TY - GEN
T1 - Cybersecurity Monitoring/Mapping of USA Healthcare (All Hospitals) - Magnified Vulnerability due to Shared IT Infrastructure, Market Concentration, & Geographical Distribution
AU - Yurcik, William
AU - Schick, Andreas
AU - North, Stephen
AU - Gastner, Michael T.
AU - De Miranda, Fabio Roberto
AU - Avelino, Rodolfo da Silva
AU - Batista, Andre Filipe de Moraes
AU - Pluta, Gregory
AU - Brooks, Ian
N1 - This research was enabled through a cooperative agreement between the University of Illinois at Urbana-Champaign and BitSight. BitSight provided no financial support to this research. Cybersecurity ratings for hospitals presented in this research were processed by BitSight engineers led by Rhonda O Kane and supported by Tadd Hopkins, Tim Jackson, Tom Linehan, and Will Ricardi. Geocoding was provided by GeoCoder.ca who provided public service access to their geography mapping scripts. Geocode provided no financial support to this research. Coauthor MTG is supported by the Ministry of Education, Singapore, under its Academic Research Fund Tier 2 (EP2) programme (Award No. MOE-T2EP20221-0007).
PY - 2024/11/21
Y1 - 2024/11/21
N2 - In October 2024, there are two defining characteristics of a healthcare provider: (1) geographic location and services available at their physical structure and (2) Internet connectivity and services available via their virtual presence. For previous centuries we focused on the first defining characteristic and now we need to shift to understand and address issues that may arise from the new second defining characteristic. In this paper we address issues related to Internet connectivity and virtual presence of USA healthcare providers, especially hospitals, when ransomware cyberattacks resulting in service outages occur. We show the cybersecurity posture of a large critical national infrastructure (USA healthcare) can be measured, mapped, and quantitatively baselined. Empirical results reveal systemic issues in USA healthcare presenting "magnified vulnerabilities"in that a single exploit can have an outsized impact on an entire nationwide infrastructure. As the initial step toward addressing this issue, we document for the first time the magnified cybersecurity vulnerability of USA healthcare to shared IT infrastructure, market concentration, and the geographical distribution of hospitals.
AB - In October 2024, there are two defining characteristics of a healthcare provider: (1) geographic location and services available at their physical structure and (2) Internet connectivity and services available via their virtual presence. For previous centuries we focused on the first defining characteristic and now we need to shift to understand and address issues that may arise from the new second defining characteristic. In this paper we address issues related to Internet connectivity and virtual presence of USA healthcare providers, especially hospitals, when ransomware cyberattacks resulting in service outages occur. We show the cybersecurity posture of a large critical national infrastructure (USA healthcare) can be measured, mapped, and quantitatively baselined. Empirical results reveal systemic issues in USA healthcare presenting "magnified vulnerabilities"in that a single exploit can have an outsized impact on an entire nationwide infrastructure. As the initial step toward addressing this issue, we document for the first time the magnified cybersecurity vulnerability of USA healthcare to shared IT infrastructure, market concentration, and the geographical distribution of hospitals.
KW - cybersecurity ratings
KW - hospital cybersecurity
KW - ransomware
UR - http://www.scopus.com/inward/record.url?scp=85215125103&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85215125103&partnerID=8YFLogxK
U2 - 10.1145/3689942.3694754
DO - 10.1145/3689942.3694754
M3 - Conference contribution
AN - SCOPUS:85215125103
T3 - HealthSec 2024 - Proceedings of the 2024 Workshop on Cybersecurity in Healthcare, Co-Located with: CCS 2024
SP - 45
EP - 52
BT - HealthSec 2024 - Proceedings of the 2024 Workshop on Cybersecurity in Healthcare, Co-Located with
PB - Association for Computing Machinery
T2 - 2024 Workshop on Cybersecurity in Healthcare, HealthSec 2024
Y2 - 14 October 2024 through 18 October 2024
ER -