IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Vast majority of US healthcare web apps vulnerable to attack

Report suggests patient data is at risk from poor security hygiene

A heartbeat monitor displayed inside an operating room

Nine in ten web applications used by US healthcare operators are highly susceptible to attack or vulnerability exposure, according to a new report.

The 2021 Web Application Security for Healthcare report, published by IT security firm Outpost24, found that most US healthcare providers (90%) had an external attack surface score of above 30 (out of 58.4). This score was categorized by the firm as ‘critically exposed’, indicating a high susceptibility for security and vulnerability exposure.

The report also found that US healthcare organizations had a larger attack surface with an average risk exposure score of 40.5 when compared to EU pharmaceutical organizations, which had a score of 32.79. 

This is despite US healthcare providers running 30% fewer external web applications compared to the top ten largest EU pharma manufacturers, which had 20,394 apps.

The top ten US healthcare organizations ran 6,069 web applications over 2,197 domains, with 3% of these regarded as suspicious. The report said these could be test environments that should be closed, since they are open to hackers. It was also found that 24% of these applications were running on old components containing exploitable vulnerabilities.

The report said that it was important that healthcare security teams get a handle on their application security to reduce the risk of ransomware and other malware from both known and unknown applications.

“With security resources feeling the strain and having a multitude of elements to manage including hybrid working from the pandemic, it's challenging to identify all web services on the Internet containing old components. We identified 19.5% of all US and EU applications analyzed use old components, increasing the security exposure from known vulnerabilities which has a knock-on effect on security hygiene,” the report’s authors said.

Although the report found that EU healthcare applications were more up to date than those run by US organizations, the number of live applications was 236% higher.

“This reveals the different weaknesses in their attack surface - with EU organizations having a much larger attack surface, possibly a result of shadow IT; and US organizations being more at risk of potential exploits from vulnerable software components,” the authors stated.

Related Resource

What to consider when choosing a next-generation firewall

How to choose a NGFW solution

Vector of an envelope with a padlock over it on a blue backgroundFree download

Nicolas Renard, a security researcher at Outpost24, said it was essential that healthcare organizations carry out the necessary due diligence to continuously evaluate their internet security perimeter given the highly sensitive information stored.

“Any kind of data breach and downtime for healthcare organizations can be fatal, therefore they must take a proactive stance to identify and mitigate potential security issues before critical care can be impacted,” he added.

Featured Resources

The 3D skills report

Add 3D skills to your creative toolkits and play a sizeable role in the digital future

Free Download

The increasing need for environmental intelligence solutions

How sustainability has become a major business priority and is continuing to grow in importance

Free Download

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

Solve global challenges with machine learning

Tackling our word's hardest problems with ML

Free Download

Recommended

Accelerating healthcare transformation through patient-centred medtech solutions
Whitepaper

Accelerating healthcare transformation through patient-centred medtech solutions

20 Oct 2022
Protecting healthcare from cybercrime
Whitepaper

Protecting healthcare from cybercrime

25 May 2022

Most Popular

Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023
European partners expect growth this year, here are three ways they will achieve it
Sponsored

European partners expect growth this year, here are three ways they will achieve it

17 Jan 2023
GTA V vulnerability exposes PC users to partial remote code execution attacks
vulnerability

GTA V vulnerability exposes PC users to partial remote code execution attacks

23 Jan 2023