May 30, 2018 By Douglas Bonderud 2 min read

Healthcare organizations are worried about cyberattacks. In fact, 77 percent of healthcare information technology (IT) professionals are “very concerned” about cyberattacks, according to a May 2018 survey sponsored by cybersecurity firm Imperva. Of those surveyed, 32 percent listed ransomware as their biggest fear, and employee actions grabbed the number two spot with 25 percent.

However, insider threats are the more persistent IT infection. As the 2018 Verizon Data Breach Investigations Report pointed out, healthcare is the only industry where insiders are responsible for more incidents than outside attacks.

Insider Threats: A Healthy Concern

According to Information Age, the use of unapproved applications by healthcare staff is often linked to IT risk, as employees may accidentally post or share confidential information to social media sites or send it via plaintext email.

Locking down access to cloud-based apps and services is often the go-to IT response — but this typically drives staff to use other applications that information security (InfoSec) professionals don’t know about and haven’t blocked. The result is a vicious cycle: IT’s attempts to reduce insider threats only increase total risk.

Despite the risk of malicious insider actions, companies are more concerned about accidental exposure. Imperva’s survey found that 51 percent of healthcare companies are more worried about careless users than staff-turned-attackers.

Although 73 percent of organizations now employ a senior information security leader — and 33 percent of respondents said their cyberattack response was “above average” — 38 percent of healthcare institutions suffered at least one cyberattack in the last year. Additionally, at least half of these attacks started with corporate insiders.

The Insider Threat Treatment Plan

What’s preventing health companies from curing the insider threat infection?

The Imperva survey pointed to four key factors:

  • More access by more people: More employees, contractors and business partners now access health networks, increasing insider impact.
  • More assets on the cloud: Increasing use of cloud services means more critical data is potentially at risk.
  • Lack of staff to analyze employee actions: As the total number of users and network-connected devices increases, staff struggle to effectively analyze insider actions.
  • Lack of monitoring tools: Without tools capable of monitoring activities across distributed networks, InfoSec professionals are hard-pressed to manage insider threats.

While there’s no cure-all, Information Age recommends making insiders part of the conversation about application use and safety. Rather than banning services outright, allow staff to use the applications of their choice wherever possible and adopt security best practices, such as deep inspection of web traffic, URL filtering and per-app monitoring.

As noted by Imperva, new machine-learning solutions can help IT teams “pinpoint critical anomalies that indicate misuse of enterprise data, so they can quickly quarantine risky users to prevent any further issues.”

The bottom line: Insider threats remain a persistent IT infection for healthcare organizations, despite increased recognition of cybersecurity risk.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today