The past few years have been challenging for healthcare. Organizations have faced spikes in the pandemic and constant shifts and challenges. During the first wave of being on the front lines of the pandemic, many healthcare organizations had to invent or reinvent patient treatment plans and clinical guidance, build testing centers, expand inpatient capacity, and dramatically expand virtual-visit platforms.

All of these digital initiatives have security implications. And healthcare is facing increasingly sophisticated cyber threats and cybersecurity complexity. Fortinet's Troy Ament, Field CISO for Life Sciences and Healthcare, offers his thoughts on healthcare cybersecurity priorities and the threats healthcare organizations are facing in 2022.

How has digital transformation affected healthcare organizations? 

Troy:Before I joined Fortinet, I worked for large health systems with over 46 hospitals and more than 60,000 employees. We were only doing 100 virtual visits per month. Now those same organizations are doing over 45,000 virtual visits. There's been a huge step forward for the healthcare ecosystem in terms of technology. After that, it was a heroic effort to vaccinate almost 4 billion people across the globe, which is just tremendous. These initial challenges during the pandemic continue to evolve and adapt and leverage new technologies and digital transformation. There are a few that I just wanted to touch on specifically.

The first is workforce mobilization. At my organization, we moved more than 6,000 people home in two weeks. We also had to manage data analytics and data sharing to provide information to state, local, and federal governments about infection rates and vaccine administration and adoption rates. Within our organization, we had to use a lot of data analytics to know where we were from a personal protective equipment (PPE) and intensive care bed rate perspective.

All the billions of doses of vaccines that were administered ended up putting a big target on the back of many healthcare and pharma organizations. Amid the vaccine rollout success, there's that darker side as adversaries track and take inventory of digital changes in healthcare and look at ways they can monetize their attacks.

What are some common challenges in healthcare cybersecurity? 

Troy:From the beginning of 2020 up until maybe the first half of 2020, adversaries weren't attacking the provider space as much. But as they saw the acceleration of digital transformation and health systems becoming focused on COVID-19, they recognized the opportunity, and there was a dramatic spike inransomwareattacks. The attacks successfully disrupted operations during a time when health systems were extremely challenged, just in staffing their hospitals and having enough PPE for them. So the adversaries were successful in forcing some health systems to pay tens of millions of dollars inransomware settlements. Organizations couldn't continue to be down because it affected patients' ability to get vaccinations and test results.

But it didn't stop there. The challenges went beyond the four walls of a health system. Over the last six months to a year, cloud application providers are more prevalent. They provide critical applications to health systems, such as payroll, staffing and scheduling, revenue, and billing. And then, more recently, electronic medical records have been impacted. These organizations provide services to these health systems, which is a pivot I've seen away from health systems. Now adversaries are going after larger cloud application service providers that need to be taking a comprehensive security approach with zero-trust solutions.

What can healthcare organizations do to improve their security posture? 

Troy:There are a few effective methods of improving an organizations security posture. First and foremost is foundationally integrating security into the business practice. Even when a business wants to quickly adopt new technologies or clinical workflows, security needs to be embedded into those workflows across IT, networking, etc. Theconvergence of networking and securityis important. And then adopting a mesh-type architecture approach to security. It's important to have acomprehensive, integrated approachto security that includeszero trustas well. Securing remote and online care is paramount in healthcare.

Right now, we're seeing much higher adoption of multifactor authentication and having zero-trust solutions embedded into networks to minimize the impact of an attack. Healthcare organizations are doubling down on security because they're starting to understand it better. The health systems that have become more mature within security operations to get in front of or limit the damage of attacks are being successful, and that information is spreading through the industry.

Learn moreabout how Fortinet healthcare security solutions can help enable the latest advances in patient care while protecting against cyberattacks. Read the latest in CISO thought leadership: CISO on CISO Perspectives.