Cyber Risk in Health Facilities: A Systematic Literature Review

The need for cybersecurity self-evaluation in healthcare

The Australian healthcare sector is a complex mix of government departments, associations, providers, professionals, and consumers. Cybersecurity attacks, which have recently increased, challenge the sector in many ways; however, the best approaches for the sector to manage the threat are unclear. This study will report on a semi-structured focus group conducted with five representatives from the Australian healthcare and computer security sectors. An analysis of this focus group transcript yielded four themes: 1) the challenge of securing the Australian healthcare landscape; 2) the financial challenges of cybersecurity in healthcare; 3) balancing privacy and transparency; 4) education and regulation. The results indicate the need for sector-specific tools to empower the healthcare sector to mitigate cybersecurity threats, most notably using a self-evaluation tool so stakeholders can proactively prepare for incidents. Despite the vast amount of research into cybersecurity, little has been conducted on proactive cybersecurity approaches where security weaknesses are identified weaknesses before they occur.

Information security and privacy in hospitals: a literature mapping and review of research gaps

Information security and privacy are matters of concern in every industry. The healthcare sector has lagged in terms of implementing cybersecurity measures. Therefore, hospitals are more exposed to cyber events due to the criticality of patient data. Currently, little is known about state-of-the-art research on information security and privacy in hospitals. The purpose of this study is to report the outcome of a systematic literature review on research about the application of information security and privacy in hospitals. A systematic literature review following the PRISMA methodology was conducted. To reference our sample according to cybersecurity domains, we benchmarked each article against two cybersecurity frameworks: ISO 27001 Annex A and the NIST framework core. Limited articles in our papers referred to the policies and compliance sections of ISO 27001. In addition, most of our sample is classified by the NIST function "Protect," meaning activities related to identity management, access control and data security. Furthermore, we have identified key domains where research in security and privacy are critical, such as big data, IOT, cloud computing, standards and regulations. The results indicate that although cybersecurity is a growing concern in hospitals, research is still weak in some areas. Considering the recrudescence of cyber-attacks in the healthcare sector, we call for more research in hospitals in managerial and non-technical domains of information security and privacy that are uncovered by our analysis.

Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors

This study aims to review the literature on antecedent factors of information security related to the protection of health information systems (HISs) in the healthcare organization. We classify those factors into organizational and individual aspects. We followed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework. Academic articles were sourced from five online databases (Scopus, PubMed, IEEE, ScienceDirect, and SAGE) using keywords related to information security, behavior, and healthcare facilities. The search yielded 35 studies, in which the three most frequent individual factors were self-efficacy, perceived severity, and attitudes, while the three most frequent organizational factors were management support, cues to action, and organizational culture. Individual factors for patients and medical students are still understudied, as are the organizational factors of academic healthcare facilities. More individual factors have been found to significantly influence security behavior. Previous studies have been dominated by the security compliance behavior of clinical and non-clinical hospital staff. These research gaps highlight the theoretical implications of this study. This study provides insight for managers of healthcare facilities and governments to consider individual factors in establishing information security policies and programs for improving security behavior.

The COVID-19 scamdemic: A survey of phishing attacks and their countermeasures during COVID-19

The COVID-19 pandemic coincided with an equally-threatening scamdemic: a global epidemic of scams and frauds. The unprecedented cybersecurity concerns emerged during the pandemic sparked a torrent of research to investigate cyber-attacks and to propose solutions and countermeasures. Within the scamdemic, phishing was by far the most frequent type of attack. This survey paper reviews, summarises, compares and critically discusses 54 scientific studies and many reports by governmental bodies, security firms and the grey literature that investigated phishing attacks during COVID-19, or that proposed countermeasures against them. Our analysis identifies the main characteristics of the attacks and the main scientific trends for defending against them, thus highlighting current scientific challenges and promising avenues for future research and experimentation.

The Evolution of Balanced Scorecard in Healthcare: A Systematic Review of Its Design, Implementation, Use, and Review

During the last few years, the interest in performance measurement increased within the healthcare sector. Due to the COVID-19 pandemic, healthcare systems needed to boost performance measurement systems to become more resilient and improve their capability in monitoring key performance indicators. Since the 1990s, the Balanced Scorecard (BSC) model has been widely used among private and public organizations as it is the most adopted model to measure performance. The current paper aims at understanding the evolution of BSC in healthcare. The systematic literature review has been carried out by searching keywords according to PRISMA guidelines. By analyzing papers through one classification of BSC adoption phases, the results reveal that studies focused mainly on the BSC design process, rather than BSC implementation, use, or review. However, there is no agreement about the perspectives to be adopted in healthcare. Concerning BSC implementation and use, on one side especially leadership, culture and communication enable the BSC implementation. On the other side, monitoring and strategic decision-making are the most widespread objectives for using BSC. Concerning BSC review, however, the paper highlights a need for additional research. Finally, the paper provides further research opportunities concerning the phases suitable for implementing a BSC in healthcare.

