Healthcare Cybersecurity Research Articles

Teaching business leadership skills to professionals in healthcare cybersecurity, biodefense and biotechnology through experiential learning methods

The COVID-19 pandemic has not only reshaped the global economic landscape but also underscored the critical need for strategic leadership and management skills in organizations spanning diverse sectors. This paper delves into the compelling imperative of nurturing strategic leadership and management competencies among technical experts, with a particular focus on pivotal fields such as biodefense, healthcare cybersecurity, biotechnology, and healthcare operations management. It asserts that the post-COVID-19 era necessitates a profound shift in organizational priorities, urging a renewed commitment to fostering comprehensive leadership capabilities alongside technical proficiency within graduate and degree completion programs. To meet this imperative, the paper advocates for the adoption of innovative and student-centric pedagogical approaches. In today’s dynamic landscape, traditional methods fall short in preparing technical managers for the multifaceted challenges they face. Instead, the paper champions the utilization of experiential learning approaches, such as activity-based learning, problem-based learning, design thinking, and Learn-Teach-Do. These approaches go beyond theory, immersing students in collaborative, reflective, and integrative experiences that simulate real-world scenarios, thus equipping them with the leadership acumen needed to excel in technical healthcare roles.

Safe and sound: Strengthening cybersecurity in healthcare through robust staff educational programs.

This article emphasizes the importance of comprehensive cybersecurity education programs in the healthcare industry. The rapid development of technology in healthcare has brought numerous advantages, including electronic health records and telehealth services. However, these advancements also expose the healthcare industry to significant cybersecurity risks. The healthcare industry is an attractive target for cybercriminals due to the presence of sensitive personal and financial information. Current regulations, such as HIPAA and PIPEDA, are in place to protect patient information, but 95% of healthcare industry breaches result from human error. Healthcare organizations must prioritize robust cybersecurity measures and implement comprehensive education programs for all healthcare professionals. This article recommends tailoring educational content to different healthcare roles and incorporating ongoing learning and awareness as essential elements of cybersecurity education. Overall, it calls for a holistic approach to cybersecurity education in healthcare to protect patient information and mitigate cyberthreats.

A cybersecurity odyssey: Between Scylla and Charybdis.

The COVID-19 pandemic has challenged the healthcare sector. In the face of waxing and waning caseloads, staff shortages, and supply chain issues, the topic of cybersecurity has often struggled for its time in the limelight. Behind the scenes, however, cybersecurity leaders and staff are burning out at a panicking rate. A dire shortage of skilled professionals continues to compound, as global affairs and an increase in the availability of information threatens leaves healthcare cybersecurity teams barely able to keep afloat. This article describes the nature and scale of the health and human resource challenges currently faced by healthcare organizations and offers several practical options for health leaders to plot a course to attract and retain staff during this period of upheaval.

Insights From a Clinically Orientated Workshop on Health Care Cybersecurity and Medical Technology: Observational Study and Thematic Analysis.

Health care professionals receive little training on the digital technologies that their patients rely on. Consequently, practitioners may face significant barriers when providing care to patients experiencing digitally mediated harms (eg, medical device failures and cybersecurity exploits). Here, we explore the impact of technological failures in clinical terms. Our study explored the key challenges faced by frontline health care workers during digital events, identified gaps in clinical training and guidance, and proposes a set of recommendations for improving digital clinical practice. A qualitative study involving a 1-day workshop of 52 participants, internationally attended, with multistakeholder participation. Participants engaged in table-top exercises and group discussions focused on medical scenarios complicated by technology (eg, malfunctioning ventilators and malicious hacks on health care apps). Extensive notes from 5 scribes were retrospectively analyzed and a thematic analysis was performed to extract and synthesize data. Clinicians reported novel forms of harm related to technology (eg, geofencing in domestic violence and errors related to interconnected fetal monitoring systems) and barriers impeding adverse event reporting (eg, time constraints and postmortem device disposal). Challenges to providing effective patient care included a lack of clinical suspicion of device failures, unfamiliarity with equipment, and an absence of digitally tailored clinical protocols. Participants agreed that cyberattacks should be classified as major incidents, with the repurposing of existing crisis resources. Treatment of patients was determined by the role technology played in clinical management, such that those reliant on potentially compromised laboratory or radiological facilities were prioritized. Here, we have framed digital events through a clinical lens, described in terms of their end-point impact on the patient. In doing so, we have developed a series of recommendations for ensuring responses to digital events are tailored to clinical needs and center patient care.

