CyberMDX11.12.21
CyberMDX, a cybersecurity provider dedicated to protecting IoT and medical devices for health delivery worldwide, has released the Perspectives in Healthcare Security. The report, prepared in collaboration with Philips, examines attitudes, concerns, and impacts on medical device security as well as cybersecurity across large and midsize healthcare delivery organizations. Insights include how they correlate and diverge.
Healthcare is one of the most targeted industries. A recent report from HHS cited a total of 82 ransomware incidents worldwide (through mid-August), with 60 percent of them impacting the United States health sector. Attacks from notorious gangs such as REvil or Conti contribute to the impact where hospitals now account for 30 percent of all large data breaches and at an estimated cost of $21 billion in 2020 alone.
“With new threat vectors emerging every day, healthcare organizations are facing an unprecedented level of challenges to their security,” said Azi Cohen, CEO of CyberMDX. “Hospitals have a lot at stake—from revenue loss, to reputational damage, and most importantly patient safety. Our new report provides a critical look into the current state of medical device security and will help raise awareness of key issues and disconnects healthcare organizations are facing with their cybersecurity.”
The study, conducted by global market research leader Ipsos, surveyed 130 hospital executives in Information Technology (IT) and Information Security (IS) roles, as well BioMed technicians and engineers. The respondents, who averaged 15 years of experience in their fields, provided insight into the current state of medical device security within hospitals as well as highlighted the challenges their organizations face.
Key Findings:
“No matter the size, hospitals need to know about their security vulnerabilities,” said Maarten Bodlaender, head of Cyber Security Services at Philips. “Proper cybersecurity begins with a clear understanding of the evolving landscape, and this survey is part of our ongoing efforts to provide insight into cybersecurity needs across healthcare organizations.”
The report is a continuation of the partnership between Philips and CyberMDX announced in November 2020 and represents their joint commitment to provide solutions to protect connected medical systems and devices.
CyberMDX is an IoT security leader dedicated to protecting the quality care of health delivery worldwide. CyberMDX provides cloud-based cybersecurity solutions that support the advancement of the Internet of Medical Things. The CyberMDX solution identifies endpoints and assesses vulnerabilities to detect, respond to, and prevent cyber incidents. Deployed worldwide, CyberMDX is designed to integrate with our customers’ existing environments through its scalable, easy-to-deploy and agentless solution.
Healthcare is one of the most targeted industries. A recent report from HHS cited a total of 82 ransomware incidents worldwide (through mid-August), with 60 percent of them impacting the United States health sector. Attacks from notorious gangs such as REvil or Conti contribute to the impact where hospitals now account for 30 percent of all large data breaches and at an estimated cost of $21 billion in 2020 alone.
“With new threat vectors emerging every day, healthcare organizations are facing an unprecedented level of challenges to their security,” said Azi Cohen, CEO of CyberMDX. “Hospitals have a lot at stake—from revenue loss, to reputational damage, and most importantly patient safety. Our new report provides a critical look into the current state of medical device security and will help raise awareness of key issues and disconnects healthcare organizations are facing with their cybersecurity.”
The study, conducted by global market research leader Ipsos, surveyed 130 hospital executives in Information Technology (IT) and Information Security (IS) roles, as well BioMed technicians and engineers. The respondents, who averaged 15 years of experience in their fields, provided insight into the current state of medical device security within hospitals as well as highlighted the challenges their organizations face.
Key Findings:
- Ransomware is attacking the bottom line: Forty-eight percent of hospital executives reported either a forced or proactive shutdown in the first eight months of 2021 as a result of external attacks or queries.
- Midsize hospitals feeling more pain: Of respondents that experienced a shutdown due to external factors, large hospitals reported an average shutdown time of 6.2 hours at a cost of $21,500 per hour while midsize hospitals averaged nearly 10 hours at more than double the cost or $45,700 per hour.
- Cybersecurity investment not a high priority: Despite continuing cyber-attacks against healthcare and roughly half of respondents experiencing an externally motivated shutdown in the first eight months this year, more than 60 percent of hospital IT teams have “other” spending priorities and less than 11 percent say cybersecurity is a high priority spend.
- Dangerous vulnerabilities persist: When asked about common vulnerabilities such as BlueKeep, WannaCry and NotPetya, the majority of respondents said their hospitals were unprotected. Fifty-two percent of respondents admitted their hospitals were not protected against the Bluekeep vulnerability, and that number increased 64 percent for WannaCry and 75 percent for NotPetya.
- Lack of automation creates gaps in security: Sixty-five percent of IT teams in hospitals rely on manual methods for inventory calculations with 7 percent still in full manual mode. In addition, 15 percent of respondents from midsize hospitals and 13 percent from large hospitals admitted they have no way to determine the number of active or inactive devices within their networks.
- Is there a Staffing Disconnect? While two-thirds of IT teams believe they are adequately staffed for cybersecurity, more than half of Biomed teams believe more staff is needed. Conversely, the industry has been experiencing a cybersecurity talent shortage and 100-plus-day lag to fill jobs.
- Cyber insurance and compliance are popular options: Fifty-eight percent of IT teams consider compliance “almost always” and rate it a high impact on their jobs. Similarly, 58 percent also said they had cyber insurance.
“No matter the size, hospitals need to know about their security vulnerabilities,” said Maarten Bodlaender, head of Cyber Security Services at Philips. “Proper cybersecurity begins with a clear understanding of the evolving landscape, and this survey is part of our ongoing efforts to provide insight into cybersecurity needs across healthcare organizations.”
The report is a continuation of the partnership between Philips and CyberMDX announced in November 2020 and represents their joint commitment to provide solutions to protect connected medical systems and devices.
CyberMDX is an IoT security leader dedicated to protecting the quality care of health delivery worldwide. CyberMDX provides cloud-based cybersecurity solutions that support the advancement of the Internet of Medical Things. The CyberMDX solution identifies endpoints and assesses vulnerabilities to detect, respond to, and prevent cyber incidents. Deployed worldwide, CyberMDX is designed to integrate with our customers’ existing environments through its scalable, easy-to-deploy and agentless solution.