Healthcare systems have been under constant attack in recent months, with threat groups demanding top-dollar ransoms in the aftermath of successful, high-profile breaches. Think United Healthcare, Kaiser Permanente, Cherry Health … the list grows every month.
Security teams must contend with a wide range of attack vectors, including HVAC systems, medical devices and even Xboxes provided for pediatric wards. In some ways, it can feel like hospitals and other healthcare centers are sitting ducks.
Healthcare Under Siege: Attack Vectors Abound
The healthcare industry faces a tough challenge in securing its expansive attack surface. In our latest State of Vulnerabilities report, we found that a healthcare company’s average digital footprint includes nearly 5,500 subdomains and over 3,000 combined web apps and associated IP addresses.
Managing this abundance of public-facing assets is made all the more complicated by the need to balance the availability of patient-centric services such as online scheduling tools with the security of the systems that enable those services. Every second in an emergency room is vital; downtime simply is not an option.
Mapping IT Assets and Infrastructure
Mapping IT assets and infrastructure is a significant hurdle for security teams. According to a recent Enterprise Strategy Group survey, 50% of respondents find managing their attack surface more challenging than a year ago due to increasing network complexity. Additionally, 58% say detecting vulnerabilities is becoming more difficult as organizations struggle to keep up with open vulnerabilities.
Healthcare’s Impressive Vulnerability Remediation
Despite these challenges, healthcare organizations have made significant strides in vulnerability remediation. On average, Synack healthcare clients have reduced the time to remediation of critical vulnerabilities by 14 days, and the remediation time for high-severity vulnerabilities has decreased by an impressive 45 days.
Vulnerability Landscape in Healthcare
In 2022, critical vulnerabilities accounted for 10.1% of all healthcare vulnerabilities found, and high-severity vulnerabilities represented 21.3%. In 2023, the distribution of critical vulnerabilities jumped to 21.3%, while high-severity vulnerabilities remained steady at 19.4%.
The healthcare industry’s vast attack surface and the increasing sophistication of threat actors necessitate robust cybersecurity measures. By leveraging advanced threat detection and automated remediation solutions, healthcare organizations can strengthen their defenses and protect patient data from unauthorized access and exploitation.
To learn more about how other industries are holding up on the cyber front, check out the 2024 State of Vulnerabilities.
