A survey conducted by cybersecurity provider Imperva has found that more than one in three healthcare organizations have experienced a cyberattack within the last year, while one in 10 have paid a ransom.
Privacy and security of patient data is being constantly put at risk in the current environment where healthcare data is valuable on the black market. With the attention of technologies like mobile apps and patient portals, healthcare organizations continue to struggle managing security of a wide range of devices.
“Attackers understand the value of the data held by healthcare organizations, and as a result, they are quickly becoming a sweet spot for hackers looking to steal large amounts of patient records for profit,” said Terry Ray, chief technology officer at Imperva, whose survey included responses from 102 information technology professionals from the 2018 Healthcare Information and Management Systems Society (HIMSS) Conference.
“There have been a number of incidents recently where cybercrime has impacted hospitals and left them unable to access patient data, which demonstrates the consequences of a successful attack. It is crucial that healthcare organizations take steps to protect their data. To retain patient trust, organizations must provide an excellent defense at all times.”
Key findings included:
- 77 percent of respondents were very concerned about a cybersecurity attack.
- 15 percent admitted their organization needed to improve its ability to handle a cyberattack.
- 32 percent of respondents stated ransomware as the attacks that caused the most concern.
- 51 percent of respondents were most concerned about careless users when asked about insider threats.
- 27 percent of respondents stated a lack of tools used to monitor employees and insider activities as making threats more difficult to detect.
- 32 percent considered collecting data from different security tools as the most time-consuming task when investigating insider threats.
- 26 percent of respondents didn't have a plan in place for how to respond to a cyber incident.
- 28 percent of respondents said their organization did not have a chief information security officer.
“As we’ve seen in past high-profile cases, data breaches caused by careless, malicious or compromised insiders are a very real threat,” said Ray. “However, because the user has legitimate access to enterprise data, attacks from the inside can take a long time to detect. To mitigate the risk, organizations should ask themselves where their sensitive data lies and invest in protecting it. Businesses can employ solutions based on machine learning technology to process and analyze vast amounts of data. This will help them pinpoint critical anomalies that indicate misuse of data, so they can quickly quarantine risky users to prevent any further issues.”
Cara joined TriMed Media in 2016 and is currently a Senior Writer for Clinical Innovation & Technology. Originating from Detroit, Michigan, she holds a Bachelors in Health Communications from Grand Valley State University.