[{"innerBlocks":[],"name":"core\/freeform","postId":126527,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"It\u2019s worth remembering that 2016 was dubbed the \u201cyear of data security\u201d after 90 percent of healthcare providers suffered data breaches in the previous two years. In particular, the Anthem breach of late 2014 and early 2015 got everyone\u2019s attention for the sheer magnitude of the hack\u2014estimated at nearly 80 million records.

Looking back, we can say 2016 lived up to its name as the number of records accessed was significantly lower than the year prior. But IT security is a game of whack-a-mole, so if fewer patient records were lost, malevolent forces simply found other ways to make the lives of healthcare CIOs very difficult.

Ransomware, for example, became the dominant security issue of 2016 and made everyone aware that hackers can always just hold your files hostage if they can\u2019t steal them.

So, does 2017 look like more of the same or will hackers conjure up something new? Sitting here in January, the expectation is that the same security issues will endure, but they will also be accompanied by more challenging and complex concerns.

The Internet of Things (IoT):<\/b> The difficulty of IoT security is represented by the numbers: There are tens of thousands, if not hundreds of thousands, of IoT devices connected to healthcare networks, and the security on all of them is not iron clad.

The hacking potential of IoT devices was made clear last October when domain name services provider DYN was breached via webcams and digital recorders, knocking Twitter, PayPal, Spotify and other internet behemoths offline for hours.

In a recent survey of healthcare executives conducted by Healthcare IT News, 52 percent said security was the highest IT priority for this year, with 58 percent elevating IoT devices to the top of the list of security concerns.

Ransomware:<\/b> Hackers require access, and unsecured IoT devices give them that access. Once inside, they can continue the breakout year that ransomware had in 2016. In 2017, however, there may simply be more players in the game because the internet is an ever-evolving amusement park of wonders and horrors.

\u201cThere is already a ransomware as a service [RaaS] model, which provides automatically generated ransomware executables for anyone who wants to get rich by infecting potential victims,\u201d Ondrj Vlcek, CTO for security firm Avast, explained to ComputerWeekly.com. \u201cThe bottom line is that creating or buying your own ransomware has never been easier.\u201d

A panel of security experts speaking with Health Data Management said they expect extortion attacks to increase and become more sophisticated. The solution? According to David Finn, health information technology officer for Symantec, hospitals and health systems must have robust backup systems so they don\u2019t have to pay for extorted patient data.

Data-integrity attacks:<\/b> You may have heard of the Stuxnet worm the U.S. government used in 2010 to infiltrate and sabotage Iran\u2019s nuclear program by engineering minor changes in targeted devices. That\u2019s an example of a data-integrity attack. The not-so-good-news is that the technology has filtered down to black-hat hackers, who can access hospital and health system networks through \u2026 wait for it \u2026 IoT devices.

\"IoT is a massive attack surface that allows people to touch systems that, for previous decades, haven't been available to be interacted with,\" Daniel Miessler, director of client advisory services for security firm IOActive, told CNBC. \"This is increasing exponentially.\u201d

Instead of taking data or holding data hostage, hackers can manipulate data in subtle and often unnoticed ways so, for instance, payments don\u2019t go where they\u2019re supposed to. That\u2019s one example of the potential data-integrity attacks offer to hackers.

Cloud infrastructure:<\/b> There is no shortage of articles touting the benefits of moving to the cloud, even if insufficient attention is paid to the attendant security risks.

As CynergisTek CEO Mac McMillan told Health Data Management, the cloud is \u201cthe proverbial double-edged sword. It\u2019s an absolute necessity for advancement, but security continues to lag further behind, which ultimately risks the advancement.\u201d

Extensive due diligence on your cloud services provider is essential, as is a contract that establishes responsibility, reaction and culpability in the event of a breach.

Artificial intelligence: <\/b>It would be difficult to imagine that most hospitals and health systems will have the resources to maximize the value of artificial intelligence and machine learning. Unfortunately, that won\u2019t keep hackers from using AI and machine learning as a tool on their side of the security battle.

\u201cFrom a hacker\u2019s point of view, AI will power malware, and use data from the target to send phishing emails that replicate human mannerisms and content,\u201d said Capgemini UK cyber security chief Andy Powell. \u201cThese AI-powered attacks will resonate with the target better than ever before, meaning they\u2019ll be more likely to fall victim.\u201d

People:<\/b> As always, there is no more enduring risk to your facility and organizational security than the people who work there. Thorough preparation of your staff is the best defense against the most common forms of hacking and data theft.

But, as Kasey Panetta of Gartner describes in a recent paper on 2017 security trends, it is only one component in an \u201cadaptive security architecture.\u201d

\u201cThe evolution of the intelligent digital mesh and digital technology platforms and application architectures means that security has to become fluid and adaptive,\u201d she writes. \u201cSecurity in the IoT environment is particularly challenging. Security teams need to work with application, solution and enterprise architects to consider security early in the design of applications or IoT solutions. Multilayered security and use of user and entity behavior analytics will become a requirement for virtually every enterprise.\u201d

Does this sound like more technical sophistication and cost than your small or medium-sized healthcare organization can handle? That\u2019s bound to be a common complaint. While all hospitals could potentially fall victim to the security breaches described here, not all hospitals can properly defend against them.

This common vulnerability calls for extensive sharing of knowledge and affordable strategies that guard against loss or manipulation of data. An ongoing Health and Human Services initiative and grant program endeavors to gather and disseminate the most current information on cyber threats, but it may take a few years for that effort to yield actionable information.

