Black Book's Annual Cybersecurity Survey Reveals Healthcare Enterprises Are Not Maturing Fast Enough, Processes Continue Underfunded and Understaffed

TAMPA, Fla., May 14, 2018 (Newswire.com) - ​​Black Book Market Research LLC surveyed over 2,464 security professionals from 680 provider organizations to identify gaps, vulnerabilities and deficiencies that persist in keeping hospitals and physicians proverbial sitting ducks for data breaches and cyber attacks.  Ninety-six percent of IT professionals agreed with the sentiments that data attackers are outpacing their medical enterprises, holding providers at a disadvantage in responding to vulnerabilities.

A fragmented mix of 410 vendors offering data security services, core products and solutions, software, consulting and outsourcing received user feedback including large IT companies, mid and small security vendors and start-ups in the polling period Q3 2017 to Q2 2018. 

Over 90 percent of healthcare organizations have experienced a data breach since Q3 2016 and nearly 50 percent have had more than five data breaches during the same timeframe.  Not only has the number of attacks increased, more than 180 million records have been stolen since 2015, affecting about one in every 12 healthcare consumers.

The dramatic rise in successful attacks by both criminal and nation-state-backed hackers illustrates how attractive and vulnerable these healthcare enterprises are to exploitation. Despite these wake-up calls, the provider sector remains exceedingly susceptible to ongoing breaches.

Budget constraints have encumbered the practice of replacing legacy software and devices, leaving enterprises more susceptible to an attack. “It is becoming increasingly difficult for hospitals to find the dollars to invest in an area that does not produce revenue,” said Doug Brown, founder of Black Book. According to 88 percent of hospital representatives surveyed, IT security budgets have remained level since 2016. As a percentage of IT organizational budgets, cybersecurity has decreased to about three percent of the total annual IT spend.

A third of hospital executives that purchased cybersecurity solutions between 2016 and 2018 report they did so blindly without much vision or discernment.  Ninety-two percent of the data security product or service decisions since 2016 were made at the C level and failed to include any users or affected department managers in the cybersecurity purchasing decision. Only four percent of organizations had a steering committee to evaluate the impact of the cybersecurity investment.

“The dilemma with cybersecurity budgeting and forecasting is the lack of reliable historical data,” said Brown. “Cybersecurity is a newer line item for hospitals and physician enterprises and budgets have not evolved to cover the true scope of human capital and technology requirements yet.”

Last year’s Black Book cybersecurity survey revealed 84 percent of hospitals were operating without a dedicated security executive. As a solution to unsuccessfully recruiting a qualified healthcare chief information security officer, 21 percent of organizations opted for security outsourcing to partners and consultants or selected security-as-a-service options as a stop-gap measure.

That shortage of healthcare cybersecurity professionals is forcing a rush to acquire services and outsourcing at a pace five times more than cybersecurity products and software solutions. Cybersecurity companies are responding to the labor crunch by offering healthcare providers and hospitals with a growing portfolio of services.

“The key place to start when choosing a cybersecurity vendor is to understand your threat landscape, understanding the type of services vendors offer and comparing that to your organization’s risk framework to select your best-suited vendor,” said Brown. “Healthcare organizations are also more prone to attacks than other industries because they persist at managing through breaches reactively.”

Fifty-seven percent of IT management respondents report their operations are not aware of the full variety of cybersecurity solution sets that exist, particularly mobile security environments, intrusion detection, attack prevention, forensics and testing.

Fifty-eight percent of hospitals did not select their current security vendor in advance of a cybersecurity incident.

Thirty-two percent of healthcare organizations did not scan for vulnerabilities before an attack.

“Providers are at a severe disadvantage when they are forced to hastily retain a cybersecurity firm in the midst of an ongoing incident as the ability to conduct the necessary due diligence is especially limited,” said Brown.

Sixteen percent of healthcare organizations reported they felt intimidated by a vendor to retain services when the vendor identified a vulnerability or security flaw. “While the intrinsic nature of cybersecurity radiates pressures and urgency, hospitals shouldn’t let this dictate the vendor selection process,” said Brown.

