YANGON, Myanmar -- There is an urgent need for the healthcare sector to boost its cyber-defense capabilities as it is among the industries on the list of top targets of hackers-for-hire, an international cyber security firm said on Thursday.
“With the healthcare sector a bit lagging in terms of their cyber security capabilities, we observe that hacking groups are now off to exploit this fact by adding medical information and hospital attacks to their services list publicly available on the dark web,” Kaspersky security researcher Seongsu Park, said in a statement at the Cyber Security Weekend here.
He noted that medical records can be considered more valuable than a simple credit card because hospitals generally require a patient’s personal and financial credentials before a check-up or an admission.
“Based on the indications and patterns we have seen and are still seeing on the dark web, the main purpose of the individuals behind these hacking groups is to sell the medical information to another crime group or to any individual who aims to access confidential medical data,” Park said.
Motives of the buyers can include call scams, identity and monetary theft, as well as blackmailing and any derived crimes.
Such malicious actions are possible with the amount of records and confidential data hacking-for-hire groups can illegally harvest from the affected health institutions.
When it comes to the possible customer profiles, the nature of the dark web being anonymous opens the possibility that it could be anyone – from a new hacker, to an enterprise, or even a nation-backed cyber-espionage group.
Securing hospital loopholes
The current threats posed against the healthcare sector show how more and more malicious actors are targeting the industry.
To be able to help protect these organizations and their patients, Kaspersky identified the possible security loopholes and how to build their defenses.
For instance, exposed vulnerable servers and patient records are often a result of misconfiguration or unconcern.
Kaspersky suggests healthcare organizations to identify the important data they are storing and to figure out how they can protect them through strengthening cyber security education for the workforce.
This, according to the company, can be done through a series of security awareness training, which in particular explains 'do's and dont's' and the signs of a cyber security-related incident.
Another potential target of cyber-attacks are complex and ultra-connected medical devices that have diverse and complex functions.
Hospital and healthcare organizations, Kaspersky said, should conduct an assessment on these devices and networks to review the access policies and the exposure of the devices to the internet.
It added that basic rules, such as keeping all software up to date and the implementation of strong password policy for devices connected to the web, must be enforced.
For an added layer of security, it is suggested to employ real-time and in-depth threat intelligence as well as holistic cyber-security solutions into a medical organization’s IT infrastructure. (PNA)
