Healthcare Cybersecurity

Quarter of Americans Have Been Impacted by a Healthcare Data Breach

Posted by HIPAA Journal

Given the volume of healthcare records that have been exposed or stolen over the past two years, it comes as little surprise that 26% of Americans believe their health data have been stolen. The figures come from a recent survey conducted by Accenture.

The survey was conducted on 2,000 U.S. adults and more than a quarter said that their medical information has been stolen as a result of a healthcare data breach.

Healthcare information is attractive for cybercriminals as the information in health records does not expire. Credit card numbers can only be used for an extremely limited time before cards are blocked. However, Social Security numbers can be used for a lifetime and health insurance information can similarly be used for extended periods. The information can also be used for a multitude of nefarious activities such as tax fraud, identity and medical identity theft and insurance fraud.

It is also unsurprising that many victims of healthcare data breaches have reported suffering losses as a result of the theft of their data. According to Accenture, half of the individuals who said their data have been stolen said they have experienced medical identity theft as a result. The survey revealed that when medical identity theft occurs, out of pocket expenses of $2,500 are incurred on average.

The report shows half of the individuals who said their data have been stolen did not find out from a breach notification letter. They discovered they were a victim of a healthcare data breach after seeing charges on bank/credit card statements and suspicious entries on their Explanation of Benefits statements. Only a third of respondents said they were notified of the breach by the breached entity.

Even with record numbers of healthcare data breaches occurring, Americans still have faith in providers’ abilities to keep electronic protected health information secure. 88% of respondents said they trusted their providers to secure their ePHI. 85% said they trusted pharmacies, 84% trusted hospitals and 82% trusted health insurance companies. Healthcare technologies fared much worse (57%), as did government organizations (56%).

Businesses that experience data breaches know all too well that there is considerable fallout after a breach announcement is made. Many customers simply take their business elsewhere. That was clearly evident after the Target breach.

However, changing healthcare provider is less straightforward. That said, many breach victims said they did change healthcare provider or insurer after they were notified that their health information had been stolen. A quarter of breach victims said they had already changed healthcare provider following a data breach, while 21% said they had changed health insurance provider.

If a data breach or an attack is experienced, healthcare organizations should carefully assess what went wrong and how their cybersecurity defenses can be improved. Considering the impact healthcare data breaches have on patients and the considerable fallout following a data breach, healthcare organizations should ensure that their cybersecurity defenses are up to scratch to prevent data breaches from occurring in the first place.

The post Quarter of Americans Have Been Impacted by a Healthcare Data Breach appeared first on HIPAA Journal.

Healthcare Industry Threat Landscape Explored by Trend Micro

Posted by HIPAA Journal

Trend Micro has issued a new report that explores the healthcare industry threat landscape, the new risks that have been introduced by the inclusion of a swathe of IoT devices, and how cybercriminals are stealing and monetizing health data.

Cybercriminals are attacking healthcare organizations with increased vigor. More attacks occurred last year than any other year, while 2015 saw a massive increase in stolen healthcare records.

While the health data of patients is an attractive target, health records are not always being sold for big bucks on underground marketplaces. Health insurance cards can cost as little as $1, while EHR records start at around $5 per record set.

However, cybercriminals are now increasing their profits by processing and packaging the stolen data.  Data are used to obtain government-issued iDs such as driver’s licenses, passwords and birth certificates. Farmed identities of individuals who have died are being sold, which can see prices of more than $1,000 charged per identity, or even more if IDs are also supplied. A large haul of health data from an EHR system can see cybercriminals make considerable sums, so it is therefore no surprise that healthcare organizations and their EHR systems are being targeted.

The report provides insights into the healthcare industry threat landscape and shows how healthcare organizations are allowing chinks to develop in their cybersecurity armor.

For the report, Trend Micro performed a scan of connected healthcare devices via the search engine Shodan, which revealed how visible healthcare networks are via the Internet and how easy it is for cybercriminals to identify targets.

