Editors Note:
As we wrap up another October Cybersecurity Awareness Month, we would like to thank David, a friend and colleague, who has shown up from the beginning not only as a contributor, but our very first reader. His voice and expertise has shaped our security and cybersecurity coverage along with this annual campaign. Thank you for lending your voice, your time, and your belief in what we’re building. We’re grateful for you, always. Roberta Mullin
By David Finn, Cybersecurity expert and Recovering HC CIO
LinkedIn:Â David (Samuel) Finn
Data Fragmentation & Interoperability Gaps
Healthcare organizations store patient data across dozens of systems — EHRs, billing platforms, lab databases, imaging archives, scheduling tools, and third-party portals — that frequently don’t talk to each other. This fragmentation isn’t just an operational headache; it’s a security liability. When you can’t see all your data, you can’t protect all your data. Every disconnected silo is an unguarded door, and attackers are very patient people with very good maps.
The Symptoms:
- If your patient’s data lives in seven systems and none of them agree on his birthday, you have an interoperability problem. If none of them have access controls, you have a catastrophe.
- Shadow IT is just ‘I found a workaround’ with better branding.
- APIs make great bridges, but they are terrible guardrails. The interoperability push is great for patients and providers – but every new API endpoint is a new attack surface. Fast and insecure is not an achievement; it might be a press release in waiting.
- Fragmented data environments mean fragmented visibility. Security teams can’t monitor what isn’t inventoried, and they can’t respond to incidents in systems they don’t know exist.
- Ignorance is not bliss — it’s liability.
The Recommendations:
- Build and maintain a comprehensive data inventory.
- Enforce consistent access controls and MFA across all systems — not just the primary EHR. And, yes, that means email.
- Secure every API endpoint.
- Establish and enforce data governance policies that explicitly prohibit unsanctioned data-sharing methods — personal email, consumer cloud storage, unencrypted USB drives.
- Integrate security monitoring across fragmented systems using a SIEM.
Legacy Technology & Medical Device Vulnerabilities
Hospitals and healthcare organizations run on a staggering mix of cutting-edge innovation and technology that predates Wi-Fi. Many critical medical devices — infusion pumps, imaging systems, patient monitors — run on operating systems so outdated they have been discontinued for longer than some employees have been alive. And most of them are connected to the Internet. This combination of clinical criticality, network exposure, and legacy software creates one of the most complex and consequential attack surfaces in any industry.
The Symptoms:
- Windows XP called — it wants its patient data back. You know what I’m talking about EOL systems and no vendor support.
- Your IV pump doesn’t need to tweet, but apparently it can. Reminds of the Rad Tech I caught sending personal email from the MRI. True.
- Patching a medical device isn’t like updating your phone. It requires FDA clearance, vendor cooperation, and a small miracle.
- The most dangerous device in your hospital might have a touchscreen and a Wi-Fi icon.
The Recommendations:
- Conduct a full medical device inventory.
- Isolate legacy devices on segmented VLANs with strict firewall rules.
- Engage device manufacturers proactively about security roadmaps, patch availability, and end-of-life timelines.
- Implement continuous network monitoring specifically for device behavior anomalies.
- Develop compensating controls for devices that cannot be patched: application whitelisting, physical access controls, and enhanced logging at network egress points.
Ransomware & Extortion Attacks
Ransomware is no longer a criminal side-hustle; It is an industry. Attacks have evolved from opportunistic smash-and-grab operations into sophisticated, multi-stage extortion campaigns. Attackers encrypt your data, threaten to leak it, and sometimes sell it to competitors. Healthcare organizations are among the most targeted sectors globally, making awareness a necessity.
The Symptoms:
- Modern ransomware gangs now use double and triple extortion: they encrypt your data, threaten to leak it, and then notify your business partners. It’s blackmail with a PR strategy.
- Backups are like seatbelts — everyone knows they need one, but nobody buckles up until after the crash. Organizations without tested, offline backups often pay the ransom.
- Ransomware doesn’t knock — it picks the lock. Most intrusions begin with phishing emails or unpatched systems weeks before encryption begins. By the time you see the ransom note, attackers have been in your network long enough to learn your lunch schedule.
- Paying the ransom is like tipping your mugger. There’s no guarantee of decryption, and roughly 80% of organizations that pay get hit again — sometimes by the same group.
The Recommendations:
- Adopt the 3-2-1 backup methodology. Three copies of the data, 2 different media types, one offsite copy (redundancy, diversity, isolation). Test restoration regularly.
- Deploy Endpoint Detection & Response tools capable of identifying ransomware behavior before encryption begins — behavioral anomalies, not just known signatures.
- Segment your network. A ransomware infection in one department should not be able to waltz into another. Think fireproof doors, not open floor plans.
- Conduct tabletop exercises that simulate a ransomware attack. Know your incident response plan before 3 AM on a holiday weekend — because that’s when attackers prefer to work.
- Train staff to recognize phishing — it remains the #1 entry point. If an email asks you to “urgently verify your credentials,” that’s not IT.