Skip to main content
General

Healthcare: Security in Crisis?

By June 14, 2018No Comments

The other day my wife went to the doctor, and a few weeks before that we took our son to the dentist. We had to fill out all the paperwork and give them all the usual PII, including name, address, phone number, alternate contacts, SS#, DOB, driver’s license, insurance info, weight, height, underwear size (just kidding), then we paid them with our credit card. All the while trusting that they are keeping our information safe and secure. Well, they are keeping the information we entrust them with secure, right? How do we know if they are?

Healthcare: Security in Crisis?

Let’s look at what is going on in the health care industry. According to the Protenus’ ‘Breach Barometer Report‘ for 2017, there were only 477 reported breaches in health care with 5.6 million patient records compromised in 2017. Only… Wait… That doesn’t instill confidence that our information is secure. Well, according to the report, it is better than in 2016 where 450 incidents were reported with 27 million patient records affected. So, it appears to have improved. Doesn’t that make you feel better? (No? Me neither.)

It’s now 6 months into 2018, so the health care industry should have learned from those that have been compromised in the past. For an industry that houses so much personal information on individuals, they should be more secure than the government. But have they learned? Look at some of these recent reports:

Why haven’t things changed? The answer is one word: People. People are the reason for the incidents. Employees are falling prey to phishing emails. Employees are making configuration errors. Employees’ laptops with patient information on them are stolen. Drives from 3rd party providers with patient information on them are being lost in the mail. Flaws are being found in the software that is used by medical practitioners that allow unauthorized access. Then there is the insider threat. According to the Protenus report, 37% of the 2017 breaches in the health care industry were due to employees.

What can be done?

The industry needs to make data security a top priority and use the latest technology and effective training for employees to protect patient data. This should include:

  • Implementing password security policies that are in line with industry best practices;
  • Restricting access to differentiate between appropriate and inappropriate access to patient information;
  • Implementing stronger security measures for accessing patient data remotely;
  • Using multifactor authentication for accessing systems;
  • Encrypting portable devices, drives, laptops, and desktops that are used for patient care or that will access any patient data;
  • Requiring 3rd party vendors and contractors to attest to the protection of patient privacy and be audited on a regular basis to make sure they are compliant. This should always be in their contract;
  • Prohibiting the use of default username and passwords on software and hardware that is used – at the very least, change that password;
  • Deploying email protection devices/services;
  • Training staff to avoid the methods unauthorized individuals use to gain access, such as training against phishing and vishing attacks.

When it comes to training staff to defend against attacks, health care needs to use a service that is proven to prepare employees to handle real-world attacks. Take, for example, Social-Engineer’s Phishing as a Service ®(PHaaS®) or Vishing as a Service® (VaaS®). By using these proven services, you will educate and train employees and ensure that they understand the value of the data they are to protect.

While nothing can be 100% secure, as long as people are involved, the health care industry can succeed in making our information secure. It just requires them to have security procedures, policies, and auditing in place that follow industry best practices. It also requires them to use regular, effective training for employees and follow the above suggestions. Then we all can be more at ease when filling out all those forms with our personal information.

Stay safe and secure.

Sources:
https://cdn2.hubspot.net/hubfs/2331613/Breach_Barometer/2017/Annual%20Report/2017%20Breach%20Barometer%20Annual%20Report.pdf?utm_campaign=Breach%20Barometer&utm_medium=email&_hsenc=p2ANqtz-9ycEgeLRYmU0SfrJPF_ckb4J6Bao-DgtH2JfAkbDKcT3bvHx0PS0n23P4yiBOdH6UYiz9zJE3oLanwVL4jUN-UppI8UA&_hsmi=60099088&utm_content=60099088&utm_source=hs_automation&hsCtaTracking=6309d03f-6d95-40dc-bd9d-0746a51fe903%7Cc12e46e5-e4aa-4274-8081-93333297898b
https://whnt.com/2018/10/01/fraud-summit-held-in-huntsville-officials-warn-against-caller-id-spoofing/

Image
https://unsplash.com/@nci?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText

Tags:

Security Assessment Case Study
Learn more about the importance of a Social Engineering Risk Assessment.
Download Now
Security Assessment Case Study
Learn more about the importance of a Social Engineering Risk Assessment.
Download Now
What Makes Us Different
At Social-Engineer, we pride ourselves on what we do and how we do it. We are a security services provider, focusing on four primary attack vectors. This case study will go through how we can protect your company and what makes us different.
Download Now
What Makes Us Different
At Social-Engineer, we pride ourselves on what we do and how we do it. We are a security services provider, focusing on four primary attack vectors. This case study will go through how we can protect your company and what makes us different.
Download Now
Woman vs Machine
Technology is providing new, more innovative ways to enhance our world. Scientists are constantly developing smarter, faster and more intelligent machines, systems and robots. There is no doubt that each of these has evolved beyond their clockwork origins.
Download Now
Woman vs Machine
Technology is providing new, more innovative ways to enhance our world. Scientists are constantly developing smarter, faster and more intelligent machines, systems and robots. There is no doubt that each of these has evolved beyond their clockwork origins.
Download Now
Vishing and Phishing Must Be Ongoing to Be Effective
Most companies have a security awareness program in one form or another. If they don’t, it should be on the short list of programs to start as soon as possible. In our experience, many of these programs take the form of computer-based training.
Download Now
Vishing and Phishing Must Be Ongoing to Be Effective
Most companies have a security awareness program in one form or another. If they don’t, it should be on the short list of programs to start as soon as possible. In our experience, many of these programs take the form of computer-based training.
Download Now
A Case Study in Vishing
Vishing (voice-based phishing) has been a problem for quite a long time. There are many vendors in the marketplace that offer vishing services. However they tend to use robo-callers or call centers for large volume engagements. If they are using trained humans to make calls, it is likely in very low numbers.
Download Now
A Case Study in Vishing
Vishing (voice-based phishing) has been a problem for quite a long time. There are many vendors in the marketplace that offer vishing services. However they tend to use robo-callers or call centers for large volume engagements. If they are using trained humans to make calls, it is likely in very low numbers.
Download Now
Benefits of a Social-Engineering Risk Assessment Engagement
Your company is important. Indeed, the data you hold for your clients or employees is very valuable and attackers seek to capitalize on that data any way they can. This is where a Social Engineering Risk Assessment (SERA) engagement can help uncover possible vulnerability to attackers.
Download Now
Benefits of a Social-Engineering Risk Assessment Engagement
Your company is important. Indeed, the data you hold for your clients or employees is very valuable and attackers seek to capitalize on that data any way they can. This is where a Social Engineering Risk Assessment (SERA) engagement can help uncover possible vulnerability to attackers.
Download Now
The Business Value of the Social-Engineer Phishing Service
Cybercriminals are targeting the human element of organizations. Additionally, they are developing techniques to use an organization’s employees as the first point of entry. According to the 2021 Verizon DBIR report, of the 3,841 security breaches reported using social engineering, phishing was the key vector for over 80% of them.
Download Now
The Business Value of the Social-Engineer Phishing Service
Cybercriminals are targeting the human element of organizations. Additionally, they are developing techniques to use an organization’s employees as the first point of entry. According to the 2021 Verizon DBIR report, of the 3,841 security breaches reported using social engineering, phishing was the key vector for over 80% of them.
Download Now