Shodan can be used by anyone with an Internet connection. The search engine returns details of Internet connected systems such as EHRs, along with medical equipment, appliances, printers and copiers together with the names of the organizations that own the devices.

Hackers can use Shodan to find devices and try to login using default passwords. Default passwords for those devices are freely accessible online. Even when passwords are changed, they are often replaced with weak passwords that can easily be guessed. Once access has been gained, the device can be used as a launch pad for an attack on other parts of the network. Alternatively, the devices can be reconfigured to record information that can be used in further attacks.

The Shodan scan revealed 36,116 healthcare-related records. Trend Micro reports that out of those records, “6,502 originated from the top 10 U.S. cities with exposed healthcare facilities.” The main cities with exposed healthcare facilities were Bethesda, Collegeville, Houston, Portland, and Phoenix, each of those cities accounted for between 10% and 18% of exposed healthcare facilities.

Many of the exposed healthcare organizations were also using out of date and unsupported operating systems such as Windows Server 2008 R2 and Windows XP. The search also revealed that 1,067 healthcare organizations had out of date security certificates.

Trend Micro discovered patch management failures were allowing vulnerabilities to remain unaddressed. 10 devices were discovered that had not been patched to protect against the Heartbleed vulnerability, even though the vulnerability was discovered and patched over two years ago.

Healthcare organizations can spend money on advanced cybersecurity protections, but it is essential that basic cybersecurity controls are not missed.

Given the value of healthcare data and the ease at which potentially vulnerable devices can be found, healthcare organizations must ensure that their networks are made more secure. At the very least, default passwords should be changed on all devices with strong passwords set. Patch management policies must cover all devices, and plans should be put in place to upgrade all devices that are still running on unsupported software.

Trend Micro’s report, Cybercrime and other Threats Faced by the Healthcare Industry, can be found on this link.

The post Healthcare Industry Threat Landscape Explored by Trend Micro appeared first on HIPAA Journal.

Beware of Medical Device Hijack Attacks! Medjack.3 Discovered

Posted by HIPAA Journal

In 2015, security researchers discovered MEDJACK malware: A form of malware developed specifically to attack medical devices such as heart monitors, MRI machines, and insulin pumps. While medical devices have long been a potential target for cybercriminals, until the discovery of MEDJACK, the threat of cyberattacks on medical devices was largely theoretical.

While MEDJACK could have been a one off, evidence emerged suggesting it was being actively developed. A second version of the malware – discovered last summer – was being used for advanced persistent attacks on hospitals via medical devices running on legacy systems.

Vulnerable medical devices were being used as a springboard to gain access to networks used to store the electronic protected health information of patients. TrapX security discovered that at least three attacks on healthcare providers had occurred using MEDJACK.2 by the summer of 2016.

MEDJACK.2 was capable of bypassing security controls as the malware used was old and was no longer deemed to be a threat by security solutions. More recent versions of Windows were protected against attacks using the malware so in many cases no alarms were triggered.

However, the attackers simply used an old malware wrapper to hide a range of cybersecurity tools. Tools that enabled them to install backdoors and move laterally within healthcare networks virtually undetected.

Now, security researchers at TrapX have discovered a third version of the malware. MEDJACK.3 is even more advanced and poses an even bigger threat to hospitals. The new version of the malware was discovered during an investigation of the medical infrastructure at ten UK hospitals.

As part of the investigation, TrapX created a number of fake medical devices such as MRI scanners. They noticed that those devices were being probed and that attackers were using a new method to discover and infect devices. While the method was new to MEDJACK, it had been seen before – many years previously. The attackers were using an old malware spreader to find and attack devices on older operating systems.

According to Anthony James, VP of marketing at TrapX, “Attackers are leveraging legacy malware-spreading tools that bypass a lot of today’s operating systems and target older systems.” The latest attacks are more targeted, with the attackers searching for specific devices that can be attacked rather than the more random approach seen last year.

