CynergisTek, (NYSE American: CTEK), a leading cybersecurity firm helping more than 1,000 hospitals navigate emerging security and privacy issues, released its fourth annual report, "Maturity Paradox: New World, New Threats, New Focus," which revealed that most hospitals critically lack the ability to secure their supply chain systems.
In this report, CynergisTek reviewed just under 100 assessments of healthcare providers across the continuum, including hospitals, physician practices, Accountable Care Organizations (ACOs), and Business Associates. These assessments measure organizations' security posture against the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF), a standardized framework first published in 2014 intended to help protect American critical infrastructure.
Assessments were categorized into two cohorts: high performers with NIST conformance scores over 80% and low performers with conformance scores under 80%. CynergisTek's 2021 report focuses on the industry's overall status in cybersecurity preparedness, with 64% of organizations below 80% conformance. The report identified several areas for continued improvement in planning and preparedness, especially seeing as only 75% improved during the coronavirus pandemic ? even then only slightly. While that is progress, it isn't the progress the industry needs to shore up defenses. Investing in security, in the long run, is often ultimately more cost effective than paying the recent exorbitant ransoms.
"The past year has been arguably the most trying on the U.S. and global healthcare systems. We saw cybercriminals attack hospitals and healthcare institutions when they were at their most vulnerable ? the industry made it through, granted with some bumps and bruises," said David Finn, EVP at CynergisTek. "It is the responsibility now ? of stakeholders, C-suite, IT managers, and anyone involved in protecting our healthcare system ? to ensure that patient care remains resilient even in an environment with growing cyberattacks. The report demonstrates there is work to be done, but there are also immediate opportunities to shore up risk management practices."
Supply Chain Proves Biggest Health System Weakness
Overall, Supply Chain Management was the second lowest-scoring and least mature category assessed. Even among high-performing organizations that have significantly improved over the past four years, scores averaged 2.7 out of 5, reflecting a universal challenge that companies face in identifying and addressing risks across their supply chains. With an acceptable score above a 3, only 23% of organizations passed on supply chain security ? and barely ? not even high performers achieved above a 3.
In particular, CynergisTek found that organizations struggle to validate whether third-party partners are meeting contractual security obligations. Given recent attacks on these critical third parties and suppliers ? ranging from SolarWinds to Microsoft Exchange ? and given the decentralized nature of global supply chains, it is imperative for organizations to dedicate time and resources to supply chain security before risks expand exponentially.
You need to look no further than the U.S. Department of Defense (DoD) for where the industry may head next from here. The DoD has mandated, through the Cybersecurity Maturity Model Certification (CMMC), that its suppliers demonstrate a minimum level of cyber hygiene standards. In fact, CynergisTek's Redspin subsidiary was the first organization that received approval to perform audit work to determine the cyber readiness level of contractors before they do business with the DoD. This standard is likely to soon be implemented across other industries, as well.
"It's clear that this is not the right time to cut back on cybersecurity, and that smart spending will be necessary to secure organizations against a rising tide of ransomware threats against critical infrastructure generally, and healthcare specifically. As we ride out the remainder of 2021, it's within your power to ensure that the economic impacts of the digital transformation on your organization are net positive ? assuming you make the right, proactive decisions to protect your assets, patients, and environment now," added Finn.
Treat Security as a Journey, Not a Destination
Cybersecurity preparedness is a long-term initiative that requires consistent attention and proactive action to match the latest threats. Given current trends, as well as data revealed in CynergisTek's 2021 report, healthcare organizations need to focus on the following:
About CynergisTek
CynergisTek is a top-ranked cybersecurity consulting firm helping organizations in highly regulated industries, including those in healthcare, government, and finance, navigate emerging security and privacy issues. CynergisTek combines intelligence, expertise, and a distinct methodology to validate a company's security posture and ensure the team is rehearsed, prepared, and resilient against threats. Since 2004, CynergisTek has been dedicated to hiring and retaining experts who bring real-life experience and hold advanced certifications to support and educate the industry by contributing to relevant industry associations. For more information, visit www.cynergistek.com or follow us on Twitter or Linkedin.
These press releases may also interest you
|