The year 2017 is set to feature greater attacks on internet security, the broad adoption of IOT seen to be easily compromised coupled with data often held on legacy systems is likely to capture attention. Healthcare represents one of the sectors vulnerable to IoT attacks. As more and more people adopt smart wearables and mobile apps tracking fitness the bank of hackable data for cyber criminals is growing and the value of the information is increasing which makes attacking more rewarding.
According to research we sponsored earlier this year with the Ponemon Institute, within healthcare and pharmaceutical companies, an average of 30 % of outbound Web traffic is encrypted today and these organisations expect that %age to increase to 48 % over the next 12 months. Indeed, healthcare organisations have been taking a multipronged approach, using a combination of people, policies and technical controls to combat cyberattack and protect information, with encryption being considered as a best practice for protecting the electronic medical records (EMR) and personal health information (PHI) of patients.
Stored data within many institutions includes individual’s blood type, medications, treatments, lab test results as well as financial data including bank details, credit card and insurance information – which can be regarded as a treasure trove for criminals. This data on the black market; according to data analyst, Aberdeen Group, can fetch around ?400 per record. This represents five hundred times more than a credit card number itself. With valuable information like this at the fingertips of cyber criminals, both patients and healthcare organisations stand to pay a high price.
Encryption ensures sensitive data remains private when it’s transmitted, preventing unauthorised users from viewing it, even when intercepted. Secure socket layer/Transport layer security (SSL/TLS) is now the most common encryption standard used to protect information as it traverses the internet. Most importantly SSL/TLS establishes an encrypted link between web servers and browsers to keep the information passed between the two private.
But here is where the problems lie, many established security solutions were implemented prior to the widespread use of SSL/TLS and therefore are unable to inspect encrypted traffic. Whilst great at protecting privacy data, SSL/TLS encryption can also be used to hide malicious activity from detection.
Despite the fact that sectors will more likely be taking far harsher cyber security precautions which will ward off lethal attacks, the growing proliferation of cheap, connected Internet of Things (IoT) devices such as fitness wearables will provide an easy gateway for criminals to illegally access critical information and personal data.
The bottom line is that most healthcare organisations simply do not have the capabilities they need to mitigate the risks potentially hiding in encrypted traffic. Going back to our research, according to the Ponemon study, 41 % of healthcare and pharmaceutical respondents felt their current security investment was ineffective because of outbound/inbound encrypted traffic; 68 % agreed the inability of their organisation’s current security infrastructure to inspect encrypted traffic compromises their ability to meet existing and future compliance requirements.
Furthermore, 92 % of healthcare and pharmaceutical organisations recognise that inspection of SSL traffic is “Important” to “Essential” to their organisation’s overall security infrastructure, only 39 % decrypt Web traffic to detect attacks, intrusions and malware.
Due to the vulnerabilities in the industry, it appears that the healthcare sector will take the brunt of these kinds of digital attacks this year. But criminals can be deterred if the sector employs more persistent authentication to make entry far more difficult. This can be achieved by adding contextual authentication through strong digital identity; for example, through adding presence, geo-location and or persistent authentication.
