May 30, 2018 By Douglas Bonderud 2 min read

Healthcare organizations are worried about cyberattacks. In fact, 77 percent of healthcare information technology (IT) professionals are “very concerned” about cyberattacks, according to a May 2018 survey sponsored by cybersecurity firm Imperva. Of those surveyed, 32 percent listed ransomware as their biggest fear, and employee actions grabbed the number two spot with 25 percent.

However, insider threats are the more persistent IT infection. As the 2018 Verizon Data Breach Investigations Report pointed out, healthcare is the only industry where insiders are responsible for more incidents than outside attacks.

Insider Threats: A Healthy Concern

According to Information Age, the use of unapproved applications by healthcare staff is often linked to IT risk, as employees may accidentally post or share confidential information to social media sites or send it via plaintext email.

Locking down access to cloud-based apps and services is often the go-to IT response — but this typically drives staff to use other applications that information security (InfoSec) professionals don’t know about and haven’t blocked. The result is a vicious cycle: IT’s attempts to reduce insider threats only increase total risk.

Despite the risk of malicious insider actions, companies are more concerned about accidental exposure. Imperva’s survey found that 51 percent of healthcare companies are more worried about careless users than staff-turned-attackers.

Although 73 percent of organizations now employ a senior information security leader — and 33 percent of respondents said their cyberattack response was “above average” — 38 percent of healthcare institutions suffered at least one cyberattack in the last year. Additionally, at least half of these attacks started with corporate insiders.

The Insider Threat Treatment Plan

What’s preventing health companies from curing the insider threat infection?

The Imperva survey pointed to four key factors:

  • More access by more people: More employees, contractors and business partners now access health networks, increasing insider impact.
  • More assets on the cloud: Increasing use of cloud services means more critical data is potentially at risk.
  • Lack of staff to analyze employee actions: As the total number of users and network-connected devices increases, staff struggle to effectively analyze insider actions.
  • Lack of monitoring tools: Without tools capable of monitoring activities across distributed networks, InfoSec professionals are hard-pressed to manage insider threats.

While there’s no cure-all, Information Age recommends making insiders part of the conversation about application use and safety. Rather than banning services outright, allow staff to use the applications of their choice wherever possible and adopt security best practices, such as deep inspection of web traffic, URL filtering and per-app monitoring.

As noted by Imperva, new machine-learning solutions can help IT teams “pinpoint critical anomalies that indicate misuse of enterprise data, so they can quickly quarantine risky users to prevent any further issues.”

The bottom line: Insider threats remain a persistent IT infection for healthcare organizations, despite increased recognition of cybersecurity risk.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today