Jason G. Weiss Discusses Surge in Healthcare Cyberattacks With HealthcareInfoSecurity

HealthcareInfoSecurity shared takeaways from a Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center report, which analyzed ransomware activity in the U.S. and global healthcare sectors during the third quarter. Privacy, cybersecurity and data strategy counsel Jason G. Weiss outlined factors that make the healthcare industry a target for cyberattacks.

The healthcare industry has been slowly improving its overall cyber-defenses and security posture, “but, at times, it seems like we are always a day late and a dollar short,” said Weiss. “During my 22 years in the FBI, the mantra we tried to use was ‘action beats reaction,’ and, at this point, the healthcare industry is still in a ‘reaction’ stage, so it is hard to prevent real-time and zero-day attacks,” he explained.

Weiss noted, “Well over 50% of all cyberattacks against the healthcare start with phishing attacks.” He added, “That is where the real defenses have to start. Stop successful phishing attacks, and this will greatly slow the ransomware attacks.”

Weiss further detailed how ransomware attacks targeting healthcare organizations “are easy, effective and a real money maker for the established ransomware gangs and other criminal syndicate groups.”

For example, the ransomware-as-a-service model with affiliate franchise groups “provides step-by-step instructions on how to use their illegal software and has now exponentially expanded the attack environment against healthcare providers worldwide,” Weiss concluded.