HACKERS, HOSPITALS, AND HIGH VALUE DATA
To a cybercriminal, hospitals present a tantalizing target, with massive amounts of sensitive data and connected devices, a willingness to pay ransoms to resume patient care, and large workforces that are ill prepared to evade attacks of varying levels of sophistication. A high-value, poorly-defended target with innumerable entry points? Jackpot.
The threat is well established, but the path forward is often less so.
Core4ce’s PatchAdvisor subsidiary helps healthcare customers see their networks the way a hacker does – as a series of opportunities waiting to be exploited. Through decades of experience working with both commercial and government customers – including the National Institutes of Health and Defense Health Agency – we’ve consistently found that the issues facing the healthcare industry aren’t particularly unique, but they are immensely consequential.
THE DOMINO EFFECT
The most prevalent issues we’ve found include poor or default passwords, unpatched software, misconfigurations, and lack of network segregation. Individually, these issues are relatively straightforward, but they compound one another, leading to a domino effect where a single successful attack can quickly cascade and result in a compromise of the entire organization.
To combat security threats, healthcare providers can (and should) run automated network and application vulnerability scans, take a defense-in-depth approach to security monitoring, and establish well-defined security reviews when on-boarding new equipment and networked applications. But while these security measures are necessary, they are also incomplete – often leaving devastating vulnerabilities undetected, and the severity of potential attack paths misdiagnosed. Automated scanning tools simply cannot keep pace with the volume of emerging vulnerabilities that may be immediately exploited. Notably, our team has uncovered multiple zero-day exploits present in major commercial medical applications and devices.
EXTERNAL VALIDATION: THE MISSING LINK
Unrestricted by the limitations of commercial scanning tools, our experienced engineers work to exploit and leverage vulnerabilities on all networked systems, aiming to uncover as many attack paths as possible and following each of them to their conclusion. Our enterprise-wide vulnerability assessments validate the defenses of an organization’s cybersecurity measures, and result in a prioritized list of remediation tasks focused on immediately strengthening a hospital’s security posture.
By making external validation an essential piece of security due diligence, healthcare organizations can more confidently face today’s threat landscape, avoid preventable attacks, and make informed decisions around IT resource distribution and security protocols.
To learn more about enterprise-wide vulnerability assessments, please contact info@patchadvisor.com.
