Threat actors are notorious for taking advantage of every opportunity, and the largest vaccine rollout in history is no exception. Attackers are finding ways to target the COVID-19 vaccine supply chain.
So says Troy Ament, Fortinet Field CISO for Healthcare, adding that healthcare and cyber security need to go hand in hand.
The healthcare sector underwent several dramatic shifts during the pandemic, including a move toward offering tele-health services on a large scale, setting up remote, temporary COVID-19 testing and vaccination sites, and large-scale development, manufacturing, and distribution of vaccines.
During all of these shifts, security teams were responsible for maintaining compliance on top of cyber security. For many organisations, this meant revamping security infrastructure to support remote users and stay one step ahead of bad actors.
Ament says although compliance requirements such as HIPAA have long been the primary drivers of healthcare cyber security strategies, other considerations are also rising to the fore.
“The threat landscape, for example, experienced significant acceleration during the pandemic and continues to grow more sophisticated. The integration of IOT, industrial IOT, and the Internet of medical things (IOMT) devices now fuel a convergence of OT and IT,” he says.
This is over and above connected medicine, tele-health, cloud migrations, and a surge in remote work, all of which have contributed to the ever-growing attack surface, Ament notes.
Capitalising on COVID-19
Exploit vulnerabilities have grown in conjunction with the rise of remote work and, like many other sectors, the healthcare industry has seen a significant increase in ransomware attacks, he says.
"Analysts with Black Book Research are even forecasting such attacks in this sector to triple in 2021. Similarly, FortiGuard Labs’ research suggests that Web browsers and IOT devices, in particular, will continue to be popular targets.”
Malefactors have also targeted the technology that facilitates vaccine rollout, such as scheduling platforms that include personal information. Attacks in this space not only lead to financial losses, but the exposure of patient information.
According to Ament, a strong security posture is critical as networks grow in complexity and volatility. While CISOs can’t always control the actions of their vendors’ vendors, they are still responsible for security, including scrutinising the supply chain’s policies and protocols.
“The first step is to develop a supply chain risk management plan that identifies and catalogs the risks across the system development life cycle, including design, manufacturing, production, distribution, acquisition, installation, operations, maintenance, and decommissioning. For each identified risk, solutions must be developed, and alternatives must be created for every link in the chain.”
The integration of networking and security strategies is crucial for security leaders in the healthcare space, he adds. To address the growing safety concerns associated with a massive surge in IOMT device usage, cloud services, and network demands, solutions such as SASE (Secure Access Service Edge) and SD-WAN are needed to enable integration and reduce complexity.
Share