Security expert says don't forget the 'physical side of things' when mapping out your cybersecurity plans

It's no secret that healthcare is under attack as one of the most marauded industries in the world after gaming and the business/professional sector. Ransomware attacks are up 350 percent, 45 percent of ransomware impacting healthcare is Locky and phishing is the method of choice, responsible for 80 percent of all exploits and 13 percent of all downtime, said Bruce Snell, director of emerging threats for NTT Security.

But what the audience at his HIMSS19 education session "Global Cyber Threats Trends and Their Impact on Healthcare" given here last week might not have expected to hear is that it's not just computer networks, medical devices and your EHR that you should be worried about.

"Don't forget the physical side of things that need to be looked at like elevators and refrigerators," he said. These are assets that are hard-coded, default threats with oft weak encryptions.

Snell said he once did a search on websites that showed available or vulnerable ports for a hospital refrigeration system and came up with a few thousand vulnerabilities that were available remotely, ripe for the hacking.

He's seeing lots of phishing, spearfishing and targeted attacks, and that's because phishing is 80 percent effective for enabling ransomware transference.

"Once you get malware in place, the typical time it takes to discover it starts getting frightening. You expect to see weeks, hours, minutes or days, but some incidents are hitting months and years," he said.

The IoT is a growing area of vulnerability, as it collects a lot of data. The average number of vulnerabilities on a wearable device is 25. But beyond that, again, don't forget the other side. The device exposes its back-end infrastructure to threats too.

"What's the bigger architecture? What's the bigger play? That's what you need to consider," he said. "You have to start worrying about the connectivity between your device and the cloud."