The risk of cybersecurity in healthcare shows no sign of ceasing. One recent example is a hospital cyberattack at a Canadian healthcare entity that compromised data dating back to decades. Medical records are a preferred target for cybercriminals since they contain a wealth of sensitive data. As per reports, in 2020 alone, cyberattacks in the medical industry consisted of more than half of all previous year's patient data breaches.
The message this emphasizes is that taking measures for preventing data breaches in the medical industry is more important now than ever. A major healthcare cybersecurity challenge — the vulnerabilities of legacy systems — poses a serious threat to the entire industry.
Digital Transformation and Rising Threats
Digital transformation is of great benefit to the healthcare industry, thanks to the rise of the Internet of Things (IoT) and cloud computing. It facilitates enhanced patient engagement and operational efficiency. But the disadvantage is that it also contributes to an increasing threat for potential cyberattacks.
In certain cases, medical data has much more value to cyber attackers compared to financial data — a complete patient record can sell for many times the value of a stolen credit card on the dark web. Healthcare industry is not as fast as other industries in embracing disruptive technologies, which compounds the gap between threat sophistication and organizational readiness.
Vendor Support and Legacy Applications
One major factor that increases the vulnerability of legacy systems is the lack of support from third-party vendors. When a technology is outdated, it becomes highly difficult to find the needed support to address security concerns or apply patches.
In healthcare, vulnerable legacy applications pose a significant threat with regard to cybersecurity. This can lead to affecting mission-critical clinical applications. Doctors, nurses, and other healthcare workers need access to the most up-to-date patient information to provide maximum care — and achieving this relies on instant access to accurate and comprehensive patient data that legacy systems may not securely provide.
To address legacy application concerns, healthcare organizations can re-focus on their technological foundations. For instance, investing in cloud-based ERP systems can assist in connecting better within the healthcare organization's network. Deploying cloud-based solutions is crucial since it lets healthcare workers access important information whenever and wherever they need it — with modern security controls built in.
The Challenge of Modernization
Though the ongoing cybersecurity workforce shortage in the healthcare sector poses a challenge, the sector's reliance on legacy systems is also a substantial concern. The healthcare industry relies immensely on legacy systems to carry out critical workloads. Legacy medical devices are a big threat to security since they are difficult to patch and keep track of.
Besides, healthcare organizations may be complacent and may not wish to risk updating these devices because they are still successfully carrying out their critical services. This "if it isn't broken, don't fix it" mindset leaves organizations dangerously exposed — particularly as cybercriminals specifically target known vulnerabilities in legacy medical device firmware and software.
Mitigation Strategies for Legacy Systems
If you are in a position where you are not able to immediately eliminate legacy systems — owing to the high cost of replacement — there are interim steps you can take:
- Network Isolation: Isolate legacy systems in their own network segment to contain any breach
- Vulnerability Scanning: Perform your own vulnerability scans to detect any security issues in the legacy system
- Computer Hardening: Remove unnecessary services and applications, close unnecessary ports, and block unnecessary IP address ranges
- Security Software: Install the best available security software compatible with legacy systems
- Access Controls: Strictly limit which users and systems can communicate with legacy devices
- Monitoring: Implement enhanced monitoring and alerting for any anomalous activity on legacy system segments
- Migration Planning: Develop a phased migration plan to move data from legacy systems into newer systems with stronger security controls
Overall, it is a good practice to migrate data from legacy systems into newer systems that have stronger security controls. A well-framed plan can lead to a successful, low-risk transition that protects both patients and the organization.