The vast majority of healthcare organizations said they have seen an increase in cyberattacks over the past year, according to a new survey of 20 chief information security officers.
What happened?
The study, conducted by cybersecurity technology vendor Carbon Black, found two thirds of surveyed healthcare organizations said cyberattacks have become more sophisticated over the past year – the same percentage said they were targeted by a ransomware attack during the past year.
Nearly half (45 percent) of surveyed healthcare organizations said they have encountered attacks over the past year where the primary motivation was destruction of data.
Destructive attacks, which are tailored to specific targets, cause system outages and destroy data in ways designed to paralyze an organization’s operations, and are often carried out by malicious nation-states.
In addition, a third of the healthcare organizations surveyed said they have encountered instances of island hopping on their enterprises over the past year.
Island hopping attacks come from a wide variety of vantage points, whether it’s through partner provisioned virtual desktop infrastructure (VDI) access, private network links and VPNs, or by leveraging the compromise of partners to establish trust and perform trusted social engineering attacks.
What is the trend?
When asked what the biggest concern to their organizations was, the top answers from CISOs were compliance (33 percent) and budget and resource restrictions (22 percent).
These were followed by loss of patient data (16 percent), vulnerable devices (16 percent), and the inability to access patient data (13 percent).
Malicious Microsoft Office documents, most notably Excel documents with macro-enabled PowerShell delivery cradles, have been the most common file-less attack method targeting healthcare customers over the past year, according to Carbon Black’s customer data.
On the record
The report recommended healthcare organizations increase endpoint visibility, establish protection from emerging attacks, run automated compliance and vulnerability assessments, and constantly back-up data.
When it comes to cybersecurity in healthcare, 84 percent of healthcare organizations said they train their employees on cybersecurity best practices at least once per year, and nearly half (45 percent) said they conduct training multiple times per year for employees.
“Regular education of employees, greater awareness of modern threats and the prospect of building out larger threat hunting teams can all go a long way in helping to curb attacks,” the report concluded. “It does not appear that the volume and frequency of attacks will be abating anytime soon. Extreme vigilance among these security teams will be required to help stem the tide in 2019 and beyond.”
Nathan Eddy is a healthcare and technology freelancer based in Berlin.
Email the writer: [email protected]
Twitter: @dropdeaded209
Source: Read Full Article