Monday, November 9, 2015

Only as strong as the weakest link - Medical/Healthcare numbers

When comparing security posture and stats for business sectors, does medical/healthcare lag behind other sectors?
The largest increase in theft since 2010 has been medical records and in 2014, 43% of the all data stolen had medical data. Community Health Systems’ breach of 4.5 million patient data help bring this to the forefront, making medical information to be 10 times more valuable - according to ITRC data.  Healthcare data exploits are not immediately apparent / exploited and with persistent growth in EMR (Electronic Medical Records) and voluminous medical device endpoints, risk is expansive/high.

In the past 10 years, there have been approx. 5,500 total breaches and 829 million number of records breached.  ITRC (Identity Theft Resource Center) labels them into 5 categories: business, financial/credit, educational, government/military and medical/healthcare. Comparing some of the sectors over that last decade showed a trend from Educational in 2005 being the largest target to Business in 2007-2011 and now Health/Medical in 2012-2014:
Health/Medical: #of Breaches was 16 in 2005 vs. 333 in 2014; representing 10% vs. 43% of overall year volume respectively (and so Health is the largest volume in 2014 comparatively)
Financial/Credit: # of Breaches was 20 in 2005 vs. 43 in 2014; representing 13% vs. 6% overall year volume respectively (making Financial drop to the lowest volume in 2014 comparatively)
Business: # of Breaches was 25 in 2005 vs. 258 in 2014; representing 16% vs. 33% of overall year volume respectively (hence, Business is 2nd largest volume in 2014 comparatively)

ITRC started tracking type of incidents in 2007 which showed nearly 50% resulted from Data on the Move and Accidental Exposure; but in 2014, that altogether to be Hackers and Subcontractors:
Data on the move accounted for 123 or 28% overall in 2007 vs. 62 or 8% overall in 2014
Hacking accounted for 63 or 14% overall in 2007 vs. 227 or 29% (now highest incident category)
Subcontractor accounted for 52 or 12% in 2007 vs. 118 or 15% (runner up for 2014)

These stats make for good eye candy charts and one might wonder what totals would be if today's breach notification were applied 10 years ago; and all breaches reported.

No comments:

Post a Comment