Cyberattacks continue to grow as a threat to companies, but ransomware incidents declined 17 percent, according to ISACA’s State of Cybersecurity 2018 survey.

The survey, including the responses from 2,366 security leaders, outlined the types and volume of cyberattacks. It also provided recommendations for improved cybersecurity.

Findings included:

• 50 percent of security leaders have seen an increase in cyberattacks in the last year.
• 80 percent reported an attack in the next year was “likely” or “very likely.”
• Incidents of ransomware declined from 62 percent to 45 percent this year, most likely because organizations improved security following the international WannaCry and NotPetya attacks. 
• 82 percent reported a ransomware strategy in place, and 78 percent had a formal process.
• Ransomware attacks could have been displaced by cryptocurrency mining.
• The most common cyberattack vectors were phishing, malware and social engineering.
• 39 percent of respondents were not familiar or only slightly familiar with active defense strategies, and only half were actively using them.

“This is a missed opportunity for security leaders and their organizations,” said Frank Downs, director of cybersecurity at ISACA. “ISACA’s research indicates that active defense strategies are one of the most effective countermeasures to cyberattacks. A full 87 percent of those who use them indicate that they were successful.”

Recommendations included:

• Invest in talent – Organizations should invest in finding, retaining and training skilled cybersecurity professionals.
• Explore automation benefits – Organizations should consider automation-driven strategies to detect and support recovery and response efforts.
• Ensure investment in security controls – Investing in security controls against phishing, malware and social engineering would prevent these most common forms of attack.

Medicalchain, providers of blockchain technology for the secure storage and transfer of electronic health records, have signed a joint work agreement with Mayo Clinic to improve blockchain technology utilization in healthcare.

In response to growing concern with data security, Mayo Clinic has begun to experiment with blockchain. In the joint working agreement, Mayo Clinic and Medicalchain aim to explore the benefits to blockchain and apply it to all specialties of medicine.

“We are thrilled to be working with Mayo Clinic. Mayo Clinic will provide their world-class healthcare and health IT expertise, while Medicalchain will provide our knowledge of blockchain and crypto,” stated Abdullah Albeyatti, MD and CEO of Medicalchain. “Together we will work on several use cases using blockchain based electronic health records. There’s a lot of opportunity out there, and we feel this working agreement will be of benefit to all healthcare stakeholders.”

Concern over the state of cybersecurity has led to 23 percent more organizations making improvements to their security systems since last year, according to the 2018 Harvey Nash/KPMG CIO survey.

One of the largest IT surveys, the report included responses from 3,958 chief information officers (CIOs) and technology leaders from 84 countries.

“Technology disruption continues to play a significant role in today’s business environment and, while more CIOs understand the importance of implementing a digital strategy, most are still struggling with integrating digital into their core processes to address business goals,” said Denis Berry, KPMG principal and U.S. CIO Advisory leader. “What tends to hold technology leaders back is the lack of trust in relying on digital to guide decisions. This disconnect is largely due to the absence of proper talent who fully understand how the technology can drive the business strategy. Companies who can source the right skills and establish a clear digital vision will be the ones who will benefit the most from these opportunities.”

Findings included:

• 23 percent more respondents than last year reported prioritizing improvements to cybersecurity in response to the increase in threats.
• Managing operational risk and compliance has increased 12 percent among IT leaders.
• 77 percent of IT leaders are most concerned about the threat of organized cybercrime, an increase from 71 percent last year.
• 22 percent of IT leaders did not think they were well prepared for a cyberattack.
• The demand for employees with “security and resilience” skills increased 25 percent.
• 78 percent of CIOs believe their digital strategy is only moderately effective.
• 35 percent of companies reported being unable to hire or develop the employees with the digital skills they need.
• 9 percent of companies reported no clear digital vision or strategy.
• Companies with chief digital officers were twice as likely to have a pervasive digital strategy than those without one.

"Data is shaping the business world from head to toe. We see it in the urgency of right now with the need to protect data privacy and ensure data integrity. We see data shaping the future as machine learning and AI advancements push beyond data analysis into a place where IT systems are combing, learning and reacting to data with strategic solutions," said Bob Miano, President & CEO, Harvey Nash USAPAC. "With so much dependent on the protection and promise of data, the next five years will be a continued struggle to find, recruit, and retain skilled data science and analytics professionals."

The majority of physicians (94 percent) and hospital leaders (90 percent) believe mobile technology is improving patient safety and outcomes, according to a survey conducted by Black Book.

The significant majority of physicians (94 percent) and hospital leaders (90 percent) believe mobile technology improves patient safety and outcomes, according to a survey conducted by Black Book.

The survey included responses from 770 hospital-based users and 1,279 individuals in physician practices. Researchers aimed to provide an overview of cybersecurity and secure communications.

