Industry executives and experts share their predictions for 2021. Read them in this 13th annual VMblog.com series exclusive.
2021 – A Banner Year for Prioritizing Cyber in Healthcare and Beyond
By John Ford, IronNet cyber strategist and former healthcare CISO
To say the healthcare industry was a focal point of 2020 seems like the understatement of the year. From COVID-related cyber threats to the vaccine’s progress to cyber implications of the resulting remote workforce and beyond, it seems like we every conversation ties back to healthcare and the pandemic. While it’s true that the healthcare industry is one of the main targets for malicious actors of late, it isn’t the only sector that stands to be impacted and my hope is that it has served as a wake up call to prioritize cyber on a national level.
Looking forward, the question now is, will healthcare remain the apple of hacker’s eyes in 2021, and if so, what does that mean for the cybersecurity industry and future tech advancements? Based on my current work around collective defense and real-time threat intelligence sharing and my background as a healthcare CISO, I have a few big picture ideas of what we can anticipate as cyber practitioners in the new year.
Companies Struggled With HIPAA Before COVID, So What Now?
We have to take a long, hard look at our current healthcare cybersecurity regulations and consider an update to HIPAA. With the advances to telehealth capabilities prior to COVID-19 many providers had to wrestle with maintaining compliance to HIPAA, but once the pandemic flipped the world on its head, decisions such as providing necessary care or complying to a regulation put providers in a difficult position. The fact that they went to medical school to practice health and not become compliance experts, needs to serve as a reality check for the healthcare industry. When an event of this magnitude takes place, any precautionary measures that were being taken go out the window to save lives. It is true that certain HIPAA safeguards were relaxed but now that telehealth has become the norm is it not the time to modify components of this regulation? It’s time for regulators to go back and say what did we learn from this type of environment that should be incorporated into our existing privacy and security safeguards? If not, I suspect there will be a groundswell of discontent amongst the provider community.
2021: A Banner Year for Ransomware in Healthcare
The seemingly crazy predictions of the past around the cost of ransomware attacks on the healthcare industry stand to be proven true in 2021! We’ve seen a substantial rise in ransomware since the onset of COVID, and as the space race 2.0 continues, so will the prevalence of attacks. With countries all around the world hunting for COVID vaccines we will see more nation state attacks leveraging ransomware and an increase in cloud-based ransomware attacks as healthcare systems expedite their transition to meet the growing remote needs. Lately, what is different about this tried and true attack method is that malicious actors aren’t just locking out data. They are also putting it on data leak sites where people can buy/have access to it leading to additional compliance concerns and my prediction for upcoming HIPAA changes.
As hackers get closer to where care is delivered (hospitals, nursing homes) the greater the probability of seeing additional ransomware attacks occur. It is as close to a perfect business model as one could find minus the fact that it is illegal. These attackers are preying on the emotions of caregivers and know time is of the essence to decide whether to pay or not to pay, knowing all along that the potential for loss of life hangs in the balance. This often conflicts with guidance from government departments and agencies but truly represents the kinds of choices that these organizations have to make. Stay tuned as this further develops in 2021.
Internet of Behaviors Will Make Its Official Debut
There is a relatively new concept called internet of behaviors (IoB), and while we’ve heard whispers of it this year, in 2021 we will see the use of IoB really take hold. Its ability to influence our emotions, decisions, perceptions, and may seem a bit too “big brother” for our comfort, but in these uncertain times, I wouldn’t be surprised if we see it play a major role in efforts to return to work…and once it’s introduced the applications will only grow.
For instance, as we return to a modified office environment, companies may introduce the use of cameras at workstations to help them monitor employees’ behaviors for items related to social distance practices, and mask wearing adherence. The IoB application would then be able to use the camera to trigger an email reprimanding the employee. Even if you can see the need here, the bigger question becomes how far will they take it? What if this extends to work-related screen time, or water-cooler discussions? Monitoring for COVID restrictions will modify our workplace norms even though the intent is not to do so. And this could also be applied to remote workers to some degree which could open the door to a host of emotional and privacy issues especially for those who cross paths with European organizations.
Cyber Will Finally Be Considered a National Emergency
Updates to DFAR’s 252.204-7012 through an interim rule, and the progression of the Cybersecurity Maturity Model Certification (CMMC) speak to acceptance that cybersecurity attacks in the Department of Defense (DoD), and the Defense Industrial Base (DIB) have risen to the level of a national emergency. DoD’s reliance of the private sector has been acknowledged for years; however, the number of small firms supporting the prime contractors may have been overlooked in terms of the vulnerabilities they represent to these contracts and ultimately to the mission of DoD.
I fully believe that the DFAR’s interim rule is the path forward, but I also believe that these small firms will need significant financial relief and helping hands from services organizations to achieve the levels of maturity aligned to the work they are performing. The notion that full rollout of CMMC will take an estimated five years still signals areas of significant risk – so let’s get to work now with these firms today and help them on their maturity journey!
The future is always unknown, but as a veteran in the cyber industry, I find we can learn from the past and gauge how we can prepare for where the industry is heading in the future. In these uncertain times, it’s key to work together to defend our nation and all digital infrastructures.
##
About the Author
John Ford is an information security veteran with over twenty years in a wide-variety of roles. Prior to IronNet, John was CISO for ConnectWise, the global leader in providing software solutions for Managed Services Providers. In this role he was accountable for customer facing security activities, product security, and served as an advisor to the CEO and leadership team.
