Pentesting for Healthcare: A Proactive Approach to Protecting Sensitive Data

The healthcare sector bears more than its share of cybersecurity risk. Like companies in financial services, retail, and other sectors frequently storing high-value data, healthcare institutions are prime targets for cybercriminals.

It’s not difficult to figure out why. Healthcare providers including hospitals, clinics, private practices and other entities hold enormous amounts of personal—and personally identifiable—records. More troubling is the frequency of healthcare cyberattacks. According to AAMC, more than 1 in 3 hospitals reported attacks in 2020.

Attackers and other bad actors aim to steal this information and then use it for some nefarious purpose such as selling it to others who might do the same or extracting ransom from the victim.

Under Attack: Increasing Cyberattacks in the Healthcare Sector

Between June 2020 and May 2022, there were 426 cybersecurity incidents against healthcare organizations, or about four per week, in 38 countries, according to CyberPeace Institute, an independent nongovernmental organization whose mission is to ensure peoples’ rights to security in cyberspace.

Many of these attacks have involved ransomware. The institute operates a Cyber Incident Tracer platform, and in late 2021 it said the platform documented that at least 39 ransomware operators had attacked one or more healthcare organizations across 27 countries over the previous 18 months.

Healthcare organizations face the added challenge of having to comply with a number of regulations related to security. The Health Insurance Portability and Accountability Act (HIPAA), which requires certain steps designed to protect patient data, has been in place for years.

More recently organizations have had to deal with the European Union’s General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and many other emerging data privacy rules. This means healthcare organizations that experience a breach not only have to contend with the financial repercussions of lost or stolen information, but possibly incur regulatory fines as well.

Unfortunately, there are no signs that the cyber threats against healthcare organizations will abate any time soon, and security and IT leaders at these institutions need to step up their efforts to protect systems and data.

Solution: Improve Security with Pentesting

One of the most effective ways healthcare companies can enhance their cybersecurity posture is by penetration testing (pentesting) in a way that is faster than traditional methods yet still yield quality results.

Pentesting as a service (PtaaS) provides benefits such as:

• Remote delivery
• Standardized, scalable pentesting
• Pricing based on usage
• Real-time collaboration between pentesters, developers, and security teams
• Customizable pentest report specific for your stakeholder's needs

On-demand testing can begin in as little as 48 hours; and users of these services receive real-time results and reporting as well as analytics and consolidated data from multiple pentests that show trends over time.

Traditional penetration testing is based on a slow, legacy model that provides outdated results. This does not work in today’s environment, where the nature of cyber security attacks and the threat vectors are constantly changing and security teams need information as quickly as possible. 

PtaaS provides the agility healthcare organizations need in order to be proactive in the cyber defenses. That way they can better mitigate risk, improve test coverage, and prevent threats.

Another key benefit of a modern pentesting service is that it can help healthcare institutions protect themselves despite the ongoing shortage of in-house security skills. These services, such as the one offered by Cobalt, leverage a worldwide community of highly vetted, experienced testers.

Key Selection Criteria: Selecting a Pentesting Provider

When evaluating pentesting services, healthcare security leaders should look for several key features and capabilities. One is that the service should be easy to set up. Enhancing security is a high priority, and getting such a service up and running shouldn’t take weeks.

The pentesting service should be capable of leveraging experienced security experts, so organizations using the service don't need to be burdened with finding the correct security talent to conduct the testing.

The service provider should enable real-time collaboration between security and IT teams, so the two can coordinate on testing strategy and results.

It’s likely that healthcare organizations will continue to be among the biggest targets of cybercriminals. But they can take steps to bolster their security by deploying services such as pentesting. This is a proactive approach to data protection that will enable these organizations to provide their vital services to communities and ensure that data is secure.