Additional findings included:

• 63 percent of respondents reported challenges with general mobile adoption strategies and enterprise technology execution.
• 85 percent of hospitals and 83 percent of physician practices are engaged with secure communication platforms between care teams, patients and families.
• 96 percent of hospitals are budgeting or investing in comprehensive communication platforms.
• 30 percent of respondents reported receiving texts that contained individually identifiable information such as patient birthdays, initials or names from unsecured sources about once a day.
• 98 percent of hospitals and 77 percent of physician practices reported using intrusion detection systems and secure emailing.

“When relying on cloud services and third-party servers to manage and route messages, end-to-end encryption that reflect HIPAA’s privacy and security requirements exchanging health data are safeguarding against breaches,” said Doug Brown, president of Black Book Market Research. “Stakeholders across the healthcare industry are in the quest of finding solutions to use comprehensive real-time data and connectivity cleverly to advance patient safety, productivity and profitability. Organizations are adopting secure text messaging platforms because texts are convenient, as well.”

Reducing end-point complexity and improving internal stakeholder alignment should be the focus of hospitals hoping to prevent cyberattacks, according to a study published May 28 in the Journal of Medical Internet Research.

Cybersecurity incidents have become an increasingly persistent threat to hospitals. Healthcare organizations have failed to prevent some of these incidents due to internal politics and regulations. In this study, researchers from the Massachusetts Institute of Technology, in Cambridge, Massachusetts, outlined a systematic and organizational perspective on evaluating the cybersecurity capabilities of hospitals. 

“This study helps healthcare leaders reduce hospital vulnerabilities by detailing the outcomes resulting from strategic decisions of cybersecurity development,” wrote first author Mohammad Jalali, MSc, PhD, and colleagues. “It also aids cybersecurity professionals in understanding the complexities of cybersecurity capability development in hospitals.”

Researchers conducted 19 interviews with chief information officers, chief information security officers and healthcare cybersecurity experts to develop a model to identify how hospitals could use improve their cybersecurity capabilities. A simulation analysis was then done to identify variables that affected the likelihood of cyberattacks.

Results showed variables such as end-point complexity and internal stakeholder alignment were significant risks. Additionally, researchers noted that low resource availability could be compensated by setting a high target level of cybersecurity when hospitals are attempting to close cybersecurity capability gaps.

To reduce end-point complexity, researchers suggested:

• Moving to cloud-hosted services when resource availability was a constraint
• Using technology to detect unauthorized devices on networks
• Maintaining firewalled networks for patients, staff, and medical devices
• Stricter policies on technology procurement

To improve internal stakeholder alignment, researchers suggested:

• Low internal stakeholder alignment decreases the effectiveness of capability development and increases the erosion of capabilities.
• Soft variables such as stakeholder alignments are often forgotten in cybersecurity management.

“To enhance cybersecurity capabilities at hospitals, the main focus of chief information officers and chief information security officers should be on reducing end point complexity and improving internal stakeholder alignment,” concluded Jalali and colleagues. “These strategies can solve cybersecurity problems more effectively than blindly pursuing more resources. Moreover, although compliance is essential, it does not equal security. Hospitals should set their target level of cybersecurity beyond the requirements of current regulations and policies.

“As of today, policies mostly address data privacy, not data security. Thus, policy makers need to introduce policies that not only raise the target level of cybersecurity capabilities but also reduce the variability in resource availability across the entire healthcare system.”

A survey conducted by cybersecurity provider Imperva has found that more than one in three healthcare organizations have experienced a cyberattack within the last year, while one in 10 have paid a ransom.

Privacy and security of patient data is being constantly put at risk in the current environment where healthcare data is valuable on the black market. With the attention of technologies like mobile apps and patient portals, healthcare organizations continue to struggle managing security of a wide range of devices. 

“Attackers understand the value of the data held by healthcare organizations, and as a result, they are quickly becoming a sweet spot for hackers looking to steal large amounts of patient records for profit,” said Terry Ray, chief technology officer at Imperva, whose survey included responses from 102 information technology professionals from the 2018 Healthcare Information and Management Systems Society (HIMSS) Conference. 

“There have been a number of incidents recently where cybercrime has impacted hospitals and left them unable to access patient data, which demonstrates the consequences of a successful attack. It is crucial that healthcare organizations take steps to protect their data. To retain patient trust, organizations must provide an excellent defense at all times.”

Key findings included:

• 77 percent of respondents were very concerned about a cybersecurity attack.
• 15 percent admitted their organization needed to improve its ability to handle a cyberattack.
• 32 percent of respondents stated ransomware as the attacks that caused the most concern.
• 51 percent of respondents were most concerned about careless users when asked about insider threats.
• 27 percent of respondents stated a lack of tools used to monitor employees and insider activities as making threats more difficult to detect.
• 32 percent considered collecting data from different security tools as the most time-consuming task when investigating insider threats.
• 26 percent of respondents didn't have a plan in place for how to respond to a cyber incident.
• 28 percent of respondents said their organization did not have a chief information security officer.

