Tech & Innovation in Healthcare

Question: Our IT department is short on staff, and they’re considering automating cybersecurity services to help fill in the gaps until the positions are filled.

Is automating parts of our cybersecurity a good or bad idea?

Nebraska Subscriber

Answer: Like most technologies, there are pros and cons to using automation — especially in the healthcare industry. For example, automated technologies make it easy for healthcare organizations to identify and react to cybersecurity threats quickly and efficiently, and the technologies can also free up human resources to handle other IT tasks. At the same time, cyberthreat actors can take advantage of automation in their efforts to harm your organization’s systems.

On Dec. 8, 2022, the Health Sector Cybersecurity Coordination Center (HC3) issued a detailed brief regarding the possible impacts of automation on healthcare cybersecurity and in other industries. According to HC3, automation is “[t]he use of largely automatic equipment in a system of manufacturing or other production process.” This process can be accomplished with hardware or software, and automation reduces the amount of human involvement in a given task.

Cyberthreat actors can use automation software to quickly identify valuable information, such as:

• Credit card data
• Personal/sensitive information
• Email addresses
• Passwords

Threat actors also use software to automate attacks on your organization’s resources. Two of the most frequently used automated attacks involves credential stuffing and brute force attempts. The automation software uses commonly used or stolen passwords, and then attempts to use the information to gain access to the users’ accounts. Other automated attacks include keyloggers and banking injects, the latter of which can redirect the user from a legitimate website and then steal the user’s credentials.

Threat actors can also use automation to move through the different phases of the cyber kill chain, according to HC3. Developed in 2011 by Lockheed Martin, the cyber kill chain is a tool to defend “against advanced threat actors.”

At the same time, cybersecurity professionals can use automation to fend off malicious threats. Your healthcare organization’s cybersecurity team can use automation tools to scan for vulnerabilities, monitor traffic to detect and block suspected malicious activity, and alert the team of possible security events.