How to prevent data breaches, medical device hacking, and improve cybersecurity in health care

Summary

In this AMA Update video and podcast, Todd Unger interviews Charles Aunger, Managing Director of Technology at Health2047 and CEO of HEAL Security, about the growing cybersecurity risks in healthcare. They discuss alarming trends in cyberattacks, particularly in medical devices and healthcare networks, and the importance of robust security practices. Aunger highlights common vulnerabilities, such as default passwords and outdated software, and recommends solutions like password managers, multi-factor authentication, and regular device updates. The conversation emphasizes the critical need for healthcare professionals to stay vigilant and protect patient safety in an increasingly digital world.

Takeaways

• 😀 HEAL Security focuses on cybersecurity in the healthcare industry, aiming to protect against cyber threats and provide situational threat intelligence.
• 😀 Cybersecurity incidents and vulnerabilities in healthcare are on the rise, with breaches doubling compared to the same time last year.
• 😀 Firmware and software vulnerabilities in medical devices, as well as misconfigurations like default passwords, are key security issues in healthcare.
• 😀 Default passwords (e.g., 'password' or '123456') are a significant risk factor, allowing cybercriminals easy access to sensitive systems.
• 😀 Healthcare organizations must prioritize keeping medical devices and software up to date with patches from vendors to prevent security breaches.
• 😀 The use of password managers and multi-factor authentication (MFA) can greatly improve security by creating strong, unique passwords for different systems.
• 😀 A proactive approach to securing medical devices involves contacting vendors for patches, configuring devices securely, and protecting the network with firewalls.
• 😀 Phishing attacks and USB device malware (e.g., those that can explode a device) are common threats that healthcare professionals should avoid.
• 😀 Patient safety is directly impacted by cyberattacks, especially when it comes to defrauding patients through identity theft and impersonation using stolen data.
• 😀 Healthcare providers and patients should stay vigilant and report any suspicious activity, especially if fraudulent transactions or communications occur.
• 😀 To stay informed about healthcare cybersecurity trends, HEAL Security publishes a monthly Cyber Pulse report that is available for free on their website.

Q & A

What is the primary focus of HEAL Security?

HEAL Security is focused on providing cybersecurity solutions specifically for the healthcare industry. They aim to build situational threat intelligence to protect healthcare organizations from bad actors and vulnerabilities.

How does the number of cybersecurity breaches in healthcare this year compare to last year?

The number of breaches in healthcare has more than doubled compared to last year. In the same month last year, there were 54 breaches, while this year there were 93 breaches.

What are some of the main issues identified with medical devices in healthcare organizations?

The main issues with medical devices include outdated firmware, misconfigurations, and the use of default credentials or passwords. These vulnerabilities increase the risk of cyberattacks on medical devices.

What is the risk of using default credentials in healthcare devices?

Using default credentials, such as unchanged passwords, poses a significant security risk because attackers can easily exploit these default settings to gain unauthorized access to healthcare systems and devices.

What does HEAL Security's monthly Cyber Pulse report track?

HEAL Security’s Cyber Pulse report tracks trends in cybersecurity incidents and vulnerabilities within the healthcare sector. It includes data on the growing number of breaches, vulnerabilities, and attacks.

What recommendation did Charles Aunger give regarding password management?

Charles Aunger recommends using password managers to create and store strong, unique passwords. He also advises against using the same password across different platforms and emphasizes enabling multifactor authentication wherever possible.

Why should healthcare organizations prioritize cybersecurity for medical devices?

Healthcare organizations should prioritize cybersecurity for medical devices because vulnerabilities in these devices can directly impact patient safety and privacy. Medical devices can be targets for cyberattacks, and securing them is essential to prevent harm to patients.

What is one of the malicious techniques being used with USB devices to attack healthcare systems?

One malicious technique involves using USB sticks that, when plugged into a device, release a power charge to blow up the device's motherboard, preventing access to the data that attackers were trying to steal.

What simple step can healthcare practices take to secure their networks and systems?

Healthcare practices should ensure that they have firewalls in place, that network configurations are secure, and that data leaving the building is monitored. Regularly updating medical device configurations and ensuring that default passwords are changed are also important steps.

How does phishing affect healthcare organizations and their patients?

Phishing attacks are a major threat, where attackers impersonate legitimate entities to gain access to sensitive information. This can lead to identity theft, fraud, and unauthorized access to patient data or financial resources.