Healthcare Hit Hardest by DNS Attacks During the Pandemic, EfficientIP and IDC Report Finds
The 2021 Global DNS Threat Report from EfficientIP and IDC puts the average cost of a DNS attack on a healthcare organisation at $862,630, up 12% in a year.
No industry suffered more from DNS attacks during the COVID-19 pandemic than healthcare, according to new research by EfficientIP and International Data Corporation (IDC). Their 2021 Global DNS Threat Report puts the average cost of a single attack on a healthcare organisation at $862,630. That is 12% more than the previous year, the steepest rise recorded in any sector.
Downtime, defaced websites and stolen data
The report finds healthcare more exposed than other sectors to a range of consequences. It is the industry most likely to lose applications to downtime, which 53% of healthcare respondents reported. It also had the highest share of compromised websites (44%) and of damage to its brand (31%). Cloud service outages were the second most common impact, at 46%. With the sector already under pandemic strain, the authors note, interruptions to apps, services and cloud platforms could weigh heavily on patients and providers alike.
Other effects included lost business (34%) and theft of customer information (23%), a figure that has climbed from 13% a year earlier. Patient and customer data is especially sensitive in healthcare, which makes the sector an appealing target, all the more so while it is under heavy pressure.
Attacks on healthcare are clearly increasing in many Asia Pacific countries, notably Thailand, Malaysia and the Philippines. A breach of sensitive medical data at a health insurer operating in the region drew attention to what cyberattacks can do when demand for care is high. In Indonesia, the national healthcare programme was attacked earlier in the year, putting the social security details of more than 100,000 people at risk of fraud and further digital attacks, including personal records, social security numbers and payment status.
Ronan David, vice-president of strategy at EfficientIP, said it had been widely expected that healthcare would be a major target during the pandemic. What he found both fascinating and useful was seeing the evidence laid out: fascinating because it finally gives a clear quantitative picture, and useful because it shows where companies such as EfficientIP can help healthcare providers strengthen their defences.
Phishing leads the attack types
Over a 12-month period, each healthcare organisation faced 6.71 DNS attacks on average. Mitigating each one took 6.28 hours on average, longer than the 5.62-hour average across all industries.
As in many other sectors, phishing was the most frequent type of DNS attack, experienced by 49% of the healthcare companies surveyed, in line with the cross-industry average. DNS-based malware affected 36%, DNS tunnelling 29% and DNS domain hijacking 28%. DDoS attacks were comparatively rare in healthcare, at 19% against an all-industry figure of 29%.
Singapore's healthcare sector has also been exposed to the risk of government data being hacked through malware. The Singapore government had earlier found millions of internet-connected medical devices, among them ultrasound machines, patient monitors and medical imaging equipment, that were open to attack. When healthcare infrastructure is hit, the damage can be severe and reach patient care and well-being directly.
Zero Trust and DNS security as the response
That is why defence strategy carries so much weight in the sector. Healthcare organisations have been turning to Zero Trust and to more intelligent DNS security. According to the report, 79% of healthcare organisations are planning, rolling out or already operating Zero Trust initiatives, more than the 75% average across industries. The sector is also the most convinced that DNS domain deny and allow lists, which give tighter control over which users reach which applications, are valuable for Zero Trust (82%, against 79% overall).
Like many other industries, healthcare regards DNS security as essential to protecting remote staff, a view held by 54% of the healthcare companies in the survey. Some 78% said DNS security was a critical part of network architecture, and 27% named improved monitoring and analysis of DNS traffic as their first priority for stopping data theft.