A Tempting Target for Cyber Adversaries
Healthcare IT teams carry out the critical task of protecting hospital systems and medical facilities from cyberattack, but they face many hurdles to hardening their sprawling attack surface. Hosting a bevy of sensitive customer patient data and medical Internet of Things devices, the healthcare sector is an ideal target for adversaries, particularly for ransomware attacks.
According to a 2022 report from Sophos, ransomware hit 66% of healthcare organizations in 2022. It also revealed that 61% of respondents with encrypted data were willing to pay the ransom, compared to 46% across other sectors.
These statistics show the importance of a continuous vulnerability management strategy that closes cybersecurity gaps and segments systems to thwart ransomware attacks.
Why Pentesting is Critical for Healthcare
A single vulnerability at any layer in the attack surface can lead to leaking sensitive patient information, or worse, disruption of healthcare services. Utilizing both a zero-trust strategy and continuous offensive security testing can minimize or prevent a cyberattack.
Security testing in a healthcare setting should have breadth and depth that traditional penetration testing can’t deliver. Conducting a point-in-time pentest with only a few security researchers won’t work in today’s dynamic IT environment. The same web applications and medical devices that help streamline and improve patient care can jeopardize the larger network they’re connected to.
For example, application program interfaces (API), which allow devices and computer programs to communicate data back-and-forth, are an emerging threat vector across all industries. In a healthcare setting, an API-related vulnerability could introduce ransomware or another type of attack that halts patient care and costs the organization millions.
Pentesting for HIPAA Compliance and Beyond
As part of HIPAA’s requirements, organizations are required to implement best practice security controls like the designation of a security official, articulation of who can access confidential protected health information (PHI) and more. HIPAA does not deliberately call out penetration testing. However, it does call out the need to identify risks to PHI. Conducting routine pentesting can help organizations identify and reduce risk to patient data.
An organization may follow HIPAA to the letter and even perform regular vulnerability scans of the attack surface, but a vulnerability either undetected or lost amongst thousands of other, less critical vulnerabilities still poses a threat. An API call revealing PHI to anyone using the right query won’t be caught, unless web applications are combed through by skilled security researchers.
Preventing Future Vulnerabilities with Strategic Pentesting
Pentesting is not only for finding current vulnerabilities. A strategic pentesting program will help you identify trends and root causes, so you can prevent future vulnerabilities from entering the network. This doesn’t include predicting when the next zero day will cause havoc, but instead analyzing Synack data for remediation time, CVSS scores on vulnerabilities found, vulnerability class and where they were found within the network.
Synack offers testing for web, mobile and cloud applications, targeted API pentesting, and host and internal infrastructure testing. Tests are performed by a community of 1,500+ expert security researchers from around the globe, the Synack Red Team (SRT). SRT members specialize in a variety of skills, ensuring that you have a diversity of perspectives that truly matches that of the adversary.
The healthcare industry can change the way vulnerability management is conducted by adopting a strategic approach to strengthen security posture. Read more about the strategic security journey in our latest white paper.
