Hospitals’ Cybersecurity Culture during the COVID-19 Crisis

Abstract

The coronavirus pandemic led to an unprecedented crisis affecting all aspects of the concurrent reality. Its consequences vary from political and societal to technical and economic. These side effects provided fertile ground for a noticeable cyber-crime increase targeting critical infrastructures and, more specifically, the health sector; the domain suffering the most during the pandemic. This paper aims to assess the cybersecurity culture readiness of hospitals’ workforce during the COVID-19 crisis. Towards that end, a cybersecurity awareness webinar was held in December 2020 targeting Greek Healthcare Institutions. Concepts of cybersecurity policies, standards, best practices, and solutions were addressed. Its effectiveness was evaluated via a two-step procedure. Firstly, an anonymous questionnaire was distributed at the end of the webinar and voluntarily answered by attendees to assess the comprehension level of the presented cybersecurity aspects. Secondly, a post-evaluation phishing campaign was conducted approximately four months after the webinar, addressing non-medical employees. The main goal was to identify security awareness weaknesses and assist in drafting targeted assessment campaigns specifically tailored to the health domain needs. This paper analyses in detail the results of the aforementioned approaches while also outlining the lessons learned along with the future scientific routes deriving from this research.

Cybersecurity in health sector: a systematic review of the literature

“…Medical organizations face a battle in protecting their systems and digital equipment against a variety of cyber threats [41]- [43]. Because of this, the authors mention that blockchain technology preserves the security and privacy of data against cyber-attacks, this technology is based on a blockchain [44]- [51] this technology comprises several nodes which hide confidential information of the organization and prevents them from being disclosed to malicious nodes [52]- [56] advanced encryption and has a rapid response plan for such incidents [57]- [59], he blockchain alerts to any possible cyber-attack by preventing hackers from altering the stored information [60]- [65]. On the other hand, the authors recommend the ontology tool that is equipped with rules, classifying security threats and automatically recommending controls that can be applied in the face of a threat [66], [67].…”

Phishing simulation exercise in a large hospital: A case study

“…Not all hospitals are willing to do this, and few research exercises take place ‘in the wild’ which limits their effectiveness. Other attempts to investigate phishing susceptibility within hospitals have used alternative means of measurement such as a phishing questionnaire 2 Whilst research projects offer more control over the demographics of participants and control over experimental conditions which facilitates statistical comparisons of participants by demographic and/or experimental conditions, they are not a reliable measure of behaviour ‘in the wild’.…”

“…The COVID-19 pandemic saw an increase in phishing attacks in general 1 and targeted at the healthcare sector specifically. 2 Phishing is a form of deception in which the attacker sends a fraudulent message designed to trick a human target into revealing sensitive information or to enable malicious software such as ransomware to infiltrate the target's infrastructure. Phishing is typically carried out through email, 3 , 4 though less common forms exist through SMS (Smishing) or Voice calls (Vishing).…”

How Do Public Perceptions Affect the Security of Connected Places? A Systematic Literature Review

“…However, the wide-ranging pre-existing levels of awareness amongst public users of connected places use a one-size-fits-all approach for the explanation of security and privacy issues, which is challenging. For example, many members of the public have a good understanding of network and data security processes but with low awareness of threats [26], or the information being shared by their devices in a connected place [8,18].…”

“…Taher et al [28] suggest students' privacy concerns in 'smart campus buildings' are influenced by their experiences and knowledge in other computing contexts, and that similar consent controls would be desirable. Other authors commented on the influence of the personal experience of cyberattack in cyberspace, as opposed to in a (a) cyber-physical environment (connected place [28]); (b) demographic differences (age, gender [18,29]); and (c) pre-existing awareness of cybersecurity vulnerabilities and controls [26]. However, none of these findings are comprehensively investigated enough to draw any applicable conclusions from.…”