{"id":12051,"date":"2022-03-07T13:56:36","date_gmt":"2022-03-07T12:56:36","guid":{"rendered":"https:\/\/www.m-q.ch\/?p=16045"},"modified":"2022-03-08T07:37:19","modified_gmt":"2022-03-08T06:37:19","slug":"cyber-sicherheit-im-gesundheitswesen-befund-diagnose-therapie","status":"publish","type":"post","link":"https:\/\/www.organisator.ch\/en\/operational-excellence\/2022-03-07\/cyber-sicherheit-im-gesundheitswesen-befund-diagnose-therapie\/","title":{"rendered":"Cyber Security in Healthcare: Findings, Diagnosis, Therapy"},"content":{"rendered":"
\"\"
The number of connected medical IoT and OT devices is growing by leaps and bounds, requiring deeper measures for greater cybersecurity. (Image: Pixabay.com)<\/figcaption><\/figure>\r\nComplex, often outdated and heterogeneous IT and technology as well as a lack of security strategy make hospitals, for example, a lucrative and blackmailable target for hackers. After all, system failure is not an option here. The data loot is just as coveted: depending on how complete the information is, medical records can cost up to $1,000 on the darknet. Only U.S. passports are even more expensive, with a unit price of $1,000 to $2,000.\r\n

Lack of cyber security: consequences of cost pressure<\/h2>\r\nIn addition, most victims in the healthcare sector are often completely unprepared. In addition to the lack of money, the main reason here is the lack of personnel, when, for example, in Germany, two employees are sometimes responsible for the entire IT administration of three different hospitals and have hardly any budget. Cost pressure is likely to increase\r\n\r\nIn addition, the demands on IT are increasing in a healthcare system that is being digitized. The current crisis and danger situation in particular show that hospitals are increasingly to be treated like critical infrastructure. In administration, the increasing requirements in terms of data protection are raising the hurdles for data security. Compliance rules must increasingly be adhered to - from the DSGVO and ISO certifications to radio guidelines for technical devices.\r\n

Symptoms<\/h2>\r\nHealthcare cybersecurity still suffers from the following symptoms:\r\n
    \r\n \t
  1. Ransomware: <\/strong>Hospitals in particular cannot sit out extortionist attacks that encrypt data or block systems if they want to continue to care for patients. Attackers will be even more aggressive in the future: On the one hand, through automated attacks on unprepared IT and, on the other, through more targeted Ransomware-as-a-Service (RaaS) attacks launched with social engineering on decision-makers in HR, administration and accounting.<\/li>\r\n \t
  2. Risks of networked devices: <\/strong>In healthcare, the number of networked medical IoT and OT devices is growing by leaps and bounds. However, this attack vector is still often neglected and networked devices are integrated into networks without the appropriate care. Hackers also know the specific risks of this hardware: they know how to find out the hard-coded passwords of most devices - and can penetrate the network through them. It is often not even possible to prevent unauthorized users from accessing the devices. Surprisingly often, devices are used that are only poorly certified. Systems with outdated, no longer supported operating systems also create new risks over time.<\/li>\r\n \t
  3. Lack of visibility of hardware: <\/strong>Many organizations do not have IT in its entirety in mind. For example, the encryption of the servers at Lukaskrankenhaus in Neuss (this cyberattack from 2016, which became public throughout Europe, resulted in damage of 900,000 euros; editor's note) was only possible because an old, invisible client had administrator rights and thus enabled the malware to spread further. In the case of IoT and OT, this danger is even more fundamental because most of these devices are not subject to access by internal IT organizations.<\/li>\r\n \t
  4. Zero-day security vulnerabilities continue to grow: <\/strong>Log4j has shown that zero-day vulnerabilities can still cause great damage and threaten countless organizations. The healthcare industry is more susceptible to such vulnerabilities, and lack of attention can lead to increased exploitation of these gaps.<\/li>\r\n<\/ol>\r\n

    Therapy proposals for more cyber security<\/strong><\/h2>\r\nIf you want to ensure the safety of the systems and the health of the patients, you should and can turn several screws:\r\n