Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/21/2016
09:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

5 Reasons Cybercriminals Target Healthcare

Cybercriminals are increasingly targeting healthcare institutions and successfully deploying malware and ransomware to exploit hospitals' need to recover quickly.

The healthcare industry has recently come under heavy fire as a target of cybercrime. Ransomware attacks on hospitals in California, Indiana, Kentucky, and Maryland, forced some officials there to make quick decisions in order to get their systems back up and running to avoid disruption of patient care.

The research team at Duo Security today released a report on the current state of healthcare endpoint security that compared the company's healthcare industry customers’ device cybersecurity to that of other industries. According to the findings, the healthcare sector has yet to come up to speed on information security.

Here’s a look at the key reasons cybercriminals are targeting healthcare institutions.

1.     Healthcare is historically not very secure.

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act that required hospitals to switch from paper to electronic health records (EHRs). With this came a flood of new health information technology and concerns that some of these vendors were bypassing security measures in order to get their products to market quickly, leaving the already newly digital healthcare institutions open and susceptible to cyberattacks.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Healthcare institutions are still holding on to legacy pieces of software, which makes them a much easier target, says Mike Hanley, director of Duo Labs. He adds that educating users about when it’s time to update software and systems or making them aware of phishing emails can be difficult.

2.     It’s life or death.

Because lives are at stake, healthcare professionals and their patients often can’t afford to have systems down or wait for an incident response team to come in and clean up the mess. This makes them prime targets for ransomware attacks. They often pay the ransom in order to get their systems back up and running, Hanley says.

It’s front page news if a hospital in a major metropolitan area goes dark due to a cyberattack, he says, which is bad for the hospital’s reputation and as well as patient well-being – you can’t have people avoiding the hospital for fear of having their patient records stolen or compromised.  

3.     The data is lucrative.

In addition to being ripe for the ransomware-picking due to the need for fast recovery times, hospitals also house a lot of private data. When cybercriminals steal a patient’s healthcare records, they’re often able to acquire multiple pieces of information: social security number, medical history, insurance provider, the patient's medications, and so on. “There’s a larger concentration of sensitive information [that can be resold],” Hanley says.

4.     An application-heavy environment provides a broad attack landscape.

According to the Duo Labs report, Duo Security healthcare customers are logging into twice as many applications as the average user in other industries. “This in itself is not a security risk or problem, but more diverse systems ... [may] require them to use old systems,” Hanley says, which could put them at risk of attack.

5.     They have an affinity for Windows and out-of-date browsing.

The healthcare industry is still using out-of-date, legacy systems. The report found that 82% of healthcare organizations are using Windows, and 76% are running on Windows 7.

They’re also partial to Internet Explorer (IE) 11, and 22% of Duo Security healthcare customers browse on unsupported versions of IE.

Hospital employees wash their hands to avoid getting the common cold and they need to employ the same basic measures to keep their information security systems healthy, Hanley says. “[It’s about] getting back to the basics, user education, security hygiene.”

Related Content:

 

 

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8720
PUBLISHED: 2020-08-13
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
CVE-2020-12300
PUBLISHED: 2020-08-13
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-12301
PUBLISHED: 2020-08-13
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-7307
PUBLISHED: 2020-08-13
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.
CVE-2020-8679
PUBLISHED: 2020-08-13
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.