The global healthcare industry faces unique challenges because it deals with human health, safety and mortality. Healthcare organizations amass huge amounts of confidential and sensitive personal information about their customers and keeping that data secure is extremely important.

There has been a sharp rise in cyberattacks on the healthcare industry over the last six months during the COVID-19 global pandemic, especially attacks using ransomware, business email compromise (BEC), and socially engineered spear-phishing. IBM Security has reported a 600% increase in spear-phishing cyberattacks in 2020, with the U.S. health care industry being the most common target.  Beazley, a global insurance company, found that the healthcare sector experienced the highest number of cyberattacks and data breaches amongst all industries in 2019, with more than double the number of attacks and breaches of the second highest ranking industry.
 
Healthcare organizations face an uphill battle in protecting against an increasingly sophisticated array of cyber threats on their information systems and those of their supply-chain partners and business associates. Today’s cyberattacks on healthcare providers are planned and conducted by a wide array of cyber-criminals, hacking groups, nation-state cyberattack groups, and even their own staff via insider threats. The average cost of a cyber data breach is now over $8.2 million, according to IBM Security’s latest report, and 40% or more of cyber vulnerabilities are directly linked to employee behavior based on the latest studies by the Gartner Group. To protect digital assets, health-care organizations must focus on educating their employees about cybersecurity through trainings and using simulations to create a strong human firewall.
 

Top Ten Cybersecurity Recommendations for the Healthcare Industry

Here are our recommendations for protecting your organization from cyberattacks or data breaches and mitigating the financial and reputational impacts of a cyberattack:

1. Begin all digital transformation projects with cybersecurity in mind – Keep cybersecurity in mind to insure data integrity and privacy when beginning the process of digital transformation using cloud infrastructure

2. Create an organizational culture of cybersecurity – Ensure all healthcare employees, including the C-Suite, consistently promote and support practicing effective cybersecurity policies, processes, and procedures via a comprehensive cybersecurity awareness, education, and training program that includes spear-phishing campaigns and cyber data breach table-top exercises.

3. Implement advanced cyber diagnostic assessments – Execute drills on a regular basis, including:

   • Email Cyberattack Assessments

   • Network & Endpoint Cyberattack Assessments

   • Computer Vulnerability Scanning

   • Penetration Testing

   • Security Software Assessments

   • Spear-Phishing Campaigns

4. Implement advanced software encryption – Ensure all data and end-to-end network operations are encrypted.

5. Verify all identities and credentials – Require the use of multi-factor authentication (MFA), including biometrics (fingerprint, voice, or facial recognition).

6. Secure information systems by data design – Implement Zero Trust Architecture (ZTA) designed to compartmentalize data and restrict data access, thus reducing the potential damage from unauthorized access to sensitive information.

7. Establish a rapid incident response plan – Develop and periodically test an enterprise-wide well-coordinated information system incident response plan to quickly identify, contain, eradicate, and recover from cyberattacks.

8. Conduct 24 X 7 X 365 monitoring, detection, & response (MDR) – Continually monitor, detect, and respond to all cyber incidents including: cyber intrusion detection systems (IDS) for email systems, network, software applications, and all information system endpoints using advanced security information event management (SIEM) software, data visualization tools, automation, and artificial intelligence (AI) capabilities.

9. Protect the information system – Ensure a timely and effective software patch management program.

10. Ensure information system resilience – Implement and periodically test an enterprise-wide business continuity plan (BCP) and disaster recovery plan (DRP) including an off-line and fully redundant data back-up system.