Kroll recently released their report on the state of cyber defense, revealing increased threats to the healthcare sector.
What happened
On April 17th, Kroll released a new research report, “The State of Cyber Defense: Diagnosing Cyber Threats in Healthcare,” that compiled data from over 3,000 cyber incidents. The report compared the cybersecurity landscape in healthcare from 2022 to 2023.
When it comes to cyber threats, the report showed that the “healthcare sector is underprepared” and that it is a “consistently popular target” for cybercriminals.
Despite the statistics, Kroll found that many healthcare organizations self-report a high level of security. Only 3% of healthcare respondents said they do not trust their organization’s ability to defend against most cyberattacks.
Even though many organizations feel confident in their preparation, Kroll’s analysis alongside the countless news reports Paubox has conducted, paints a very different picture.
Going deeper
The report noted the frequency with which healthcare organizations are targeted is due to the industry’s critical nature; attacks can result in downed operations or even put patients in danger. Because of this, healthcare organizations are more likely to comply with ransom demands, even if it can lead to more attacks in the future.
Some ransom organizations, like Rhysida Ransomware, were purposely created to target hospitals and other critical industries.
The report found that 50% of respondents believe their overall security is “very mature” and many said that zero improvements are needed.
Kroll listed out key components of a strong threat and detection response system, which included:
- Cybersecurity monitoring
- Digital forensics
- Containment/disruption
- Threat hunting
- Remote eradication and remediation
- Incident response plan
- Investigation and validation
- Business continuity plan
- Crisis management
- Recovery capabilities.
Twenty-eight percent of companies only conduct cybersecurity monitoring, 13% conduct only digital forensics and monitoring, and 12% only conduct forensics, monitoring, and containment. Ultimately, no organizations reported having all of the components.
The report found the most common threats were email compromise (37% of threats) and ransomware (34% of threats). Kroll also found that phishing was the most common initial access method; 33% of attacks began this way in 2023.
Read more: HIPAA Compliant Email: The Definitive Guide
What’s next
Kroll provided the following suggestions for the industry:
- Complete risk assessments, like the HIPAA risk assessment, to identify potential vulnerabilities. These should be completed, at minimum, yearly.
- Conduct external and internal testing
- Complete “simple” tasks diligently; ensure the use of strong passwords, multi-factor authentication, and system updates as needed.
Why it matters
As the Kroll report shared, the healthcare environment is vast and varied; not every healthcare organization will have the same budget for cybersecurity. Yet, the Kroll report revealed that “many healthcare institutions might use the same billing, insurance or third-party suppliers, linking them in a network a threat actor could exploit.” For healthcare, cybersecurity must be a priority. Thankfully, with services like Paubox, it can also be reasonably priced.
Furthermore, the Kroll report showed that many healthcare organizations are “time poor and high risk,” meaning that training an already busy staff on critical cybersecurity measures can be challenging. Utilizing simple but effective solutions is the best option for healthcare organizations.
The big picture
As the report showed, attacks on the healthcare sector are unlikely to stop anytime soon. But preventing them doesn’t have to be exhausting. Phishing, especially, is extremely preventable with a strong software, like Paubox.
Lastly, it’s critical that healthcare organizations examine their current response and detection strategies. Some organizations do not realize their level of vulnerability until it’s too late. By reviewing their security systems and response protocols comprehensively, organizations can better understand how prepared they are to prevent or mitigate an attack.
Try Paubox today.
Abby Grifno
