Healthcare industry receives a B+ score for cybersecurity

The Cyber Risk Landscape of the U.S. Healthcare Industry, 2024 report analyzes historical breaches and security ratings, offering healthcare organizations insights on preventing cyberattacks. In recent news, the healthcare industry received a B+ score from SecurityScorecard, “a global leader in cybersecurity ratings, providing organizations with comprehensive assessments of their security posture.” 

What triggered the report? 

The recent ransomware attack on Change Healthcare brought significant attention to cybersecurity vulnerabilities within the healthcare sector. These attacks prompted SecurityScorecard's STRIKE threat analysts to conduct a detailed assessment of the cybersecurity risks among the 500 largest US healthcare companies. The aim was to provide a comprehensive analysis of the sector's security posture, identify key vulnerabilities, and advocate for improved practices in third-party risk management and application security. This proactive response was essential in addressing ongoing cybersecurity threats and enhancing resilience within the healthcare industry.

Key findings

Businesswire summarized the key findings of the report as follows:

• “Healthcare industry gets a B+: The U.S. healthcare industry's security ratings were better than expected, with an average score of 88. However, there is still room for improvement: Organizations with a B rating are 2.9x more likely to be victims of data breaches than those with an A rating.
• Healthcare Industry leads in third-party breaches: 35% of third-party breaches in 2023 affected healthcare organizations, outpacing every other sector. The supplier ecosystem is a highly desirable target for ransomware groups. Attackers can infiltrate hundreds of organizations through a single vulnerability without being detected.
• Medical device organizations have a higher risk of compromise: Medical device and equipment companies scored 2-3 points lower than those of the overall healthcare sample. These organizations also had a 16% higher rate of reported breaches and compromised machines than those in other healthcare sectors.
• AppSec is the biggest attack surface threat: Application security issues are among the most significant flaws in healthcare attack surfaces – 48% of organizations scoring the lowest in this category. The software supply chain gives an attacker access to source code, build processes, pipeline tools, or software updates to carry the attack downstream to the supplier’s customers, which often implicitly trust the vendor and its systems.
• Breaches remain low despite rising threats: 5% of healthcare organizations experienced publicly reported breaches in the past year, and 6% had evidence of a compromised machine on their networks in the past 30 days. Ransomware remains a top threat to the industry, as reflected in the public reporting on these attacks.”

See also: HIPAA Compliant Email: The Definitive Guide

Cybersecurity in healthcare

In a 2022 survey, 97% of healthcare executives believed technological advancements were more reliable for informing their organization's long-term strategy than political, social, or economic trends. However, the digitization of healthcare is not without risks.

Cybersecurity in healthcare is crucial for protecting sensitive patient information and ensuring the seamless operation of medical services. As the industry increasingly relies on digital systems and interconnected devices, the risk of cyberattacks has grown substantially. The European Repository of Cyber Incidents observed a worldwide rise from 32 occurrences in 2022 to 121 incidents in the year following.

Cybercriminals target healthcare organizations to access valuable personal health data, disrupt services, and demand ransoms. The consequences of such attacks can be severe, leading to compromised patient safety, financial losses, and erosion of trust in healthcare institutions. Therefore, robust cybersecurity measures, including advanced threat detection, regular security audits, and comprehensive staff training, are essential to safeguard patient data and maintain the integrity of healthcare operations.

Go deeper: What is cybersecurity in healthcare?

FAQs

What is cybersecurity?

Cybersecurity is the practice of protecting computer systems, networks, and data from digital attacks, unauthorized access, and damage. It involves implementing measures to safeguard information, ensure data privacy, and maintain the integrity and availability of critical systems. This includes the use of technologies, processes, and practices designed to prevent cyber threats such as hacking, malware, ransomware, and phishing, ensuring that sensitive information remains secure and systems remain functional.

What are the major vulnerabilities identified in the healthcare sector?

Major vulnerabilities include third-party breaches, medical device security, and application security issues. The sector's extensive supplier ecosystem and reliance on interconnected systems make it a prime target for cyberattacks.

How can healthcare organizations improve their cybersecurity posture?

Healthcare organizations can improve cybersecurity by investing in advanced threat detection systems, conducting regular security audits, and training staff on cybersecurity best practices. Additionally, strengthening third-party risk management and securing software supply chains are crucial steps.

See also: Preventing the spread of cybersecurity attacks in healthcare