Any device connected to an older, unpatched operating system was discovered to be vulnerable to attack and would accept the hacker’s tools. That included older operating systems such as Windows XP and Windows Server 2003, but also Windows 2008 and 2012. As was the case with MEDJACK.2, because the malware used was not perceived to pose a threat, the hackers were able to infect devices undetected.

TrapX has warned that many healthcare providers may already have been attacked with MEDJACK.3 and access may have been gained to their medical devices; possibly also the networks to which those devices are connected.

TrapX will be releasing a new white paper on MEDJACK.3 shortly.

The post Beware of Medical Device Hijack Attacks! Medjack.3 Discovered appeared first on HIPAA Journal.

2016 Healthcare Data Breach Report Ranks Breaches By State

Posted by HIPAA Journal

A new 2016 healthcare data breach report has been released that analyzes incidents reported to the Department of Health and Human Services’ Office for Civil Rights last year. While other reports have already been compiled, this latest report – compiled by data loss prevention firm Safetica USA –  shows where those data breaches occurred and the states most affected by healthcare data breaches in 2016.

Data for the 2016 healthcare data breach report was taken from the Office for Civil Rights breach portal, which includes all reported breaches of more than 500 records. The data show that the states most affected by healthcare data breaches are those with the highest number of residents and highest number of healthcare providers.

The top ten states for healthcare data breaches were found to be:

  1. California – 39 breaches
  2. Florida – 28 breaches
  3. Texas – 23 breaches
  4. New York – 15 breaches
  5. Illinois, Indiana, & Washington – 12 breaches
  6. Ohio & Pennsylvania – 11 breaches
  7. Michigan – 10 breaches
  8. Arizona & Arkansas – 9 breaches
  9. Georgia & Minnesota – 8 breaches
  10. Colorado & Missouri – 7 breaches

The states least affected by healthcare data breaches in 2016 were:

  1. Idaho
  2. Maine
  3. North Dakota
  4. South Dakota
  5. Vermont
  6. West Virginia

HIPAA-covered entities based in each of those states survived 2016 without experiencing a data breach that impacted more than 500 individuals. Only one HIPAA breach impacting more than 500 individuals was reported last year by a HIPAA-covered entity based in Alaska, Delaware, Hawaii, New Hampshire, Nevada, Utah and Wyoming.

The five worst hit states in terms of the numbers of records exposed were as follows:

  1. Arizona – 4,524,278 records
  2. New York – 3,588,554 records
  3. Florida – 2,872,912 records
  4. California – 1,436,701 records
  5. Georgia – 782,956 records

The main causes of healthcare data breaches in 2016 were unauthorized access/disclosure, which accounted for 41.5% of breaches, followed by hacking/IT incidents (31.8%), theft (19%), loss (5.4%) and improper disposal (2.3%).

Theft of physical PHI and devices used to store electronic protected health information was significantly lower than in 2015 when theft accounted for 30% of reported data breaches. In 2015, unauthorized access/disclosure was cited as the cause of 38% of breaches, hacking/IT incidents accounted for 21.4% of breaches, loss of PHI and devices used to store ePHI was the cause of 8.3% of breaches, and improper disposal was the cause of 2.3% of breaches.

The post 2016 Healthcare Data Breach Report Ranks Breaches By State appeared first on HIPAA Journal.

Cybercriminals Switch File Types to Infect More Organizations with Malware

Posted by HIPAA Journal

During the past year, spam volume increased considerably, as did the percentage of those emails that were malicious. The increase in malicious messages coincided with increased botnet activity. Botnets are now being used to send large-scale malware and ransomware campaigns. While spam email delivery of malware may have fallen out of favor in recent years, that is clearly no longer the case.