Advancing the cybersecurity of the healthcare system with self-optimising and self-adaptative artificial intelligence (part 2)

This article advances the knowledge on teaching and training new artificial intelligence algorithms, for securing, preparing, and adapting the healthcare system to cope with future pandemics. The core objective is to develop a concept healthcare system supported by autonomous artificial intelligence that can use edge health devices with real-time data. The article constructs two case scenarios for applying cybersecurity with autonomous artificial intelligence for (1) self-optimising predictive cyber risk analytics of failures in healthcare systems during a Disease X event (i.e., undefined future pandemic), and (2) self-adaptive forecasting of medical production and supply chain bottlenecks during future pandemics. To construct the two testing scenarios, the article uses the case of Covid-19 to synthesise data for the algorithms - i.e., for optimising and securing digital healthcare systems in anticipation of Disease X. The testing scenarios are built to tackle the logistical challenges and disruption of complex production and supply chains for vaccine distribution with optimisation algorithms.

Anatomy of a Cyberattack: Part 1: Managing an Anatomic Pathology Laboratory During 25 Days of Downtime

OBJECTIVES

Our institution was affected by a multi-institution, systemwide cyberattack that led to a complete shutdown of major patient care, operational, and communication systems. The attack affected our electronic health record (EHR) system, including all department-specific modules, the laboratory information system (LIS), pharmacy, scheduling, billing and coding, imaging software, internet access, and payroll. Downtime for the EHR lasted 25 days, while other systems were nonfunctional for more than 40 days, causing disruptions to patient care and significantly affecting our laboratories. As more institutions transition to network EHR systems, laboratories are increasingly vulnerable to cyberattack. This article focuses on the approaches we developed in the anatomic pathology (AP) laboratory to continue operations, consequences of the prolonged downtime, and strategies for the future.

METHODS

Our AP laboratory developed manual processes for surgical and cytopathology processing, redeployed staff, and used resources within the department and of nearby facilities to regain and maintain operations.

RESULTS

During the downtime, our AP laboratory processed 1,362 surgical pathology and consult cases as well as 299 cytology specimens and outsourced 1,308 surgical pathology and 1,250 cytology cases.

CONCLUSIONS

Our laboratory successfully transitioned to downtime processes during a 25-day complete network outage. The crisis allowed for innovative approaches in managing resources.

A taxonomy of knowledge risks for healthcare organizations

Purpose

Knowledge is a critical factor for health-care organizations’ sustainability in today’s hyperconnected and technology reliant environment, which presents additional challenges and responsibilities for managing knowledge and its risks in medical practices. This paper aims at developing a taxonomy of knowledge risks (KR) within a health-care context, with relevant descriptions and discussion of their possible impact on health-care organizations.

Design/methodology/approach

As KRs have not been discussed yet within a health-care context, the authors reviewed relevant literature on KRs and challenges to knowledge practices in general contexts and in other industries. In addition, the authors reviewed literature on knowledge management (KM) in health care. The authors synthesized their findings and combined it with authors’ insights based on their experience in the health-care and KM fields to develop the taxonomy of KR, with contextual explanations and expounded on their potential effects on health-care organizations.

Findings

The authors propose and explain 25 types of KRs in health-care organizations and organized them into three categories: human, operational and technology.

Practical implications

Proper identification of clinical and administrative KRs plays a critical role in their effective management and remediation, thus improving the quality of care, promoting efficiency savings and ensuring health-care organizations’ sustainability. This paper will raise the awareness of KR among health-care professionals and offer researchers solid ground for more rigorous research in the field of KR and their management, within the health-care context in specific.

Originality/value

To the best of the authors’ knowledge, this paper is the first to comprehensively discuss issues of KRs within a health-care context.

Cyber risk and cybersecurity: a systematic review of data availability

Cybercrime is estimated to have cost the global economy just under USD 1 trillion in 2020, indicating an increase of more than 50% since 2018. With the average cyber insurance claim rising from USD 145,000 in 2019 to USD 359,000 in 2020, there is a growing necessity for better cyber information sources, standardised databases, mandatory reporting and public awareness. This research analyses the extant academic and industry literature on cybersecurity and cyber risk management with a particular focus on data availability. From a preliminary search resulting in 5219 cyber peer-reviewed studies, the application of the systematic methodology resulted in 79 unique datasets. We posit that the lack of available data on cyber risk poses a serious problem for stakeholders seeking to tackle this issue. In particular, we identify a lacuna in open databases that undermine collective endeavours to better manage this set of risks. The resulting data evaluation and categorisation will support cybersecurity researchers and the insurance industry in their efforts to comprehend, metricise and manage cyber risks.

