Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/21/2016
09:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

5 Reasons Cybercriminals Target Healthcare

Cybercriminals are increasingly targeting healthcare institutions and successfully deploying malware and ransomware to exploit hospitals' need to recover quickly.

The healthcare industry has recently come under heavy fire as a target of cybercrime. Ransomware attacks on hospitals in California, Indiana, Kentucky, and Maryland, forced some officials there to make quick decisions in order to get their systems back up and running to avoid disruption of patient care.

The research team at Duo Security today released a report on the current state of healthcare endpoint security that compared the company's healthcare industry customers’ device cybersecurity to that of other industries. According to the findings, the healthcare sector has yet to come up to speed on information security.

Here’s a look at the key reasons cybercriminals are targeting healthcare institutions.

1.     Healthcare is historically not very secure.

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act that required hospitals to switch from paper to electronic health records (EHRs). With this came a flood of new health information technology and concerns that some of these vendors were bypassing security measures in order to get their products to market quickly, leaving the already newly digital healthcare institutions open and susceptible to cyberattacks.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Healthcare institutions are still holding on to legacy pieces of software, which makes them a much easier target, says Mike Hanley, director of Duo Labs. He adds that educating users about when it’s time to update software and systems or making them aware of phishing emails can be difficult.

2.     It’s life or death.

Because lives are at stake, healthcare professionals and their patients often can’t afford to have systems down or wait for an incident response team to come in and clean up the mess. This makes them prime targets for ransomware attacks. They often pay the ransom in order to get their systems back up and running, Hanley says.

It’s front page news if a hospital in a major metropolitan area goes dark due to a cyberattack, he says, which is bad for the hospital’s reputation and as well as patient well-being – you can’t have people avoiding the hospital for fear of having their patient records stolen or compromised.  

3.     The data is lucrative.

In addition to being ripe for the ransomware-picking due to the need for fast recovery times, hospitals also house a lot of private data. When cybercriminals steal a patient’s healthcare records, they’re often able to acquire multiple pieces of information: social security number, medical history, insurance provider, the patient's medications, and so on. “There’s a larger concentration of sensitive information [that can be resold],” Hanley says.

4.     An application-heavy environment provides a broad attack landscape.

According to the Duo Labs report, Duo Security healthcare customers are logging into twice as many applications as the average user in other industries. “This in itself is not a security risk or problem, but more diverse systems ... [may] require them to use old systems,” Hanley says, which could put them at risk of attack.

5.     They have an affinity for Windows and out-of-date browsing.

The healthcare industry is still using out-of-date, legacy systems. The report found that 82% of healthcare organizations are using Windows, and 76% are running on Windows 7.

They’re also partial to Internet Explorer (IE) 11, and 22% of Duo Security healthcare customers browse on unsupported versions of IE.

Hospital employees wash their hands to avoid getting the common cold and they need to employ the same basic measures to keep their information security systems healthy, Hanley says. “[It’s about] getting back to the basics, user education, security hygiene.”

Related Content:

 

 

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now this is the worst micromanagment I've seen.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
CVE-2019-13569
PUBLISHED: 2019-07-19
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.