“As we’ve seen in past high-profile cases, data breaches caused by careless, malicious or compromised insiders are a very real threat,” said Ray. “However, because the user has legitimate access to enterprise data, attacks from the inside can take a long time to detect. To mitigate the risk, organizations should ask themselves where their sensitive data lies and invest in protecting it. Businesses can employ solutions based on machine learning technology to process and analyze vast amounts of data. This will help them pinpoint critical anomalies that indicate misuse of data, so they can quickly quarantine risky users to prevent any further issues.”

Black Book Market Research, a healthcare and public opinion research company, has named Fortified Health Security as the top cybersecurity service vendor in the "medical device and internet of things" category.

Black Book surveyed 2,464 cybersecurity professionals from over 680 organizations to identify vulnerabilities healthcare systems face when it came to cyberattacks. With 96 percent of information technology experts reporting hackers have exploited healthcare’s vulnerability, professionals are hoping to strengthen security.

“We know that many healthcare organizations do not have the staff, or expertise, to prepare for and address cybersecurity issues which is why we offer programs that scale from a technology-enabled service to a fully managed solution depending on the organization’s needs and infrastructure,” said Dan L. Dodson, President of Fortified Health Security. “Our Connected Medical Device & IoT Security Program is in demand by many hospitals and health systems because of the immediate positive impact it provides to their security posture and this recognition by Black Book reflects the importance of this program.”

Read more at the link below:

While organizations have made investments into data security tools, employees remain a major barrier to achieving full privacy, according to a survey commissioned by Biscom.

The survey included more than 600 American employees to gauge how organizations are protecting data. The participants included C-suite executives from more than 20 industries including healthcare, finance and information technology.

Key findings included:

• 98 percent of respondents stated their company cared about data security, and 93 percent stated the organization invests in keeping data safe.
• 95 percent of respondents reported their company provides secure information tools.
• 85 percent believed their organization has policies about sharing, delivering and stealing data, documents and information.
• 88 percent of respondents reported their organization trains employees on how to use secure methods of information sharing and delivery.
• While 78 percent of respondents agree with an organization’s security policies, 74 percent reported insecurely sharing information both internally with their colleagues and 60 percent shared with people outside of their organization.
• 60 percent of respondents admitted doing what was easiest when deciding how to send sensitive documents.
• In respondents who shared data through an insecure internal email, 62 percent sent data that included customer data, 46 percent on strategy documents or presentations, 45 percent on company business or financial data and 43 percent on regulated data.
• Of those sharing data through an external insecure email, 49 percent of respondents reported sharing data that contained highly regulated data like medical or financial information, 35 percent shared strategy documents or presentations and 29 percent shared info about intellectual property.

 “The survey’s results uncover some interesting factors that contribute to non-compliance,” said Bill Ho, CEO of Biscom. “It would surprise most companies who have made major investments in security that so many people just fall back to the easiest method, namely sending confidential messages and files through email.”

In solving a cold case involving a serial rapist and murderer who terrified Northern California for decades, police used a novel approach to track down the killer. Detectives accessed open-source genetic data to locate relatives of a person whose genetic material was collected at a crime scene.

Before arresting the Golden State Killer—believed to be responsible for at least 12 murders and 51 rapes—last week, according to Buzzfeed, authorities subpoenaed FamilyTreeDNA in March 2017 for information associated with a specific customer.

FamilyTreeDNA runs a public database that includes genetic information. With profile names and payment information associated with one account, police found what they thought was a genetic match to the potential suspect. But the elderly man from Oregon was eventually cleared.

Despite this dead end, authorities used public records for relatives of the potential Golden State Killer, eventually identifying 72-year-old former police officer Joseph DeAngelo as their primary suspect.

But what does this case mean for the millions of individuals who have taken commercially available genetic tests? Who owns and controls the information collected by companies such as 23andMe, AncestryDNA and GEDmatch?

“I would say consumers should not be worried, but they should be aware,” Robert Green, MD, MPH, a medical geneticist at Brigham and Women’s Hospital and Harvard Medical School, told Time magazine. “It’s not necessarily a reason for concern, because we haven’t seen, to my knowledge, abuses of these databases. We have seen appropriate uses by law enforcement. I think we’re all glad a serial killer was caught.”

Privacy policies for these companies often claim information will not be readily available to law enforcement—and police efforts to obtain personal data will be resisted. But companies may be compelled to share information by a court order.

“Privacy is an important good, but it’s not the only good. We have to decide as a society how we’re going to trade these things off,” Ellen Wright Clayton, a professor of health policy at Vanderbilt University, told tech site Gizmodo. “I, like many people, think it’s probably a pretty good thing that this guy got captured. Bringing people to justice is an important social cause.”

Those who submit to genetic testing, like users of Facebook have recently learned, are willingly giving up some privacy. The industry of consumer-focused genetic testing, though, is still evolving, so policies and procedures will mature over time.