Cybersecurity in Healthcare Through the 7-S Model Strategy

Abstract According to the 2019 HIMSS Cybersecurity Survey, most healthcare organizations are aware of the importance of cybersecurity, with 96% of respondents indicating that cybersecurity was a priority for their organization. Despite this, the survey also found that healthcare organizations are not adequately prepared for cyberattacks, with only 39% reporting that they had a comprehensive cybersecurity plan. This paper uses the 7-S Model strategy as a foundation for strategy development for healthcare organizations in a post-COVID-19 world.

Intelligent AI-based Healthcare Cyber Security System using Multi-Source Transfer Learning Method

Cyber-security intelligence have made a great impact over healthcare industry where several researchers are developing new techniques to improve security for healthcare systems. Besides, Artificial Intelligence (AI) become the tremendous technology in recent decades to improve the existing methods to be more intelligent. In this paper, we proposed cyber attack detection system for healthcare sector with centralized and federated transfer learning mode. Edge of Things (EoT) framework is developed in connection with cloud and healthcare sectors to transmit the data efficiently and the proposed Centralized with Multi-Source Transfer Learning (CMTL) algorithm which is used for detection and classification of various threats such as information gathering, DoS/DDoS attacks, Malware attacks, Injection attacks, and Man in the Middle attacks. Performance of the proposed framework is evaluated using various datasets such as EMNIST, X-IIoTID, and Federated TON_IoT. Our framework outperforms with the analysis of execution time and obtains high level accuracy when compared with different algorithms.

A quantum trust and consultative transaction-based blockchain cybersecurity model for healthcare systems

Many researchers have been interested in healthcare cybersecurity for a long time since it can improve the security of patient and health record data. As a result, a lot of research is done in the field of cybersecurity that focuses on the safe exchange of health data between patients and the medical setting. It still has issues with high computational complexity, increased time consumption, and cost complexity, all of which have an impact on the effectiveness and performance of the complete security system. Hence this work proposes a technique called Consultative Transaction Key Generation and Management (CTKGM) to enable secure data sharing in healthcare systems. It generates a unique key pair based on random values with multiplicative operations and time stamps. The patient data is then safely stored in discrete blocks of hash values using the blockchain methodology. The Quantum Trust Reconciliation Agreement Model (QTRAM), which calculates the trust score based on the feedback data, ensures reliable and secure data transfer. By allowing safe communication between patients and the healthcare system based on feedback analysis and trust value, the proposed framework makes a novel contribution to the field. Additionally, during communication, the Tuna Swarm Optimization (TSO) method is employed to validate nonce verification messages. Nonce message verification is a part of QTRAM that helps verify the users during transmission. The effectiveness of the suggested scheme has been demonstrated by comparing the obtained findings with other current state-of-the-art models after a variety of evaluation metrics have been analyzed to test the performance of this security model.

The elephant in the room: cybersecurity in healthcare.