During 2016, cybercriminals favored malicious Office macros and JavaScript for downloading their malicious payloads. However, the Microsoft Malware Protection Center has identified a new trend. Rather than JavaScript, which is becoming easier to identify and block, cybercriminals have turned to less suspicious looking file types to infect end users.

Large-scale spamming campaigns are now being conducted that distribute malicious LNK and SVG files. These files are less likely to arouse suspicions than JavaScript and may make it past anti-spam defenses. LNK files – Windows shortcut files – are combined with PowerShell scripts which download malicious payloads when opened. Over the past year, PowerShell scripts have been used to download ransomware variants such as Locky.

Microsoft’s Malware Protection Center has identified one campaign that uses LNK files which attempts to download Locky from five different domains. “The use of multiple domains and the technique of storing the rest of the URL as a parameter is a way to circumvent URL filtering solutions. All the script needs is one URL that is not blocked in order to successfully download malware,” warns Microsoft.

Not all campaigns are used to download malicious files. Fileless malware is becoming more popular. Since PowerShell scripts are run directly in the memory, no file download is necessary. Malicious code remains in the memory. Even if endpoint security has been implemented, those solutions are unlikely to detect these fileless malware attacks.

Organizations can improve defenses against these fileless malware attacks by setting PowerShell policies to restricted, but is a relatively easy process to bypass these security policies and still run the scripts.

SVG – Scalable Vector Graphics – files are image files; however, it is relatively easy to incorporate obfuscated JavaScript into the files. Opening the file attachment will launch the JavaScript, which in turn will download the malware or ransomware.  SVG files are opened using browsers and the image will be displayed even if JavaScript has been incorporated into the file. End users who open these files are therefore unlikely to realize that malware is being silently downloaded.

Many organizations have responded to the threat of JavaScript downloaders by blocking their delivery through their spam filtering solutions. The change to PowerShell scripts could potentially see spam controls bypassed. To deal with the threat, organizations should also configure their spam filtering solutions to block LNK files. Since these file types are rarely sent in legitimate emails, blocking LNK files is unlikely to cause any problems.

SCG files are more commonly used, although organizations should consider also blocking these image types from delivery via email. If images do need to be sent, polices can be developed to require these file types to be communicated via other means, via Google Drive or Dropbox for example.

The post Cybercriminals Switch File Types to Infect More Organizations with Malware appeared first on HIPAA Journal.

IRS Issues Warning About W-2 Phishing Scams

Posted by HIPAA Journal

W-2 phishing scams increased considerably in 2015 prompting the IRS to issue a warning about the risk of attack. Now, just over 4 weeks into 2017, the IRS has issued a further warning in response to the sheer number of W-2 phishing scams that have been reported so far this year.

This type of scam – often referred to as business email compromise (BEC) or business email spoofing (BES) – is simple, but highly effective. The attacker sends an email request to a payroll or HR staff member and requests W-2 Form data for the entire workforce by return. Typically, the request is for the W-2 Forms of all individuals who worked in the previous tax year. The information is often asked for in PDF format.

The request appears to come from the company’s CEO, CFO, or another high-ranking executive with authority. Payroll and HR employee respond to the email and send data as requested as the email seems genuine. The individual who appears to have sent the request is likely to have a need for the information.

Research is conducted on the company by the attackers. They find out the email addresses of staff members to target and select an executive that is likely to have a need for W-2 Form data. The email address of the chosen executive is then spoofed using a variety of techniques to make the request appear to have been sent from within the company.

The consequences of responding to such a scam can be serious, certainly for an organization’s employees. The data on W-2 Forms can be used for a wide range of nefarious purposes, although the main purpose of the attack is to obtain the data necessary to file fraudulent tax returns.

Last year, there were at least 145 reports of successful W-2 phishing scams sent to the IRS and more than 29,000 employees were impacted by those scams. Given the number of successful scams already reported this year, 2017 looks set to be far worse than last year.