SUPPLEMENTARY INFORMATION

The online version contains supplementary material available at 10.1057/s41288-022-00266-6.

Cost Benefits of Using Machine Learning Features in NIDS for Cyber Security in UK Small Medium Enterprises (SME)

Cyber security has made an impact and has challenged Small and Medium Enterprises (SMEs) in their approaches towards how they protect and secure data. With an increase in more wired and wireless connections and devices on SME networks, unpredictable malicious activities and interruptions have risen. Finding the harmony between the advancement of technology and costs has always been a balancing act particularly in convincing the finance directors of these SMEs to invest in capital towards their IT infrastructure. This paper looks at various devices that currently are in the market to detect intrusions and look at how these devices handle prevention strategies for SMEs in their working environment both at home and in the office, in terms of their credibility in handling zero-day attacks against the costs of achieving so. The experiment was set up during the 2020 pandemic referred to as COVID-19 when the world experienced an unprecedented event of large scale. The operational working environment of SMEs reflected the context when the UK went into lockdown. Pre-pandemic would have seen this experiment take full control within an operational office environment; however, COVID-19 times has pushed us into a corner to evaluate every aspect of cybersecurity from the office and keeping the data safe within the home environment. The devices chosen for this experiment were OpenSource such as SNORT and pfSense to detect activities within the home environment, and Cisco, a commercial device, set up within an SME network. All three devices operated in a live environment within the SME network structure with employees being both at home and in the office. All three devices were observed from the rules they displayed, their costs and machine learning techniques integrated within them. The results revealed these aspects to be important in how they identified zero-day attacks. The findings showed that OpenSource devices whilst free to download, required a high level of expertise in personnel to implement and embed machine learning rules into the business solution even for staff working from home. However, when using Cisco, the price reflected the buy-in into this expertise and Cisco’s mainframe network, to give up-to-date information on cyber-attacks. The requirements of the UK General Data Protection Regulations Act (GDPR) were also acknowledged as part of the broader framework of the study. Machine learning techniques such as anomaly-based intrusions did show better detection through a commercially subscription-based model for support from Cisco compared to that of the OpenSource model which required internal expertise in machine learning. A cost model was used to compare the outcome of SMEs’ decision making, in getting the right framework in place in securing their data. In conclusion, finding a balance between IT expertise and costs of products that are able to help SMEs protect and secure their data will benefit the SMEs from using a more intelligent controlled environment with applied machine learning techniques, and not compromising on costs.

Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review

BACKGROUND

COVID-19 has challenged the resilience of the health care information system, which has affected our ability to achieve the global goal of health and well-being. The pandemic has resulted in a number of recent cyberattacks on hospitals, pharmaceutical companies, the US Department of Health and Human Services, the World Health Organization and its partners, and others.

OBJECTIVE

The aim of this review was to identify key cybersecurity challenges, solutions adapted by the health sector, and areas of improvement needed to counteract the recent increases in cyberattacks (eg, phishing campaigns and ransomware attacks), which have been used by attackers to exploit vulnerabilities in technology and people introduced through changes to working practices in response to the COVID-19 pandemic.

METHODS

A scoping review was conducted by searching two major scientific databases (PubMed and Scopus) using the search formula "(covid OR healthcare) AND cybersecurity." Reports, news articles, and industry white papers were also included if they were related directly to previously published works, or if they were the only available sources at the time of writing. Only articles in English published in the last decade were included (ie, 2011-2020) in order to focus on current issues, challenges, and solutions.

RESULTS

We identified 9 main challenges in cybersecurity, 11 key solutions that health care organizations adapted to address these challenges, and 4 key areas that need to be strengthened in terms of cybersecurity capacity in the health sector. We also found that the most prominent and significant methods of cyberattacks that occurred during the pandemic were related to phishing, ransomware, distributed denial-of-service attacks, and malware.

CONCLUSIONS

This scoping review identified the most impactful methods of cyberattacks that targeted the health sector during the COVID-19 pandemic, as well as the challenges in cybersecurity, solutions, and areas in need of improvement. We provided useful insights to the health sector on cybersecurity issues during the COVID-19 pandemic as well as other epidemics or pandemics that may materialize in the future.