Cybersecurity has seen an increasing frequency and impact of cyberattacks and exposure of Protected Health Information (PHI). The uptake of an Electronic Medical Record (EMR), the exponential adoption of Internet of Things (IoT) devices, and the impact of the COVID-19 pandemic has increased the threat surface presented for cyberattack by the healthcare sector.Within healthcare generally and, more specifically, within anaesthesia and Intensive Care, there has been an explosion in wired and wireless devices used daily in the care of almost every patient-the Internet of Medical Things (IoMT); ventilators, anaesthetic machines, infusion pumps, pacing devices, organ support and a plethora of monitoring modalities. All of these devices, once connected to a hospital network, present another opportunity for a malevolent party to access the hospital systems, either to gain PHI for financial, political or other gain or to attack the systems directly to cause erroneous monitoring, altered settings of any device and even to access the EMR via this IoMT window.This exponential increase in the IoMT and the increasing wireless connectivity of anaesthesia and ICU devices as well as implantable devices presents a real and present danger to patient safety. There has, at the same time, been a chronic underfunding of cybersecurity in healthcare.This lack of cybersecurity investment has left the sectorexposed, and with the monetisation of PHI, the introduction of technically unsecure IoT devices for monitoring and direct patient care, the healthcare sector is presenting itself for further devastating cyberattacks or breaches of PHI. Coupled with the immense strain that the COVID-19 pandemic has placed on healthcare and the changes in working patterns of many caregivers, this has further amplified the exposure of the sector to cyberattacks.

Healthcare Cybersecurity Threat Context and Mitigation Opportunities

With the rapid increase in cybersecurity incidents around the globe, no business or industry is hidden from cybercriminals' crosshairs. Cyber-attacks are evolving and becoming more complex each day, causing much damage to different financial and reputational sectors. The health sector (including healthcare technology) is increasingly digitized and continues to offer life-critical services. It continues to improve diagnosis, treatment, and patient care with state-of-the-art technologies. However, cybercriminals continue to exploit vulnerabilities and exfiltrate confidential patient data and other confidential information. The health care sector offers cybercriminals a rich source of confidential data and is very easy to exploit as the defense and security controls are weak. Because of the growing number of threats associated with the health sector, it is essential to understand how health care practitioners - along with concerned critical Information Technology (IT) teams - can take steps to improve the cybersecurity posture of this industry and help reduce the attack surface. Hence, this paper discusses a critical approach to analyze the current cybersecurity challenges faced by the health care sector and relevant mitigation and other scholarly articles and research papers.

A Comprehensive Review of the State-of-the-Art on Security and Privacy Issues in Healthcare

Currently, healthcare is critical environment in our society, which attracts attention to malicious activities and has caused an important number of damaging attacks. In parallel, the recent advancements in technologies, computing systems, and wireless communications are changing healthcare environment by adding different improvements and complexity to it. This article reviews the current state of the literature and provides a holistic view of cybersecurity in healthcare. With this purpose in mind, the article enumerates the main stakeholders and architecture implemented in the healthcare environment, as well as the main security issues (threats, attacks, etc.) produced in healthcare. In this context, this work maps the threats collected with a widely used knowledge-based framework, MITRE ATT&CK, building a contribution not seen so far. This article also enumerates the security mechanisms created to protect healthcare, identifying the principal research lines addressed in the literature, and listing the available public security-focused datasets used in machine-learning to provide security in the medical domain. To conclude, the research challenges that need to be addressed for future research works in this area are presented.

Vulnerability to Cyberattacks and Sociotechnical Solutions for Health Care Systems: Systematic Review.

