What are the rising issues in healthcare security and how can we combat them?
The digital evolution of healthcare globally is characterized by massive growth in the number of connected medical IoT devices. The worldwide pandemic has only accelerated and exacerbated this increase, resulting in virtual delivery of healthcare services becoming the preferred method of delivery, most probably for the foreseeable future. However, we must acknowledge that the scope of this technological advance exceeds the space of only hospitals and clinics; it includes our home life, the biomedical and clinical engineering landscape, and all the third party vendors that these spaces interact with and rely on.
For example, medical wearables are becoming commonplace in our daily lives by supplementing or replacing traditional medical records with their data, and AI is becoming instrumental in clinical decision making support. There are now three times as many non PC devices on a hospital's network than there are PCs, and this is without including the many patient and guest devices that connect externally.
Interoperability Introduces Greater Risk
While these devices serve to streamline healthcare processes, they also invite a plethora of risk, especially considering that most new devices conform to the rising trend of device interoperability. The increased level of interconnectivity opens numerous pathways for an attacker to enter. A cybercriminal may now be able to access hospitals through our personal mobile devices or vice versa. Instead of the segmented, self contained systems of the past, new devices are made to be wireless and able to connect and communicate with a wide selection of other devices. This is a problem made worse by the proliferation of device suppliers in the healthcare industry.
Third party vendor risk is an area that healthcare has yet to really consider. Manufacturers do not prioritize cybersecurity when selling and educating about their product. They do not consider unintended, malicious use cases for their product, resulting in attackers taking advantage of security gaps.
These attackers can be pariah nation states, organized crime syndicates, or other unexpected sources. Take for example the SolarWinds Orion Sunburst incident, the recent Microsoft Exchange breach, or the apparent targeting of hospitals and clinical research facilities by both state actors and extortionists in the advent of COVID-19. These attacks are especially devastating to the healthcare sector; if the availability or functionality of medical devices is compromised, human lives are at stake.
Combating Attacks & Mitigating Risks
Hospitals and government leaders have not yet grasped the severity of the increasing problem. Awareness and understanding of the issue is the first step in mitigating cyber risk. Healthcare delivery organizations (HDOs) face limited budgeting, tools, and staff when trying to address security and most HDOs don't have a dedicated plan or staff to respond to cyberthreats to begin with.
The lack of integration between the priorities of manufacturers, HDOs, and security professionals is crippling in the fight against cybercriminals. Healthcare is trailing even the energy and industrial sectors in this regard. Cyber breaches will continue to be devastating until all of the parties involved in the creation, usage, and protection of connected devices work together to seal security gaps.
In Australia, it seems that convergence between the groups may be a long ways away from that eventuality.
See the full expert discussion here:
2021 Australia Managed Security Services Forum (Melbourne)
Wednesday, March 17th, 2021
The panel consists of:
-
- Richard Staynings (moderator) -- Chief Security Strategist at Cylera
- Prof. Trish Williams – Cisco Professor of Digital Health Systems at Flinders University
- Christopher Neal – Chief Information Security Officer at Ramsay Health Care Australia
- Mark Goudie – PRJ Services Leader at CrowdStrike
See related articles:
Nation State Cyber Thieves Target Healthcare and Patient Data
