jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

With 93% of breaches found to be preventable in Q3 of 2017, Auth0 offers concrete ways to protect patients against rising cyberattacks.



## Block Medical Identity Thieves with Cyber Hygiene

Cybersecurity attacks increased in number and sophistication in 2017. But the Online Trust Alliance (OTA), a global nonprofit dedicated to promoting online innovation and trust, found that [93% of breaches through Q3 could have been prevented](https://otalliance.org/system/files/files/initiative/documents/ota_cyber_incident_trends_report_jan2018.pdf). Only 52% of those breaches were caused by actual hacks. Internal issues that resulted in accidental or malicious events instigated by employees accounted for another 11%.

This is good news for healthcare organizations charged with protecting large quantities of personal health information (PHI) attracting data thieves.

Medical identity theft brings more than standard identity theft horrors. It allows criminals to pose as patients, securing prescription drugs or even medical treatment.

Victims of medical identity theft can even find themselves paying the thieves’ deductibles. An [Accenture study](https://www.accenture.com/us-en/insight-accenture-health-2017-consumer-survey) found half of U.S. victims were stuck with an average of $2,500 in out-of-pocket costs after an attack. Plus they have to clean up a medical history that can lead to serious treatment errors.

That kind of patient experience can send a customer doctor shopping. A [2018 PwC report](https://www.pwc.com/us/en/health-industries/assets/pwc-health-research-institute-top-health-industry-issues-of-2018-report.pdf) noted that 26% of consumers would change doctors, hospitals, insurers, or medical organizations after a hack.

<include src="TweetQuote" quoteText="26% of consumers said they would change healthcare providers after a hack. Cyberattacks may be rising, but 93% of hacks are preventable. Auth0 offers concrete ways to keep your patients safe."/>

"Healthcare organizations are just starting to realize that cybersecurity is not a cost center,” says Auth0 CISO Joan Pepin, speaking from more than twenty years experience handling cybersecurity, “It's actually adding value by placing the focus on the well-being of their end customers."

<include src="TweetQuote" quoteText="Healthcare organizations are just starting to realize that cybersecurity is adding value by placing the focus on the well-being of their end customers. —Auth0 CISO Joan Pepin"/>

And 2018 is already laying out challenges and consequences.
Half of Norway’s entire population — 3 million people — was already exposed in a [professional healthcare hack](https://www.scmagazineuk.com/half-of-norways-population-have-medical-data-leaked/article/738079/) in January. Although swift by current standards, breach notification fell well outside GDPR’s 72-hour requirement. After May, that lag will mean stiff fines.

Even outside the EU, breaches can have expensive consequences. Last year U.S. health insurer [Anthem paid a $115 million settlement](https://www.nbcnews.com/news/us-news/anthem-pay-record-115m-settle-lawsuits-over-data-breach-n776246) on over 100 consolidated lawsuits due to a 2015 cyber attack.

![Healthcare cybersecurity](https://images.ctfassets.net/23aumh6u8s0i/73bOR9hNS3ww9qRI6yTIjS/847eb9ef2e2b53769fabf1c7fc508053/med)

## Creating Your Cyber Hygiene Protocol

There is no such thing as a 100% vaccination against cyber attacks, but there are several steps you can take to protect your patients and your organization.

Pepin often mentions the protective strength of regular cyber hygiene. Like asking healthcare professionals and visitors to scrub in before visiting intensive care units, regularly following a set of logical protocols and actions can reduce cyber-attack risk.

### 1. Backup and Patch

Backups, regular patching, and third-party risk assessments can provide insights into areas in need of attention.

### 2. Instill Screen Locking

For situations where patients could access monitors, its best for healthcare professionals to follow the practice of locking the screen whenever they need to leave the room.

### 3. Retire Unsupported Devices and Applications

Making the argument to retire an older device can be challenging, especially when the device appears fully functional, but a device that runs on software that’s no longer updated leaves your entire network open to attack.

Unsupported applications and operating systems offer similar points of entry for hackers. Part of good cyber hygiene is putting together an end-of-life plan for these devices and applications.

