UCLA Breach Shows Hospitals Vulnerable to Cyber-attacks
The recent string of major hacker attacks in the healthcare sector, including the cyber-attack on UCLA Health, highlights the need for healthcare providers to step up their security programs.
UCLA Health Breach
In the latest headline-grabbing hack attack in the healthcare sector, UCLA Health estimates that data on as many as 4.5 million individuals potentially may have been impacted by a cyber-attack. It is thought to have begun last September and is “believed to be the work of criminal hackers.” UCLA Health says it is working with FBI investigators and has also hired private computer forensic experts to further secure information on network servers.
Healthcare organizations need to thoroughly assess their risks and implement appropriate security measures. In many cases, this will include implementing multi-factor authentication, improving breach monitoring and detection, and ramping up staff security education.
Healthcare is becoming a bigger target for hackers and other cybercriminals for three main reasons:
- Healthcare has traditionally under-invested in IT compared to other industries, leaving it more vulnerable.
- Healthcare tends to aggregate a large amount of personally identified information in one place, making it easy to breach a large number of records in a single attack.
- Medical identity theft—fraudulently receiving healthcare services—can be more profitable than financial identity theft.
Even some well-meaning healthcare organizations are realizing that the diligent efforts they’ve been putting into information security aren’t enough.
Many healthcare industry organizations thought they had pretty good information security. But these attacks should be eye opening to many companies.
The scope of vulnerabilities is increasing, and the ‘defensive’ security program model is failing to meet the challenge of the threats. Surveys over the past few years indicate that more than 90 percent of organizations sampled have already been hacked. That is a startling number that requires a national emergency-level response.
Cybercriminals are motivated by easy money. Healthcare offers one of the greatest ROI efforts with the lowest level of detection and risk. Medical information is data rich and durable. Unlike credit card data, health information is much more durable, with much of it unchangeable for the life of the affected individual.
4 Steps To Take
- Two-factor authentication. Weak passwords, seldom if ever changed, are the bane of information security. Requiring a token, something other than a username and password—both things you know—is the cheapest big step up the security ladder.
- Data segmentation. Valuable, sensitive information needs to be segmented from general user access, not all accessible from one network or one level of user account.
- Proactive monitoring for unauthorized use. When 90 percent or more of organizations are potentially compromised, real-time detection of threat actors is essential.
- Rapid response. Today is ‘It’s not if, but when we will be breached.’ If an organization cannot respond to an attack and penetration with effective countermeasures, all of the other information security measures, funding, planning and effort, will be undone.
If you have questions about how you can protect your organization, call ITPAC today for a free consultation.