Health care organizations worldwide are faced with an increasing number of cyberattacks and threats to their critical infrastructure. These cyberattacks cause significant data breaches in digital health information systems, which threaten patient safety and privacy. From a sociotechnical perspective, this paper explores why digital health care systems are vulnerable to cyberattacks and provides sociotechnical solutions through a systematic literature review (SLR). An SLR using the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) was conducted by searching 6 databases (PubMed, Web of Science, ScienceDirect, Scopus, Institute of Electrical and Electronics Engineers, and Springer) and a journal (Management Information Systems Quarterly) for articles published between 2012 and 2022 and indexed using the following keywords: "(cybersecurity OR cybercrime OR ransomware) AND (healthcare) OR (cybersecurity in healthcare)." Reports, review articles, and industry white papers that focused on cybersecurity and health care challenges and solutions were included. Only articles published in English were selected for the review. In total, 5 themes were identified: human error, lack of investment, complex network-connected end-point devices, old legacy systems, and technology advancement (digitalization). We also found that knowledge applications for solving vulnerabilities in health care systems between 2012 to 2022 were inconsistent. This SLR provides a clear understanding of why health care systems are vulnerable to cyberattacks and proposes interventions from a new sociotechnical perspective. These solutions can serve as a guide for health care organizations in their efforts to prevent breaches and address vulnerabilities. To bridge the gap, we recommend that health care organizations, in partnership with educational institutions, develop and implement a cybersecurity curriculum for health care and intelligence information sharing through collaborations; training; awareness campaigns; and knowledge application areas such as secure design processes, phase-out of legacy systems, and improved investment. Additional studies are needed to create a sociotechnical framework that will support cybersecurity in health care systems and connect technology, people, and processes in an integrated manner.

CYBER-AIDD: A novel approach to implementing improved cyber security resilience for large Australian healthcare providers using a Unified Modelling Language ontology.

This paper proposes a novel cyber security risk governance framework and ontology for large Australian healthcare providers, using the structure and simplicity of the Unified Modelling Language (UML). This framework is intended to mitigate impacts from the risk areas of: (1) cyber-attacks, (2) incidents, (3) data breaches, and (4) data disclosures. Using a mixed-methods approach comprised of empirical evidence discovery and phenomenological review, existing literature is sourced to confirm baseline ontological definitions. These are supplemented with Australian government reports, professional standards publications and legislation covering cyber security, data breach reporting and healthcare governance. Historical examples of healthcare cyber security incidents are reviewed, and a cyber risk governance UML presented to manage the defined problem areas via a single, simplified ontological diagram. A clear definition of 'cyber security' is generated, along with the 'CYBER-AIDD' risk model. Specific examples of cyber security incidents impacting Australian healthcare are confirmed as N = 929 over 5 years, with human factors the largest contributor. The CYBER-AIDD UML model presents a workflow across four defined classes, providing a clear approach to implementing the controls required to mitigate risks against verified threats. The governance of cyber security in healthcare is complex, in part due to a lack of clarity around key terms and risks, and this is contributing to consistently poor operational outcomes. A focus on the most essential avenues of risk, using a simple UML model, is beneficial in describing these risks and designing governance controls around them.

Cybersecurity in Healthcare: A Review of Recent Attacks and Mitigation Strategies

Cybersecurity in Healthcare: A Review of Recent Attacks and Mitigation Strategies

Implementation of Cybersecurity Risk Theory and Model in Healthcare

This review paper examines the implementation of cybersecurity risk theory and models in Healthcare, including their benefits and challenges. The paper begins with an overview of cybersecurity risk theory and models, including the STAMP theory and various types of models. It then compares different cybersecurity risk models and discusses their strengths and weaknesses. The paper also explores case studies of the successful implementation of cybersecurity risk models in Healthcare and the challenges these organizations face. The importance of risk assessment and management in healthcare cybersecurity and strategies for mitigating cybersecurity risks are highlighted. The paper concludes with future research and practice recommendations, including the need for more sophisticated risk models, addressing the cybersecurity workforce shortage, understanding the impact of emerging technologies, increasing collaboration between healthcare organizations, and conducting more empirical studies. Keywords: Cybersecurity, Risk assessment, Risk management, Healthcare, Implementation, Risk models

