Trustwave, a leading cybersecurity and managed security services provider, released comprehensive research shedding light on the distinctive cybersecurity risks encountered by the healthcare sector. The report, “Cybersecurity in the Healthcare Industry: Actionable Intelligence for an Active Threat Landscape,” explores the specific threats and risks that healthcare organizations face, along with practical insights and mitigations to strengthen their defenses.
In an era where cyber threats continue to evolve, healthcare organizations are increasingly targeted by malicious actors employing multiple attack vectors. In its new research, Trustwave SpiderLabs has documented the attack flow utilized by threat groups, shedding light on their tactics, techniques, and procedures. From phishing emails to exploiting known vulnerabilities and compromising third-party vendors, these persistent threats pose significant risks to the industry.
While the healthcare industry is not alone in facing an elevated threat landscape, the consequences of attacks in this sector can be severe, even fatal. Adversaries are highly motivated by financial gains and continuously refine their techniques to surpass existing defenses. In 2022, the average cost of a data breach in healthcare was $10.1 million, which is more than double the industry average of $4.4 million, according to data from the Ponemon Institute.
“Protecting the supply chain and maintaining business continuity are critical considerations across most industries, but healthcare cyber leaders encounter distinct challenges in safeguarding patient well-being, maintaining quality of care, and enabling healthcare professionals to leverage cutting-edge digital technologies to perform at the highest level,” said Trustwave Chief Information Security Officer Kory Daniels. “Our latest threat briefing is a valuable resource for security leaders within the healthcare sector, providing a comprehensive view of the threats observed by our SpiderLabs team, along with specific mitigation strategies to bolster defenses.”
The Trustwave SpiderLabs report analyzes threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. These methods encompass leveraging valid access credentials, exploiting unsecured credentials, and utilizing Webshells. Additionally, the report identifies specific entry points such as Apache Log4J (CVE-2021-44228) and Spring Core RCE (CVE-2022-22965) vulnerabilities, while highlighting the high activity of prominent ransomware gangs like LockBit and ALPHV/BlackCat targeting healthcare entities.
Trustwave SpiderLabs’ research serves as a resource for healthcare organizations to understand and combat the multitude of attack groups, malware variants, and techniques deployed against them. The report explores:
Emerging and Prominent Trends in the Healthcare Industry
- Artificial Intelligence and Generative AI: Unique implications and risks due to the sensitive nature of the data potentially being shared with these tools.
- Ransomware Groups Targeting Healthcare: Threat groups previously considered healthcare-related targets off limits, or protected, but are now widely attacked.
- Software Vendor and Internet of Things (IoT) Exposure: The risks associated with third-party vendors and the proliferation of Internet of Things (IoT) devices in healthcare further amplifies the potential attack surface and vulnerability of the industry’s infrastructure.
SOURCE: Businesswire