Nitya Ravi, CPI Media Group, spoke to Bernard Montel, EMEA Technical director and Cybersecurity Strategist at Tenable, throws light on the different types of cybersecurity threats faced by organisations post pandemic and the reason it has affected healthcare the most.
“Fast paced digital transformation has bought about its own security risks. At present, we mostly see three main threats. Number one is due to remote working. We all know that remote workers are here to stay. Companies won’t go back to operating the way they did two years back before the pandemic. Certainly, people are willing to go back to office but the fact that they were using remote working capacity will continue and this is clearly a threat because a home network is not secure. A home network has plenty of devices, roughly about eight devices connected at a time which includes corporate devices as well but not only so this a vulnerability that can be easily targeted by attackers”, says Montel
“The second is attack against critical infrastructure. In EMEA, they are the main targets for cyber criminals and the trend is very high. In Europe, Middle East, and Africa, almost 45 percent of attacks are ransomware attacks which is the top threat right now against critical infrastructure. Third is due to cloud adoption. Because of the huge amount of people working from home, we needed to launch new cloud services to ensure continuity and we had to do this in like a couple of weeks. Now cloud adoption is something we have been talking about for the past 10 years but rapid cloud adoption was bought about by the pandemic and we have attackers who are now willing to target the cloud provider rather than targeting a particular company. Why so? Because if they target a cloud provider, they can hit hundreds of companies so the effort is the same but it will have a domino effect that will affect hundreds of companies at a time”.
Montel goes on to talk about how critical infrastructures like healthcare are easy targets for attackers looking to make quick monetary benefits, “In EMEA, the top three sectors are education, government, and healthcare. Of these, healthcare is the number one sector which is vulnerable to attacks. Hospitals have not been designed to beat cyber security threats. Their main mission has always been to save people. During the COVID-19 pandemic, they were under fire to save people’s lives leaving them vulnerable to cyber-attacks. We must bear in mind that the nature of healthcare data is unique. If you have data breach for intellectual property, the data can have a new version, it can be changed and hence it won’t be sensitive data anymore. Same goes for financial data. However, in case of data related to human beings, the data will always be unique. For example, you cannot change your disease, your date of birth or your social security number. You can’t have a version 2 of the history of your diseases! So, when this type of data is out, it is considered highly sensitive and because of that its highly monetised by attackers. Majority of them are ransomware attacks. I would say about 98 percent of the attacks are ransomware attacks and majority of any sort of attack focuses on vulnerabilities. They penetrate the network using these vulnerabilities which have been there for many years because hospitals, like I mentioned before, have not been designed for cybersecurity but for saving lives. They use technology mainly for medical purposes and thus are prone to be easy targets for an attack”.
“My advice to companies looking to improve their security posture is to prioritise. There are hundreds of vulnerabilities that come up every day. You cannot patch up all of them. There should be an approach based on risk. If we are to talk about business risk, we must consider which are the technologies that are business critical be it on-prem or on cloud; if there are any vulnerabilities, this is where the effort must go for patching. Also keep in mind specific software’s that might have access to active directory and admin rights. These are very sensitive and must be taken care of. Another step is detecting vulnerabilities in cloud applications. When we move to the cloud, we move to native cloud applications that are designed and coded directly with containers and Kubernetes and that type of technology. If we fail to check for vulnerabilities in the code when the applications are being developed, it will be too late. We must thus shift left and detect vulnerabilities in the code itself which will ensure huge benefits later”, added Montel.