It takes a pirate to know one: ethical hackers for healthcare cybersecurity

Healthcare cybersecurity is increasingly targeted by malicious hackers. This sector has many vulnerabilities and health data is very sensitive and valuable. Consequently, any damage caused by malicious intrusions is particularly alarming. The consequences of these attacks can be enormous and endanger patient care. Amongst the already-implemented cybersecurity measures and the ones that need to be further improved, this paper aims to demonstrate how penetration tests can greatly benefit healthcare cybersecurity. It is already proven that this approach has enforced cybersecurity in other sectors. However, it is not popular in healthcare since many prejudices still surround the hacking practice and there is a lack of education on hackers' categories and their ethics. The present analysis aims to comprehend what hacker ethics is and who ethical hackers are. Currently, hacker ethics has the status of personal ethics; however, to employ penetration testers in healthcare, it is recommended to draft an official code of ethics, comprising principles, standards, expectations, and best practices. Additionally, it is important to distinguish between malicious hackers and ethical hackers. Amongst the latter, penetration testers are only a sub-category. Acknowledging the subtle differences between ethical hackers and penetration testers allows to better understand why and how the latter can offer their services to healthcare facilities.

Decision support for healthcare cyber security

The pandemic has demonstrated that healthcare systems are prime targets for attackers. Finding an optimal security control set is a constant challenge for health organizations, where cost is a major consideration. The purpose of this paper is to demonstrate a healthcare cost optimization system as well as a case study based on two IT setup configurations that have been evaluated by medical experts as well as IT experts. These configurations would aid in conveying the complexity of the decision parameters and demonstrating how CySecTool handles this difficulty. In the study, 64 different security controls were linked to 70 vulnerabilities that could occur at any level of a hospital system dealing with both internal and external attacks/risks. The study also includes a novel visualization scheme that allows for the observation of vulnerabilities and also their subcategories based on Microsoft's STRIDE categorization.

Quantum Techniques and Technologies for Cybersecurity in Healthcare

Quantum Techniques and Technologies for Cybersecurity in Healthcare

Classification of Challenges and Threats in Healthcare Cybersecurity: A Systematic Review.

The rapid development of electronic health has highlighted the essential position information security holds today in the healthcare industry. Indeed, healthcare organisations have increasingly become targets for cyberattacks. The authors investigated cybersecurity challenges through identifying cases within the academic literature related to cybersecurity threats and vulnerabilities present within healthcare settings. The fast adoption of healthcare information systems has exposed the healthcare industry to numerous kinds of cyberattacks, thereby prompting the international academic community to investigate these threats. There are various cybersecurity challenges and vulnerabilities within healthcare that could later be exploited and lead to cybercrimes. As security systems continue to develop, the interest in cybersecurity as a form of defense and protection is expected to grow.

An Action Research Case Study Concerning Deaf and Hard of Hearing Diversity and Inclusion in Healthcare Cybersecurity Consulting Organizations

The U.S. hospital Ransomware attacks during COVID-19 have highlighted the importance of cybersecurity workers and expertise in healthcare. These attacks are increasing when the US is experiencing a considerable cybersecurity workforce shortage. As everyone becomes increasingly hyper-connected and cybercrime intensifies in both scale and complexity, the need for experts in the field is dire. Innovative organizations realize that they need to tap into new employment talent populations that have historically been overlooked, especially deaf and hard of hearing. This action research study explores a management consulting intervention at an organization with an unfriendly culture for employees with disabilities but in need of workers with cybersecurity expertise.

Exploring Holistic Managerial Thinking to Better Manage Healthcare Cybersecurity

Healthcare systems in the United States have discovered the massive potential for digital technology to enhance clinical outcomes and change care delivery (Coventry & Branley, 2018). Technologies range from telemedicine technology providing care remotely, storing electronic health records (EHRs), and devices that deliver medication or monitor health (Coventry & Branley, 2018). There has been a 300% increase in cyberattacks in the healthcare industry (Janofsky, 2019). The increasing cost and threat to cybersecurity, especially amid a global pandemic, highlights organizations' immediate need to utilize system thinking to prevent continuous loss. This research discussion aims to use the literature's contextual review to examine healthcare cybersecurity organizational behavior through systems thinking lens to explore a holistic managerial thinking to better manage healthcare cybersecurity.