Sixty percent of healthcare enterprises have not formally identified specific security objectives and requirements in a strategic and tactical plan. Without a clear set of security goals, providers are operating in the dark and it's impossible to measure results.

Eighty-three percent of healthcare organization have not had a cybersecurity drill with an incident response process, despite the skyrocketing cases of data breaches in the healthcare industry.

Only 12 percent of hospitals and nine percent of physician organizations believe that a Q2 2019 assessment of their cybersecurity will show improvement. Twenty-three percent of provider organizations believe their cybersecurity position will worsen, as compared to three percent in other industries.

In 2018, 24 percent of providers still do not carry out measurable assessments of their cybersecurity status. Of those that did, seven percent used an objective third-party service to benchmark their cybersecurity status, six percent used an objective software solution to benchmark their cybersecurity status and 78 percent self-assessed with their own criteria.

Twenty-nine percent of respondents currently report they do not have an adequate solution to instantly detect and respond to an organizational attack.

Seventy-four percent of surveyed CIOs did not evaluate the total cost of ownership (TCO) before making a commitment to sign their current cybersecurity solution or service contract. Eighty-nine percent reported they bought their cybersecurity solution to be compliant, not necessarily to reduce risk when the IT decision was made.

Healthcare organizations are hyper-focused on patient care and reimbursement. "Cybersecurity risks are not on the forefront of executives’ minds,” said Brown. “Medical and financial leaders also wield more influence over organizational budgets making it difficult for IT management to implement needed cybersecurity practices despite the existing environment.”

BLACK BOOK ANNOUNCE THE 2018 TOP CYBERSECURITY SERVICES & SOLUTIONS VENDORS

Black Book Market Research LLC conducts polls and surveys with healthcare executives and front-line users about their current technology and services partners and awards top-performing vendors based on performance based on 18 qualitative indicators of client experience and solution/service satisfaction and three indicators of customer loyalty. Black Book surveyed users of 18 categories of cybersecurity vendors, consultants and advisors which produced the 2018 rankings of No. 1 performing suppliers.  

AUTHORIZATION & AUTHENTICATION SOLUTIONS – FIREEYE

Other Top Authorization & Authentication Solution Vendors include: SAILPOINT, AVATIER, SECUREAUTH, AUTH0, OPTIMAL IDM, CROSSMATCH & IMPRIVATA.

BLOCKCHAIN SOLUTIONS – HASHED HEALTH

Other Top Blockchain Solution Vendors include: POKITDOK, IBM BLOCKCHAIN, HEALTHCOMBIX, MEDICAL CHAIN, HEALTH LINKAGES, GEM & BLOCK MD.

COMPLIANCE & RISK MANAGEMENT SOLUTION – CLEARWATER COMPLIANCE

Other Top Compliance & Risk Management Solution Vendors include: EY, DELOITTE, SERA-BRYNN, KPMG, COALFIRE, CYNERGISTEK & BAE SYSTEMS.

CYBERSECURITY ADVISORS & CONSULTANTS – LEIDOS

Other Top Compliance & Risk Management Solution Vendors include: KPMG, EY, SECURE DIGITAL SOLUTIONS, CYNERGISTEK, IBM, ATOS & IMPACT ADVISORS.

CYBERSECURITY TRAINING & EDUCATION – KNOWBE4

Other Top Cybersecurity Training Solution Vendors include: INSPIRED ELEARNING, DIGITAL DEFENSE, THE SANS INSTITUTE, (ISC)2, OPTIV, VANGUARD & CIRCADENCE.

DDOS ATTACK PROTECTION – IMPERVA

Other Top Cybersecurity DDOS Attack Protection Vendors include: CLOUDFLARE, F5 NETWORKS, FORTINET, ARBOR NETWORKS, NEXUSGUARD, AKAMAI TECHNOLOGIES & ROOT9B.

END POINT SECURITY SOLUTIONS – CARBON BLACK

Other Top End Point Security Solutions include: SYMANTEC, FORTINET, CHECKPOINT SOFTWARE, FORTINET, DUO, ABSOLUTE SOFTWARE, COUNTER TACK, TREND MICRO & MCAFEE.

