CIOs should plan for a spike in healthcare cyberattacks

Cyberthreats seen on the front lines

Anahi Santiago, CISO at the Delaware-based ChristianaCare health system, said there has been a rapid increase in social engineering attacks -- including phishing, where bad actors appear as a trusted source and trick healthcare employees into revealing their credentials -- that are testing healthcare systems during the coronavirus crisis.

Anahi Santiago

Although the ChristianaCare health system has security tools to prevent phishing attacks on the organization, Santiago said home computers may not have the same protections. Additionally, Santiago said threat actors are setting up websites using legitimate coronavirus outbreak global maps to trick people into visiting those sites and, unbeknownst to them, downloading malware. While the healthcare system's security tools block malicious websites, clinicians may not have the same types of protection at home.

CynergisTek's Barlow said the "threat landscape has increased dramatically," as regulations have been relaxed to enable physicians to work and treat patients remotely. That increased threat landscape includes a physician's home network, which gives bad actors more opportunity to gain access to a healthcare institution.

As cyberattackers capitalize on this opportunity, Barlow said it's important for health systems' security teams to mobilize and for healthcare CIOs and CISOs to have a plan in place in case their healthcare system is breached.

Santiago echoed Barlow's call on security teams, saying awareness and ensuring the cybersecurity posture remains intact are key to preventing these kinds of attacks.

"We have been working very closely with our external affairs folks to communicate to the organization so that our caregivers have awareness, not only around potential phishing and social engineering attacks that might come through the organization, but also to be aware at home," she said. "We're doing a lot of enablement for the organization, but also making sure that we're thinking about our caregivers and their families and making sure we're giving them the tools to be able to go home and continue to protect themselves."

Aaron Miri

Aaron Miri, CIO at the University of Texas at Austin Dell Medical School and UT Health Austin, said he has heard of academic medical institutions and healthcare systems being under constant attack and is remaining vigilant.

"During any situation, even if it's a Friday afternoon at 5 o'clock, you can expect to see bad actors try to capitalize," he said. "It is an unfortunate way of the world and it's reality, so we are always keeping watch."

Preparing for cyberattacks

Barlow said there are a few steps healthcare security teams can take to make sure providers working at home are doing so securely.

First, he said it's key to make sure clinicians have proper virtual private networks (VPNs) in place and that they're set up properly. A VPN creates a safe connection between a device that could be on a less secure network and the healthcare system network.

Second, he said security teams should make sure those computers have proper protection, often referred to as endpoint security. Endpoint security ensures devices meet certain security criteria before being allowed to connect to a hospital's network.

The next step is getting a plan in place so that when a healthcare system is breached or hit with ransomware, it will know how to respond, he said. The plan should include how to manage a breach in light of the pandemic, when leaders of the organization are likely working from home.

"If you are hit with ransomware, how are you going to process through that, how are you going to do that when you can't get everybody in the room … how are you going to make decisions, who are you going to work with," he said. "Get those plans up to date."