S C R U B B I N G U P factor authentication , single sign-on or rolebased access that are essential for preventing unauthorised access to digital assets .
Finally , threat actors are constantly on the lookout for low-hanging fruit and will scan systems for unpatched software and hardware vulnerabilities that can be exploited to infiltrate and undertake a breach . Increasingly , they are also undertaking supply chain attacks which involve exploiting vulnerabilities in third-party tools that are used daily by organisations worldwide . For example , in June of last year , Health Service Ireland ( HSE ) became a victim of a cyberattack launched via the MOVEit file transfer tool .
The need for cyber-resilience is growing
The enduring and growing threat of cyberattacks is highlighted in news stories on a daily basis . In June , a ransomware attack on the University of Manchester affected an NHS patient data set holding information on 1.1 million patients across 200 hospitals .
Meanwhile , in July the Barts Health NHS Trust , which serves more than 2.5 million patients , confirmed it was investigating a ransomware incident perpetrated by the BlackCat ransomware gang which claimed to have stolen 70 terabytes of sensitive data . More recently , it was revealed that historic data leaks at the Cambridge University Hospitals NHS Foundation Trust had exposed the sensitive data of more than 22,000 patients .
To overcome the challenges posed by legacy technologies , NHS organisations will need to take some key steps to foster the cyber-resilience that is needed . At a minimum , this includes :
• Implementing strict access controls that limit data access and reduce the likelihood of success from cyberthreats .
• Regularly training all staff on the importance of setting strong passwords , keeping devices locked when not in use and being aware of phishing and email scams .
• Keeping software and systems updated and diligently rolling out security patches to address known vulnerabilities .
• Securing mobile devices with strong authentication and encryption .
• Undertaking regular risk reviews to identify critical areas to address . This should include understanding who accesses systems , how systems are secured and how patient data is stored and encrypted .
• Initiating a cybersecurity mindset that considers systems , software and tooling .
• Ensuring that the policies and workflows between security and IT functions are aligned and that a clear incident response plan is in place .
By implementing some pragmatic measures , NHS organisations can start to shift how they thwart cyberattackers and overcome their legacy technology dilemma . By addressing issues like cybersecurity , communication and data storage with a view to moving as close as possible to future-proofing their environments , they will be able to gain a holistic view of their operations and be better prepared to identify and mitigate risk . �
Randeep Gill , Principle Security Strategist at Exabeam
www . intelligenthealth . tech 69