There have been at least 23 such scams pulled off in January, and over the past week, the number of reports received by the IRS has increased substantially.

It is not only the corporate world that is being targeted. Healthcare institutions, school districts, nonprofits, tribal organizations, restaurant chains, staffing agencies, shipping, and freight companies are all being targeted. In fact, any business or organization is a potential target.

This year, a new trend has emerged. In addition to the W-2 phishing scams, victims are also subjected to a second attack. The same spoofed email account is used to send a request to payroll or the comptroller requesting a bank transfer be made.

These scams were commonplace in 2016. In some cases, transfers of millions of dollars were sent to fraudsters’ accounts. The FBI reported that cybercriminals attempted to steal $3.1 billion by the middle last year. The transfer amounts ranged from around $10,000 to tens of millions of dollars.

The year may still be young, but several organizations have been stung twice and have sent W-2 Form data and made fraudulent bank transfers.

To avoid becoming a victim of these scams, employees must be made aware of the risk and instructed to exercise caution. Any request to send W-2 Form data should be treated as suspicious, even if that request appears to have been made by the CFO.

Policies should be introduced that require payroll/HR staff to properly authenticate any request for W-2 forms that are sent via email. Internal policies should also be developed covering wire transfers – and especially international wire transfers – to ensure such requests are authenticated before transfers are processed.

The post IRS Issues Warning About W-2 Phishing Scams appeared first on HIPAA Journal.

Email Spam Surged in 2016: 65% of Emails are Spam

Posted by HIPAA Journal

Email spam is seen by many as a productivity draining nuisance. It clogs inboxes and takes up precious time; although the volume of malicious spam has grown significantly in the past 12 months. Email spam remains a major security threat.

In 2010, following takedowns of botnets and arrests of key spammers, spam email volume fell. Spam email volume has since been relatively low. However, a recent analysis of email traffic by Cisco Systems has shown that spam email volume rose significantly last year.

Cisco tracked spam using opt-in customer telemetry and its data show that spam email now accounts for 65% of all emails sent. The sharp rise in email spam has been attributed to the growth of spam botnets such as Necurs. The Necurs botnet is one of the primary vectors used to deliver Locky ransomware and the Dridex banking Trojan.

The number of IP connection blocks added to the botnet increased significantly last year. Between August and October, Cisco reports a doubling of IP addresses used by the botnet, rising from around 200,000 to 400,000 IP addresses during that period.

In 2010, Cisco’s data show that around 5,000 spam emails were being sent every second. While there has been the occasional blip between then and now, spam email volume between 2010 and 2015 has remained at a level of around 1,500 spam emails per second. Last year did not see a return to 2010 levels, but spam email volume did rise to around 3,000 emails per second – Twice the volume seen in 2015.

Spam is unfortunately not just a nuisance. It is a serious security threat. The increase in email spam is not all cheap deals for watches and Viagra. There has been a sharp rise in malicious spam containing links to websites containing exploit kits and other threats, phishing email volume has increased, and there are malicious attachments aplenty.

Spam email has once again become a hugely popular attack vector for cybercriminals and it is being extensively used to spread malware, ransomware, and relieve employees of their credentials.

According to Cisco Systems, between 8% and 10% of spam emails are malicious. However, more significantly, the percentage of malicious emails has tripled over the course of last year and there is nothing to suggest that the trend will not continue in 2017.

The types of malicious attachments being sent are highly varied. Cybercriminals are experimenting with different files types to find out which are the most effective. There have been notable spikes in a wide range of malicious files in the past 12 months: HTA attachments, JavaScript files, zip files, Office documents and spreadsheets containing malicious macros, and WSF files.

Cisco systems reports two distinct tactics used by spammers: hailstorm and snowshoe campaigns. Hailstorm campaigns take advantage of the small window of opportunity between the campaign commencing and antispam solutions detecting the spammers’ malicious IP addresses. While the window may only last for seconds or minutes, during that time vast quantities of spam emails are sent. On the other hand, snowshoe campaigns involve very small quantities of spam being sent from IP addresses in an attempt to fly under the radar of antispam solutions.

