This article first appeared in Digital Edge, The Edge Malaysia Weekly on September 23, 2024 - September 29, 2024

Cybercriminals continue to target healthcare services, which can cripple critical infrastructure and services. In 2024, Cybersecurity Malaysia reported 2,518 security incidents including spam, fraud, malicious attempts and intrusion, among many others. A cybersecurity report by the National ICT Association of Malaysia (Pikom) found that “almost 70% of companies were victims of cyber breaches in the past three years”.

Minister of Digital Gobind Singh Deo in a keynote address on June 4 said, “Our cybersecurity efforts must be robust. Adopting strong cybersecurity measures will safeguard personal data and ensure the reliability of public services that are dependent on digital technologies.”

Owing to the rapid evolution of cyberattacks, the improved connectivity of medical infrastructure and valuable patient data in the healthcare industry continues to face unique challenges in the fight against cyberattacks. Phishing, ransomware, data breaches, insider threats, supply chain attacks and regulatory compliance challenges, among others, are threats faced by the healthcare sector.

Private patient information that health service providers hold can be extremely lucrative for cyber attackers. While financial information such as credit card numbers may change, personal health information (PHI) usually remains the same throughout an individual’s lifespan.

As healthcare tends to be an intense field, many employees find themselves pressed for time and ill-prepared to fully understand the risks they face from potential attacks. Here are some of the most common threats that organisations and individuals working in healthcare should be aware of:

There is no question that ransomware has been a serious threat to Malaysian businesses in recent years. News from the Ministry of Communication states that what makes ransomware so dangerous is that once it gains access to your systems, it renders critical data inaccessible without the correct key. The repercussions of ransomware attacks in healthcare extend far beyond financial losses. These attacks cut off access to medical records, jeopardising patient safety and eroding public trust.

Ransomware attacks often start with threat actors gaining access to data and then encrypting it. By holding data hostage, cybercriminals could extort money from organisations by demanding payment to restore the stolen data. Investing in strong data encryption and backup solutions will cost a fraction of what is typically demanded from criminals and it will also help the organisation steer clear of hits to its brand reputation.

The Centre for Internet Security (CIS) discovered that selling PHI on the black market is more lucrative than selling credit card details. On the black market, a single PHI record typically costs US$355 (RM1,539.84). To put things in context, the average cost of credit card information stands at a meagre US$1 to $2, says CIS.

The stakes are also considerably higher for the healthcare industry, where a breach on non-healthcare-related agencies costs an average of US$158.

Therefore, healthcare service providers must arm themselves with solutions that can fend off both external and internal threats.

Protecting patient medical records relies on protecting them from the inside out. That can only be achieved by restricting who can access them to a particular set of users, including employees and authorised third parties.

This ensures that sensitive personally identifiable information (PII) is secured from prying eyes, whether they be cybercriminals or employees of the organisation who are not directly involved in the use of that data.

MRI machines, patient monitoring tools, workstations, operating systems, peripheral devices and computers are all connected by a healthcare network. Although the quality of patient healthcare has seen tremendous improvement, this network of connected devices also increases the attack surface.

Using a combination of firewalls, intrusion prevention systems and vulnerability detection and remediation tools can mitigate these risks. Implementing endpoint security systems protects sensitive patient information and apps while automatically and swiftly addressing cybersecurity threats.

In the case of phishing, humans are often the weakest link that gets exploited by the prying eyes of cybercriminals.

Attackers often use social engineering techniques by tricking people into disclosing sensitive information. Preventing phishing attempts requires training medical staff, setting up privileged access and implementing multi-factor authentication (MFA) to fight against potential phishing attempts.

Healthcare providers occasionally store patient records on public-facing servers, which makes them easily accessible to anyone with an internet connection.

Compliance mandates such as Malaysia’s Cyber Security Act 2024 aim to improve and protect the cybersecurity environment and also introduce requirements for entities to comply with specific standards, measures and processes when handling cybersecurity incidents.

As healthcare organisations are becoming increasingly reliant on IT, it is important to keep in mind that many of the tools that these organisations use were not devloped with security in mind.

While digital transformation has no doubt brought innovation and efficiency, these benefits will be in vain without a carefully considered approach to an organisation’s overall security practices.

Karthick ChandraSekar is associate director of ManageEngine, an enterprise IT management product and solutions provider

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.