AlexOakenman - Fotolia
Reduce healthcare security risks with SaaS-based applications
SaaS applications are hosted by external providers and can remain functional if other applications in a healthcare organization are compromised, mitigating the risk of an attack.
In the ongoing battle to keep hackers away from hospital systems, IT departments are constantly looking for innovative ways to improve their protections. Unfortunately, despite the best tools and protections, criminals can still gain access through stolen credentials or the use of phishing emails. As a result, some IT leaders are not asking if they can stop or prevent attacks, but how they can reduce the impact of an attack if their systems are compromised. Shifting to a cloud-based environment by using SaaS-based applications may just be the prescription for mitigating healthcare security risks.
In December 2017, Mecklenburg County in North Carolina -- which includes Charlotte -- experienced a serious breach when hackers gained control of government computer systems. The attack occurred after a county employee unknowingly opened an email attachment that contained spyware. The attackers held several sets of data and systems hostage by encrypting them and asked for Bitcoin as ransom. This had serious implications across the county since it took down several critical systems. This attack raised questions about how the use of SaaS-based applications would have been able to keep many services for the county up and operational.
One of the most common attacks that frequently target healthcare is ransomware, where malicious code is executed on an end user's machine or server, then encrypts any files the user is authorized to access on the network or local machine. The second type lures a user into clicking a link or opening an email attachment, which then executes code allowing a hacker to gain control of the machine remotely and capture the user's credentials to use later. These attacks would have a different outcome if the victims had more of their systems as SaaS applications. Following is a list of areas in which the use of SaaS or cloud-hosted applications poses an advantage over an on-premises environment.
Limited or no access to servers that host applications
In the unfortunate event of a successful ransomware infection, a hospital using cloud-based solutions would not see any damage or interruptions to those workloads. The first likely area to be impacted is the local network and servers. But SaaS-based applications are well-protected and shielded from potential infections since they are delivered through the browser or remote clients.
SaaS applications are less vulnerable to network attacks
Using SaaS-based applications can also help reduce healthcare security risks because they will still operate if the network or an environment has been compromised, since the applications are hosted by external providers. This is especially important in a healthcare setting where access to systems that hold patient data is critical. In case of a massive ransomware attack, hospital staff can still access SaaS applications while IT is working on restoring affected systems.
SaaS providers deliver advanced and specific protection
Hospitals use many SaaS applications, whether it is a full cloud-based EHR, payroll, patient scheduling and billing, or hosted email services. Each vendor delivers specific protocols and safeguards that address the potential risks associated with their tools. This highly specialized security practice reassures hospitals that the burden of protecting those workloads is being addressed and that the vendors use the best tools available.
Lower risk when an attack is successful
Despite the best protections in the marketplace, even SaaS vendors can and will eventually face the potential risks associated with an attack. In a hospital, if one SaaS vendor experiences an attack that causes an application to go offline, the other SaaS services the hospital uses are still intact. This approach significantly mitigates the healthcare security risks a hospital faces, and blocks the spread of infections when one system is affected.
Hospital IT executives continue to face the daunting task of keeping their environments well protected. Despite the best tools and investments, hospitals still face potential healthcare security risks. Mecklenburg County is an example that, despite using the best tools and investing over $1.2 million for IT security services in 2017, a system-wide outage is still possible.
The use of SaaS may help reduce the healthcare security risks associated with a successful ransomware attack or data breach. By keeping the servers that host different SaaS applications offsite, the potential damage from an attack is limited to the local accessible environment or systems.
