recovery times, hospitals also house a lot of private data. When cybercriminals steal a patient’s healthcare records, they’re often able to acquire multiple pieces of information: social security number, medical history, insurance provider, the patient's medications, and so on. “There’s a larger concentration of sensitive information [that can be resold],” Hanley says.

4.     An application-heavy environment provides a broad attack landscape.

According to the Duo Labs report, Duo Security healthcare customers are logging into twice as many applications as the average user in other industries. “This in itself is not a security risk or problem, but more diverse systems ... [may] require them to use old systems,” Hanley says, which could put them at risk of attack.

5.     They have an affinity for Windows and out-of-date browsing.

The healthcare industry is still using out-of-date, legacy systems. The report found that 82% of healthcare organizations are using Windows, and 76% are running on Windows 7.

They’re also partial to Internet Explorer (IE) 11, and 22% of Duo Security healthcare customers browse on unsupported versions of IE.

Hospital employees wash their hands to avoid getting the common cold and they need to employ the same basic measures to keep their information security systems healthy, Hanley says. “[It’s about] getting back to the basics, user education, security hygiene.”

Related Content:

 

 

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22152
PUBLISHED: 2021-05-13
A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any new user connections.
CVE-2021-22153
PUBLISHED: 2021-05-13
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with t...
CVE-2021-22154
PUBLISHED: 2021-05-13
An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially gain access to a victim's web history.
CVE-2021-20331
PUBLISHED: 2021-05-13
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "i...
CVE-2021-31215
PUBLISHED: 2021-05-13
SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.