### 4. Educate Your Staff In Social Engineering

Educating staff to recognize increasingly sophisticated spoofing, spear-phishing, and malware attempts can help stave off ransomware attacks and their potential economic impacts.
The FBI rates Business-Email Compromise (BEC) attacks as a “serious threat on a global scale.” Since 2015, the FBI’s Internet Complaint Center (IC3) has seen a [1,300% increase in identified exposed losses totalling more than $3 billion](https://www.fbi.gov/news/stories/business-e-mail-compromise-on-the-rise).

Pepin points out the need for regular maintenance and backups so you have the option of rebuildingand restoring rather than suffering a cessation of services in the case of a ransomware attack — and it means you retain access to your data. As [one in three Australian companies](https://www.theguardian.com/technology/2017/may/15/dont-pay-ransomware-demands-cybersecurity-experts-say-wannacry) surveyed by Telestra in 2017 discovered, paying the ransom doesn’t automatically get it back.

### 5. IoHT Devices: Inventory, Authorize, and Authenticate

Thousands of internet of health things (IoHT) devices are already in use in the form of patient monitors, imaging and x-ray devices.

Part of the draw is a large ROI. According to Aruba’s [2017 State of IoT study](http://www.arubanetworks.com/assets/infographic/Aruba_IoT_Healthcare_Infographic.pdf), healthcare organizations expect to a see a 40% ROI on the devices, despite the fact that 89% say they’ve already experienced a breach because of an IoT device.

But that ROI could be at risk. Reported medical device cybersecurity vulnerabilities in the U.S. climbed by [525%](https://www.pwc.com/us/en/health-industries/assets/pwc-health-research-institute-top-health-industry-issues-of-2018-report.pdf)  in 2017 according to PwC. Increasing vulnerabilities combined with heavy adoption rates has [IDC](https://www.brighttalk.com/webcast/15909/275931) expecting the world’s first USD $100 million lawsuit as the result of a cyber security attack on a medical device by 2021. Given regulatory trends like GDPR that lay responsibility for third-party vendor compliance at the feet of hiring organizations, the device manufacturer wouldn’t be the only one facing fines and possible lawsuits.

In an effort to reduce vulnerabilities, regulatory organizations like the FDA and ENISA are offering guidelines, hoping to increase interoperability, but the truth is that decreasing manufacturing costs have already lead to a proliferation of IoHT devices running on different protocols. It’s not unlikely that a single hospital must manage hundreds of varying protocols from its IoHT devices.

Inventorying devices in use makes it easier to recognize what to keep and what to retire, especially since most older IoHT devices lack the ability to be patched.

According to Component’s healthcare forecast, the IoHT global market is expected to grow from [$41.22 billion to $158.07 billion by 2022](https://www.marketsandmarkets.com/PressReleases/iot-healthcare.asp), which means more devices will come online. Getting a handle on what you have in place and understanding security vulnerabilities now will save on headaches later. Auth0 offers secure IoHT authentication and authorization protocols that can further secure vulnerable PHI and protect the rest of your system.

### 6. Eliminate System Siloes with a 360 Degree Patient View

Siloed systems provide hackers with multiple points of entry and make it harder to manage cyber-hygiene updates. Consolidating databases also makes it easier to identify care gaps and limit avoidable care errors. Auth0’s consolidated patient view means you can quickly authenticate and authorize patient access, understand if your patient is interacting with IoHT devices, and take advantage of API security — all of which reduces user friction, improving your patient’s overall experience and reducing risk.

### 7. Step-Up Authentication

One of your best deterrents is making sure your patients are who they say they are. Authenticating identity often happens only at login. Auth0 gives you the opportunity to add step-up authentication at any time during the patient journey. For example, if your patient normally logs in from his or her home address, but suddenly logs in from a different country, the patient might be traveling. Or they might be a hacker. Activating Auth0’s step-up authentication allows you to push out a request for additional information to a sanctioned device, like your patient’s phone. In a well-designed flow, this is handled easily, without disrupting your patient’s journey, ensuring the security of your patient and your system.

