Rising cyber incidents challenge healthcare organizations

Healthcare organizations are facing many cybersecurity challenges that require them to increasingly prioritize cybersecurity and compliance, according to Claroty.

Threat actors are not only targeting IT systems, but have now set their sights on cyber-physical systems – from IoMT devices, to building management systems such as elevators and HVAC systems – which are considered critical to maintain a safe environment for patient care.

Cyber-physical systems affected

Like many other critical infrastructure organizations, healthcare delivery organizations are becoming increasingly interconnected as they adapt to the reality of digital transformation. However, unique to this sector is the broad range of cyber-physical systems that are being connected to the internet and to one another, as well as the potentially devastating impact a successful attack on any of these systems or devices can have to care delivery or, worse, patient safety.

• 78% of respondents experienced a minimum of one cybersecurity incident over the last year
• 47% cited at least one incident that affected cyber-physical systems such as medical devices and building management systems
• 30% cited that sensitive data like protected health information (PHI) was affected
• More than 60% reported that incidents caused a moderate or substantial impact on care delivery, and another 15% reported a severe impact that compromised patient health and/or safety

Surprisingly, of the respondents that were victims of ransomware attacks, more than a quarter made ransom payments. Another noteworthy financial implication, more than a third experiencing incidents in the past year incurred costs from the attack of more than $1 million.

“The healthcare industry has a lot working against it on the cybersecurity front—a rapidly expanding attack surface, outdated legacy technology, budget constraints and a global cyber talent shortage,” said Yaniv Vardi, CEO of Claroty.

“Our research shows that healthcare organizations need the full support of the cyber industry and regulatory bodies to defend medical devices from mounting threats and protect patient safety,” Vardi added.

As healthcare organizations undergo digital transformation and technological innovation revolutionizes the industry, regulatory requirements are increasingly complex and frequently evolving. Keeping up with standards and understanding guidelines can be challenging, but the survey shows that organizations hold these regulations in high regard and value the guidance.

Increased standards and regulations fuel stronger cybersecurity, but there’s more work to be done:

• 30% say current government policies and regulations require improvement or do nothing to prevent threats
• NIST (38%) and HITRUST Cybersecurity Frameworks (38%) were selected by most respondents as important to their organizations
• 44% cite regulatory developments such as mandated incident reporting as the most influential external factor to an organization’s overall security strategy

For organizations that believe regulations could be improved, a majority are seeking assistance in the development of a comprehensive cybersecurity strategy. This likely reflects the increasing complexity of healthcare environments, the growing attack surface, and recognized need for a comprehensive approach to close gaps that pose risks.

Cyber skills shortage still a challenge

• More than 70% of healthcare organizations are looking to hire in cybersecurity roles
• 80% of those hiring say it’s difficult to find qualified candidates that have the skills