With spammers’ tactics constantly evolving and malicious spam email volume increasing, healthcare organizations need to exercise caution. Antispam solutions should be deployed to reduce the risk of malicious messages being delivered to end users and CISOs should keep abreast of the latest threats. Warnings should then be issued to staff to prevent them being fooled by phishing scams and malicious messages containing ransomware/malware downloaders.

The Cisco Annual Cybersecurity Threat Report, which covers a broad range of attack vectors used by cybercriminals in 2016, can be viewed here.

The post Email Spam Surged in 2016: 65% of Emails are Spam appeared first on HIPAA Journal.

Forrester: Anthem-Sized Healthcare Data Breaches Will Be Commonplace in 2017

Posted by HIPAA Journal

The start of the year sees many worrying predictions made about healthcare cybersecurity and potential data breaches; however, Forrester Research has painted a particularly bleak picture for 2017. The firm expects data breaches on the scale of the 2015 Anthem Inc., cyberattack will be commonplace in 2017.

2016 saw more healthcare data breaches reported to OCR than in any other year. While the severity of those breaches was nowhere near as bad as in 2015, the same cannot be said of all industries. A report published last month by Risk Based Security shows that while the total number of data breaches – across all industries – was similar in 2016 to 2015, the severity of those data breaches was much worse. Large data breaches can be expected in 2017.

Forrester suggests that as healthcare organizations grow in size – through mergers, acquisitions and partnerships – the volume of patient data that each organization stores will increase. Large repositories of healthcare data will be seen as a major prize for cybercriminals and attacks on those large healthcare organizations can be expected.

Unfortunately, when healthcare organizations acquire other companies or merge with other healthcare firms, security becomes fragmented. Fragmented security makes it much more likely that vulnerabilities will be introduced that can be exploited by hackers.

The methods used to attack healthcare organizations are becoming more sophisticated and many traditional technologies are now becoming ineffective at preventing cyberattacks. Forrester also points out that many healthcare organizations are only improving their cybersecurity defenses to ensure compliance with the requirements of the Health Insurance Portability and Accountability Act (HIPAA). HIPAA only requires cybersecurity defenses to be improved to ensure a minimum standard is met, not to ensure that patient data cannot be accessed by hackers.

Ensuring patient health information is safeguarded requires considerable investment in new technologies, yet the healthcare industry lags behind other industry sectors when it comes to cybersecurity defenses. Previous studies by Forrester have shown that healthcare organizations typically devote smaller percentages of their IT budgets to security.

Across all industries, the average percentage of IT budgets directed to security is 26%. For the healthcare industry it is 23%. However, the telecommunications sector devotes 35% of IT budgets to security. Forrester suggests that due to the highly sensitive nature of healthcare data and its value to cybercriminals, healthcare IT security budgets should be increased to a similar level.

In addition to a rise in massive healthcare data breaches, Forrester predicts that the number of IoT devices that are compromised will increase to more than 500,000 in 2017, leading to massive DDoS attacks even larger than those seen in the tail end of 2016.

A Fortune 1000 company failure is probable in 2017 as a direct result of a cybersecurity incident, while Forrester says President Trump will likely face a major cyber crisis in his first 100 days in office. The final prediction is a lack of cybersecurity talent will see CISOs forced to outsource as much as 25% of their security budgets to external providers of security services and automation.

The post Forrester: Anthem-Sized Healthcare Data Breaches Will Be Commonplace in 2017 appeared first on HIPAA Journal.

IoT and Mobile Application Vulnerabilities Not Being Adequately Addressed

Posted by HIPAA Journal

Organizations around the world are taking advantage of IoT applications and mobiles to improve efficiency, yet too little is being done to ensure the applications are secure.