### 8. Perform Reasonable Triage

Despite the real threats, you can’t do all of these things at once. Identifying your areas of greatest risk can help you recognize which tasks to handle in-house and which are best handled by a trusted-third party vendor.

Cybersecurity can be easy to get wrong. In 2017, Molina Healthcare, a major Medicaid and Affordable Care Act provider, was [forced to shut down its patient portal](http://www.healthcareitnews.com/news/molina-healthcare-breached-exposed-patient-data-over-month) after discovering a “security 101” flaw, impacting 4.8 million patients.

If cyber-security is not your IT team’s area of expertise, it could be time to hire expert help. Auth0 authenticates and secures more than 50 million logins each day for customers in 70+ countries. Sophisticated data encryption algorithms are best left in the hands of those who regularly beat hackers and assume responsibility for upgrades and maintenance.

## Find Out How Auth0 Can Help Healthcare Organizations

Auth0 is trusted by healthcare organizations like Healthgrades, Clinica Alemana, Green Cross Health, IntegraMed, the Seattle Cancer Care Alliance and more. If you’d like to learn more about how Auth0 can help you securely put your patients at the center of their healthcare experience, reach out to [sales@auth0.com](mailto:sales@auth0.com).


8 Ways to Avoid Healthcare Breaches

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

A global cyber-attack using leaked NSA tools is targeting organizations worldwide including UK's National Health Service, Spain's Telefonica telecom, and many more.



A ransomware, called [**WannaCry**](http://money.cnn.com/2017/05/12/technology/ransomware-attack-nsa-microsoft/), is making rounds across the globe and infecting vulnerable systems worldwide. Amongst the affected include FedEx, UK's National Health Service, Spain's Telefonica telecom, Russia's Interior Ministry, and many more. Hackers exploiting leaked NSA secrets and tools are said to be behind the massive attack, although no specific group has been identified as of yet.

The **WannaCry** ransomware encrypts a computer's file system and demands payment to restore access to the files. If a payment is not made in 7 days, the ransomware will delete all of the files on the machine. The attack, circulated initially through email, targets Windows machines that have not received the March 2017 security update where Microsoft fixed the vulnerability that makes this particular attack possible.

![WannaCry Ransomware](https://images.ctfassets.net/23aumh6u8s0i/5uOAgDiG784chdydy4fMHI/e1f7f71a48912fd9ba6396731004ec71/wannacry)

Ransomware attacks are nothing new. In 2016, a [Los Angeles hospital paid $17,000](https://www.nytimes.com/2016/02/19/business/los-angeles-hospital-pays-hackers-17000-after-attack.html) to regain access when hackers seized control. In fact, in our [Security Trends for 2016](https://auth0.com/blog/security-trends-for-2016/), we mentioned that **cyber extorsion** is likely to evolve and keep security specialists up at night, and we hate that we were right. The **WannaCry** cyber-attack is looking to be one of the biggest attacks recorded!

The **WannaCry** cyber-attack has been reported in 99 countries and over 75,000 attacks have been carried out so far, but perhaps the most concerning is the attack on UK's National Health Service (NHS), as it has life-or-death implications. An important thing to note is that these numbers are only from victims that have self-reported the attack, which means that the scope of this cyber-attack is most likely larger than reported.

Companies can protect themselves and their users agains cyber-attacks by developing strong incident response capabilities to complement their traditional security measures. As prevention can not be successful everytime, being capable of detecting and responding to incidents quickly is crucial. For individuals, the best way to prevent becoming a victim of ransomware and other cyber-attacks is to always keep your operating system up-to-date by enabling automatic updates. It may be annoying to see the *"You need to restart your computer to apply updates"* message, but a 5-10 minute downtime beats losing years worth of data.

## Personal Information Security Guide

Although you may not be affected by the **WannaCry** ransomware, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, detecting phising scams, backing up data, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

Be sure to check out the [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) to learn how to secure your wireless network, backup your data so that it is not lost if you become a victim of ransomware such as **WannaCry**, detect phishing scams, and more.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


"cyber-attack"