Biggest Healthcare Security Threats, Ransomware Trends into 2021

The Neverending Reign of Ransomware

Beginning in September, ransomware again asserted its dominance on the healthcare sector, after a relative lull in reported events during the spring. By the end of November, more than a dozen healthcare delivery organizations were driven into EHR downtime by the evasive threat.

Even as some bad actors increase their attacks’ sophistication, Riemer noted that at the end of the day, hackers are opportunistic in nature and able to pivot quickly across the network once they’ve gained a foothold.

"Money and lives are at risk, to put it bluntly."

Hackers will use anything to gain an advantage, including people, new networks, and especially COVID-19.

To Potter, Friedberg, and Riemer, ransomware and other opportunistic threats will continue well into 2021 as the healthcare sector continues its response to the COVID-19 outbreak. Those risks will only amplify as more entities migrate data to the cloud and with the pandemic stress.

Friedberg noted that those stressors may lead to data exposures due to misconfigured cloud and on-prem servers.

“For 2021, we can expect a continued uptick in ransomware, and in more cases we will see a doxing component in which the attacker threatens to publish exfiltrated personally identifiable information and protected health information, if the healthcare institution does not pay the ransom,” Friedberg said.

“A growing ransomware trend is for the attackers to disable victims’ incident response, restoration and recovery platforms and technologies, all with the purpose of further pressuring the institution to pay,” he added. 

While nation-state actors are increasingly targeting the sector, he added that ransomware has remained the largest threat. Regardless of the attack method, similar security efforts can defend against these prominent threats.

And as the pandemic is largely handled during the first half of 2021, Potter predicted that there will likely be less interest in healthcare from those nation-state actors. Investments in this attack activity will likely cease, altogether.

“That said, the knowledge they gained in the last year will likely serve them well in future intelligence and cybercrime operations against this sector making them a perpetually dangerous adversary,” Potter statedconcluded.

Serious Security Shortcomings and Resource Failures

The Department of Health and Human Services released an audit report gauging HIPAA compliance across the sector based on a sample of healthcare organizations. It found that the majority of providers are failing to perform required risk assessments and risk management processes.

As threat actors continue to hunt and exploit vulnerabilities, the risks to the sector have drastically increased in severity, and many providers are failing to keep pace with threats.

“Many of the small-to-midsize providers continue to face resourcing issues when it comes to implementing cybersecurity controls,” Potter explained. “Lack of funding and lack of staff mean that these organizations will continue to be relatively easy targets for attackers, and the critical nature of their services mean that criminal organizations know that they are likely to pay up.”

For Riemer, healthcare’s greatest challenges are caused by budgetary constraints, staffing shortages, and a “lack of cybersecurity prowess with needed IT support staff.”

A decline in cybersecurity expertise has also been predicted for the coming year, and coupled with usability issues and multiple hacking exploits to get into the network, providers are struggling to adequately defend their networks.

Diving deeper into those threats finds many entities are falling victim to attacks due to a failure to effectively block malicious phishing emails from employees’ accounts, explained Friedberg. 

Others have failed to deploy effective visibility tools to better detect hackers moving laterally across their networks, while overall, there’s a lack of advanced malware detection capabilities on network traffic and endpoints.

Healthcare’s shortcomings also include password issues, a lack of enterprise forensics software and anomaly detection tools, and sub-par security monitoring or threat hunting. And some providers are still failing to segregate their data backups from the network.

"In more cases we will see a doxing component in which the attacker threatens to publish exfiltrated PII and PHI."

But to Potter, the biggest security failure within the industry is a lack of needed workforce support.

“For the larger players, they are able to hire staff and buy the required tech to run reasonably secure organizations,” Potter said. “For down-market providers, particularly those in less urban parts of the nation, the situation is much more dire. Even with funding it will be difficult to first staff the required jobs and then actually build out the necessary security controls.”

“A national initiative to assist placing skilled cybersecurity staff in small- and mid-market healthcare companies would go a long way to closing this gap,” he added. “A shared responsibility model with the USG may be the only way to address this problem in the near term.”

Time for Action

Collaboration is crucial for all levels of healthcare privacy and security, including with medical device security needs. Potter stressed there’s a serious need for greater assistance from both federal and state governments in terms of grants, financial incentives, and concrete cybersecurity guidance.

For many providers, security is a new domain, and as such, they lack a revenue model or organizational structure to successfully bolster cybersecurity across the enterprise.

“Money and lives are at risk, to put it bluntly. Some of the problems these organizations face go beyond what they can solve on their own,” explained Potter. “These entities should work with state and federal organizations already focused on healthcare and critical infrastructure security to make their case and get whatever assistance they can.”

“Hopefully those government organizations will be able to assist,” he added.

For Friedberg, patient privacy should be considered when making security-based decisions in the healthcare setting. From increased maturity in cybersecurity tools, to the processes and needed skills, these elements must be completely aligned with increasing patient privacy across the enterprise.

In general, cybersecurity obstacles are similar to patient privacy, including bandwidth unable to support new projects across complex, and often sprawling infrastructure, Friedberg explained.

The ideal security model for healthcare is zero trust: an evolving set of network security parameters designed to narrow defense perimeters from the current wide state, to more individualized resources. The model was designed in response to an expanse of remote users and cloud-based assets not directly located within the enterprise network. 

However, a host of misconceptions plague progress in this area, including the thought that the project is too broad in scope or too expensive to tackle. However, many providers already employ many of the tools needed to accomplish a zero trust model within their infrastructure, Riemer explained.

Those elements include two-factor authentication, encryption, endpoint posture assessments, evaluating connectivity, visibility into access management, and the like. As COVID-19 spurred the rapid adoption of telehealth, temporary care sites, and remote work, providers can meet the challenges of today’s security issues by employing a model of least privilege and other zero trust elements.

“The reality of the situation is that breaches and attacks are happening on a daily basis,” Riemer said. “Given the scale and size of the attacks, it’s imperative to act now. We only hear about the big attacks, and small ones go unnoticed, or the hacker will save the victim for another day.”

“One of the biggest things providers need to understand is that a lot of the technology available to them fits within a zero trust model,” he added. “Early 90s defense-in-depth security has gone through multiple iterations, and zero trust is just a later version. Companies don’t need to feel this is an overwhelming budget issue: it works with what you have in place or reutilizes system assets.”

Regardless of the security model or tools chosen to defend a healthcare network, what’s imperative is that some form of best practice steps are taken now. The threats seen this year have only begun to spotlight the inherent risk healthcare is facing. Hackers will not wait for the sector to play catch-up; instead, they’ll continue to take advantage of their mass weaknesses.