Organizations can benefit greatly from IoT and mobile technology, yet it is all too easy for major security risks to be introduced. Hackers are well aware of vulnerabilities in mobile and IoT applications and leverage those vulnerabilities to gain access to networks and sensitive data.

IoT infrastructure is vulnerable to attack, although the greatest risks are introduced by embedded software in gateways and the cloud. Many IT security practitioners are well aware of the security risks that can potentially be introduced, yet according to a recent survey conducted by the Ponemon Institute, little is being done to mitigate risk.

593 IT and IT security professionals were surveyed for the Arxan/IBM Security-sponsored survey, which set out to discover how companies are mitigating risk from mobile apps and IoT applications. The results of the survey are alarming. 8 out of 10 respondents said that while IoT applications are in use, their organization does not test them for security vulnerabilities. 71% or respondents said they use mobile applications that have not been subjected to vulnerability testing.

IT security professionals are aware of the risks and are concerned that vulnerabilities will be exploited. 58% of respondents said they were concerned that vulnerabilities in IoT apps would be exploited by hackers, while 53% expressed concern that mobile applications would be hacked. 75% of respondents said IoT apps increase security risk very significantly or significantly.

Malware is also a major worry. A lack of protection against mobile malware was seen as a problem by 84% of respondents, while 66% were concerned about the malware threat to IoT applications.

Part of the problem is a lack of understanding about how IoT and mobile applications should be tested. 55% of respondents said they lacked QA and testing methods for IoT applications.

In many cases, IT security professionals are unsure about how many apps are actually in use. 63% of respondents were not confident that they were aware of the mobile apps that were being used by employees, and 75% were unsure that they were aware of all the IoT apps that were being used.

The data security risks are very real. 60% of individuals surveyed claimed their organization had experienced a data breach or security issue as a result of a mobile app.

Even though there are known risks, 44% of respondents said their organization was not taking any steps to prevent an attack. Protecting these apps is simply not a priority at many organizations. Only 32% of respondents said their organization wanted to urgently secure mobile apps, while 42% said they wanted to urgently security IoT apps. Budgetary restrictions were seen as the main problem by 30% of respondents.

Larry Ponemon, chairman and co-founder of the Ponemon Institute, said “Without proper budget or oversight, these threats aren’t being taken seriously and it should come as no surprise for mobile and IoT applications to be the culprit of major data breaches to come.”

Organizational Complexity is Hindering Cybersecurity Efforts

The results of a separate study published earlier this month by the Ponemon revealed that the biggest barrier preventing adequate cybersecurity defenses from being implemented is organizational complexity.

The global Citrix-sponsored study was conducted on 4,200 IT security practitioners from Australia, Brazil, Canada, China, Germany, France, India, Japan, Korea, Mexico, New Zealand, the Netherlands, United Arab Emirates, the United Kingdom and the United States.

The survey revealed that 79% of respondents were worried about data breaches involving high-value, sensitive information. 71% of respondents said they their organization is at risk because they are unable to effectively control employee devices and apps. 74% of respondents said their organization requires a new IT security framework if they are to successfully manage risk and improve their security posture.

The biggest barrier that is preventing businesses from improving their security posture was organizational complexities. 83% of respondents said organizational complexities were hampering cybersecurity efforts. Corporate security policies are being ignored because they are hindering employees’ and preventing them from working in their preferred manner. All too often security policies have a considerable negative impact on productivity.

As employees try to get more work done, they look to go-arounds such as shadow IT and data are being stored on personal devices to speed up access. 87% of respondents said information is being placed at risk as a result of an increase in data assets.

Larry Ponemon said “The research reveals respondents’ awareness of the need to challenge the status quo of their IT security strategies and consider a new IT security architecture to safeguard their organizations from cyber risks.”

The post IoT and Mobile Application Vulnerabilities Not Being Adequately Addressed appeared first on HIPAA Journal.