ENTERPRISE ACCESS MANAGEMENT – BOMGAR

Other Top Access Management Vendors include: IMPRIVATA, TREND MICRO, MICROSOFT, CISCO, SAILPOINT, RSA SECURITY & MICRO FOCUS.

ENTERPRISE FIREWALL NETWORKS – FORTINET

Other Top Firewall Network Vendors include: SONICWALL, ZSCALER, CHECKPOINT SOFTWARE, PALO ALTO NETWORKS, CISCO, HUAWEI, FOREPOINT & SOPHOS.

HEALTHCARE DATA ENCRYPTION – ONPAGE

Other Top Data Encryption Vendors include: SENETAS, THALES, DATA LOCKER, SYMANTEC, SOPHOS, CHECKPOINT SOFTWARE, TREND MICRO, FLEXENTIAL, VIRTRU & APRICORN.

INTRUSION PROTECTION SOLUTIONS – IMPERVA

Other Top Intrusion Protection Solution Vendors include: CISCO, INTEL SECURITY (MCAFEE), TREND MICRO TIPPING POINT, IBM, PALO ALTO NETWORKS, ALERT LOGIC, HEWLETT PACKARD & EXTREME NETWORKS.

MEDICAL DEVICE & INTERNET OF THINGS SECURITY – FORTIFIED HEALTH SECURITY

Other Top Medical Device & IoT Security Solution Vendors include: BAYSHORE NETWORKS, SENRIO, RUBICON, SECURERF & BASTILLE.

OUTSOURCING & NETWORK MANAGED SERVICES – TRUSTWAVE

Other top Outsourcing & Managed Services Vendors include: CYTELLIX, SECUREWORKS, DXC TECHNOLOGIES, ARMOR, BOMGAR, NTT, OPTIV, LEVEL3, AT&T & SECUREWORKS.

PATIENT PRIVACY MONITORING – FAIRWARNING

Other Top Patient Privacy Monitoring Solution Vendors include: CONVERGEPOINT, HAYSTACK, IATRIC, CYNERGISTEK, MAIZE ANALYTICS, JERICHO SYSTEMS & TRUE VAULT.

RANSOMWARE PROTECTION – ZIX CORPORATION

Other Top Ransomware Protection Solution Vendors include: IBOSS, ZSCALER, DIGITAL GUARDIAN, WEBSENSE, CISCO, SYMANTEC & BARKLY.

SECURE COMMUNICATIONS PLATFORMS – DOC HALO

Other Top Secure Communications Platform Vendors include: PERFECTSERVE, PATIENT SAFE SOLUTIONS, VOCERA, IMPRIVATA, SPOK, ONPAGE, TIGER TEXT & TELEMEDIQ.

THREAT DETECTION & CYBER ATTACK PREVENTION – DIGITAL GUARDIAN

Other Top Threat Detection & Prevention Vendors include: SYMANTEC, FORCEPOINT, CROWDSTRIKE FALCON, CARBON BLACK, TRAPX SECURITY, MCAFEE, FIREEYE, IBM, FORTINET & CYLANCE.

THREAT INTELLIGENCE & ANALYTICS – JVION

Other Top Threat Intelligence & Analytics Vendors include: EY, RAYTHEON, RAPID7, CSC, HAYSTACK, NOVETTA, REDSEAL & SAS INSTITUTE.

About Black Book Research

Black Book Market Research LLC, its founder, management and staff do not own or hold any financial interest in any of the vendors covered and encompassed in the surveys it conducts. Black Book reports the results of the collected satisfaction and client experience rankings in publication and to media prior to vendor notification of rating results and does not solicit vendor participation fees, review fees, inclusion or briefing charges and/or vendor collaboration as Black Book polls vendors’ clients.

In 2009, Black Book began polling the healthcare user and client experience of now over 600,000 healthcare software and services users. Black Book expanded its survey prowess and reputation of independent, unbiased crowd-sourced surveying to IT and health records professionals, physician practice administrators, nurses, financial leaders, executives and hospital information technology managers. Cybersecurity services and products satisfaction and client experience polling was initiated in 2013 by Black Book Market Research LLC.

Source: Black Book Market Research LLC