It’s not uncommon for large healthcare organizations to support patients via thousands of systems––servers, network hardware, and Internet of Things (IoT) devices particular to the medical practice. Healthcare organizations are primary targets for attackers and are required to follow strict regulations to stop data breaches. HIPAA violations are costly, and unpatched hardware leaves healthcare systems vulnerable to numerous threats including malware, ransomware, security bypasses, and possible remote code execution. Patching systems with the latest update is critical to data protection and risk management, and it keeps the company compliant with HIPAA guidelines.
Almost every business stores data that’s valuable to third-parties, but healthcare organizations store full patient identities including their financial data. The volumes of personally identifiable information (PII) and their large attack surface make healthcare companies an attractive target.
Healthcare faces three main risks:
To avoid threats against your large attack surface, administrators need to scan the environment for unpatched software and firmware. The first step is to audit the environment so that you can account for every device and system on the network. Shadow IT, which are unknown devices on the network, leave the environment vulnerable to exploits when administrators don’t know that they exist and don’t update them.
After auditing the environment, an automated scan can find devices with outdated software. Agents can be installed on a server to report unpatched software, but some scanners scan open ports too. This step is automated and can use artificial intelligence to help with accuracy. Scanners report to a central server where administrators can review devices with outdated software and create a plan to patch them.
The last step is the biggest challenge. Patching must be done across numerous devices, but these devices can’t always be shut down. Some operating systems can be ‘hot patched,’ meaning patches can be installed without rebooting the machine, but this method requires specialized patching software.
Another issue is the concern around bugs or flaws that may embedded in patch code, which is typically written under considerable pressure. Enterprise organizations test patches on a small non-critical system before deploying to all devices. The strategies you choose depend on the devices located on the network, your attack surface, and operating systems. Several deployment automation and orchestration applications help with this step, but you should still test on non-critical machines.
The issue of unpatched software came to a head in 2018 when the Office for Civil Rights (OCR) released a newsletter explaining the importance of patching software. OCR warned healthcare administrators that vulnerabilities could exist in unpatched databases, electronic health records (EHRs), operating systems, and IoT firmware. The OCR advice comes after numerous data breaches from unpatched software across large attack surfaces common in hospitals, doctor offices, and other healthcare organizations.
HIPAA requires organizations to identify flaws in their software, and patch management is a requirement of 45 C.F.R. § 164.308(a)(5)(ii)(B). Violations not only carry hefty fines, but lead to long-term litigation and brand damage. HIPAA requires that healthcare organizations have a complete audit of their digital environment with strategies to patch operating systems, software, and firmware.
To help make patching comprehensive, artificial intelligence (AI) can be used to detect and deploy updates. Instead of asking an administrator to manually install patches, AI scans and automatically remediates unpatched software. You may still want to manually patch critical hardware like servers or firewalls, but AI reduces the overhead of updating user devices and non-critical IoT.
Many of today’s AI scans and patch remediation systems also perform validation on the updates. If an update fails or a device cannot be accessed, an alert is sent to an administrator. Automation isn’t the answer to every patching problem, but it can remediate the low-level systems that would otherwise require administrator attention. By reducing this overhead, administrators can focus their attention on tending to critical systems.
Safeguarding protected healthcare information (PHI) and PII is likely your top priority, and having a patch management plan helps with your efforts. Instead of leaving your data and network environment open to exploits, use automation to scan and remediate outdated software. IoT is a primary target for threats, but patching their firmware greatly reduces risks of a data breach.
If you haven’t built a patch management system into your regular IT process, talk to one of our experts to evaluate your current environment and make suggestions on appropriate next steps.
Let us help you secure your healthcare environment.
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