It may also call for smaller facilities partnering with those that are larger and more resource rich. We\u2019re seeing relationships between large and small organizations develop in other areas of healthcare IT such as EHR implementation. Getting to the point where healthcare is not such an attractive hacker target may require the same with regard to security.","saveContent":"It\u2019s worth remembering that 2016 was dubbed the \u201cyear of data security\u201d after 90 percent of healthcare providers suffered data breaches in the previous two years. In particular, the Anthem breach of late 2014 and early 2015 got everyone\u2019s attention for the sheer magnitude of the hack\u2014estimated at nearly 80 million records.

Looking back, we can say 2016 lived up to its name as the number of records accessed was significantly lower than the year prior. But IT security is a game of whack-a-mole, so if fewer patient records were lost, malevolent forces simply found other ways to make the lives of healthcare CIOs very difficult.

Ransomware, for example, became the dominant security issue of 2016 and made everyone aware that hackers can always just hold your files hostage if they can\u2019t steal them.

So, does 2017 look like more of the same or will hackers conjure up something new? Sitting here in January, the expectation is that the same security issues will endure, but they will also be accompanied by more challenging and complex concerns.

The Internet of Things (IoT):<\/b> The difficulty of IoT security is represented by the numbers: There are tens of thousands, if not hundreds of thousands, of IoT devices connected to healthcare networks, and the security on all of them is not iron clad.

The hacking potential of IoT devices was made clear last October when domain name services provider DYN was breached via webcams and digital recorders, knocking Twitter, PayPal, Spotify and other internet behemoths offline for hours.

In a recent survey of healthcare executives conducted by Healthcare IT News, 52 percent said security was the highest IT priority for this year, with 58 percent elevating IoT devices to the top of the list of security concerns.

Ransomware:<\/b> Hackers require access, and unsecured IoT devices give them that access. Once inside, they can continue the breakout year that ransomware had in 2016. In 2017, however, there may simply be more players in the game because the internet is an ever-evolving amusement park of wonders and horrors.

\u201cThere is already a ransomware as a service [RaaS] model, which provides automatically generated ransomware executables for anyone who wants to get rich by infecting potential victims,\u201d Ondrj Vlcek, CTO for security firm Avast, explained to ComputerWeekly.com. \u201cThe bottom line is that creating or buying your own ransomware has never been easier.\u201d

A panel of security experts speaking with Health Data Management said they expect extortion attacks to increase and become more sophisticated. The solution? According to David Finn, health information technology officer for Symantec, hospitals and health systems must have robust backup systems so they don\u2019t have to pay for extorted patient data.

Data-integrity attacks:<\/b> You may have heard of the Stuxnet worm the U.S. government used in 2010 to infiltrate and sabotage Iran\u2019s nuclear program by engineering minor changes in targeted devices. That\u2019s an example of a data-integrity attack. The not-so-good-news is that the technology has filtered down to black-hat hackers, who can access hospital and health system networks through \u2026 wait for it \u2026 IoT devices.

\"IoT is a massive attack surface that allows people to touch systems that, for previous decades, haven't been available to be interacted with,\" Daniel Miessler, director of client advisory services for security firm IOActive, told CNBC. \"This is increasing exponentially.\u201d

Instead of taking data or holding data hostage, hackers can manipulate data in subtle and often unnoticed ways so, for instance, payments don\u2019t go where they\u2019re supposed to. That\u2019s one example of the potential data-integrity attacks offer to hackers.

Cloud infrastructure:<\/b> There is no shortage of articles touting the benefits of moving to the cloud, even if insufficient attention is paid to the attendant security risks.

As CynergisTek CEO Mac McMillan told Health Data Management, the cloud is \u201cthe proverbial double-edged sword. It\u2019s an absolute necessity for advancement, but security continues to lag further behind, which ultimately risks the advancement.\u201d

Extensive due diligence on your cloud services provider is essential, as is a contract that establishes responsibility, reaction and culpability in the event of a breach.

Artificial intelligence: <\/b>It would be difficult to imagine that most hospitals and health systems will have the resources to maximize the value of artificial intelligence and machine learning. Unfortunately, that won\u2019t keep hackers from using AI and machine learning as a tool on their side of the security battle.

\u201cFrom a hacker\u2019s point of view, AI will power malware, and use data from the target to send phishing emails that replicate human mannerisms and content,\u201d said Capgemini UK cyber security chief Andy Powell. \u201cThese AI-powered attacks will resonate with the target better than ever before, meaning they\u2019ll be more likely to fall victim.\u201d

People:<\/b> As always, there is no more enduring risk to your facility and organizational security than the people who work there. Thorough preparation of your staff is the best defense against the most common forms of hacking and data theft.

But, as Kasey Panetta of Gartner describes in a recent paper on 2017 security trends, it is only one component in an \u201cadaptive security architecture.\u201d

\u201cThe evolution of the intelligent digital mesh and digital technology platforms and application architectures means that security has to become fluid and adaptive,\u201d she writes. \u201cSecurity in the IoT environment is particularly challenging. Security teams need to work with application, solution and enterprise architects to consider security early in the design of applications or IoT solutions. Multilayered security and use of user and entity behavior analytics will become a requirement for virtually every enterprise.\u201d

Does this sound like more technical sophistication and cost than your small or medium-sized healthcare organization can handle? That\u2019s bound to be a common complaint. While all hospitals could potentially fall victim to the security breaches described here, not all hospitals can properly defend against them.

This common vulnerability calls for extensive sharing of knowledge and affordable strategies that guard against loss or manipulation of data. An ongoing Health and Human Services initiative and grant program endeavors to gather and disseminate the most current information on cyber threats, but it may take a few years for that effort to yield actionable information.

It may also call for smaller facilities partnering with those that are larger and more resource rich. We\u2019re seeing relationships between large and small organizations develop in other areas of healthcare IT such as EHR implementation. Getting to the point where healthcare is not such an attractive hacker target may require the same with regard to security.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

How new security threats will buffet healthcare in 2017

More for you