That generally gels with the conventional wisdom regarding the healthcare industry: that it\u2019s overall security posture is poor<\/a>. It also agrees with something else we say all the time, which is that an organization\u2019s own employees are its biggest threat<\/a>. <\/p>\n\n\n\n So, today we\u2019re going to discuss this new study, the healthcare industry\u2019s security issues and email security, in general. At the end we\u2019ll also offer you a chance to download our new eBook \u2013 filled with almost 40 pages worth of insight and actionable advice on securing your organization\u2019s email.<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n The study, which was published last month, is named \u201cAssessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions,\u201d a serviceable \u2013 if slightly uninspired \u2013 title. The study was designed to answer one major question: <\/p>\n\n\n\n Are employees at US health care institutions susceptible to phishing attacks?<\/p><\/blockquote>\n\n\n\n Turns out the answer is yes.<\/p>\n\n\n\n In summary, current click rates in phishing simulations at US health care organizations indicate a major cybersecurity risk. These click rates highlight the importance of phishing emails as an attack vector, as well as the challenge of securing information systems.<\/p><\/blockquote>\n\n\n\n Now, common sense likely could have saved this group some money \u2013 the answer is obviously yes \u2013 but\u2026 SCIENCE!<\/strong><\/p>\n\n\n\n So, the researchers proceeded to bombard six different US hospitals with nearly 3-million (95 different campaigns totaling 2,971,945) simulated phishing emails from 2011-2018 and recorded the organizations’ click rates. The overall median click rate was 16.7% across the various campaigns and institutions.<\/p>\n\n\n\n To better interpret the data, the researchers organized the\nvarious simulated phishing campaigns into three different categories:<\/p>\n\n\n\n As we discuss all the time, the best phishing emails are constructed to trigger certain emotions<\/a>. What those targeted emotions are has actually shifted a bit recently, whereas creating a sense of panic or urgency has historically been the MO, recently phish have begun to play to our vanity. This can partially be attributed to the rise of social media. Unfortunately, the study didn\u2019t provide its raw data and didn\u2019t offer any insight as to trends in phishing as they ebbed and flowed over the eight years the study ran. That could have been enlightening and it would be nice to compare the results over a longer duration against some of the more recent, more abbreviated phishing studies that have been completed. <\/p>\n\n\n\n Additionally, without the raw data it\u2019s tough to know what these campaigns actually looked like, both in terms of aesthetics and the subject line and contents of the simulation emails. I\u2019m not saying any of this to criticize the study, I\u2019m just trying to qualify some of this information by framing it with the correct context. <\/p>\n\n\n\n While those details were rather opaque, the study did offer\nseveral examples of subject lines from each category.<\/p>\n\n\n\n Ok, the boring methodology stuff is out of the way, so let\u2019s look at the most interesting takeaways from the study, starting with the click rates by the category:<\/p>\n\n\n\n It seems like there would be quite a bit of overlap between Office-related and IT-related phish, but obviously when it comes to technology-related issues the healthcare industry \u2013 or at least the sampling from this study \u2013 is especially sensitive. This makes a lot of since given how many devices, more and more of them IoT, are critical to a well-functioning hospital. If devices or networks start going down, people could very literally die.<\/p>\n\n\n\n Here\u2019s a random fact that emerged from this study: hospital\nemployees are nearly twice as likely to get phished in the Fall as they are in\nthe Summer. I have no idea what to attributed that to, and the study didn\u2019t\neven try to guess. <\/p>\n\n\n\n Finally, certain seasons were associated with click rates. For example, both spring (adjusted OR, 0.842; 95%CI, 0.735-0.964) and summer (adjusted OR, 0.751; 95%CI, 0.624-0.905) campaigns were associated with fewer clicks compared with fall campaigns, while winter was not significantly associated with click rates (adjusted OR, 1.175; 95%CI, 0.972-1.420).<\/p><\/blockquote>\n\n\n\n Because I realize a lot of eyes are going to glaze over on account\nof those numbers, let\u2019s toss it in a graph.<\/p>\n\n\n\n The big takeaway from the study is that, at least in a\nhealthcare context, these phishing simulations really do help. Over this eight-year\nstudy, across a couple of different metrics, there\u2019s decisive evidence that\nphishing simulations help decrease click rates. <\/p>\n\n\n\n We found that the odds of clicking on a phishing email decreased with greater institutional experience, which we hypothesize may be due to the benefit of running phishing simulation campaigns for employee education and awareness.<\/p><\/blockquote>\n\n\n\n Then, in their conclusion, they state it a bit more emphatically:<\/p>\n\n\n\n Repeated campaigns were associated with improved click rates, suggesting that simulated phishing campaigns are an important component of a proactive approach to reducing risk.<\/p><\/blockquote>\n\n\n\n Let\u2019s take a look at the total unadjusted click rate over\nthe eight years that the study ran:<\/p>\n\n\n\n You\u2019ll notice they didn\u2019t run any simulations during 2013 and\n2014. I have no idea why that was, nor do they disclose the reason in the\nreport. The biggest dip came between 2016 and 2017, which lines up with when\nphishing simulations were really beginning to come into their own. The\nresearchers admitted that at the start of the study, they were somewhat\nhamstrung by the lack of healthcare institutions with \u201can information security\nsystem organization mature enough to conduct phishing simulations.<\/p>\n\n\n\n The more compelling evidence is the reduction in click rates as employees received more training. We say it all the time, but education is one of the best lines of defense when it comes to cybersecurity<\/a>. Here\u2019s how employees fared as they progressed through more and more phishing simulations:<\/p>\n\n\n\n The healthcare industry has historically lagged a bit behind other industries in terms of cybersecurity preparedness<\/a>. This despite stringent industry standards for compliance like HIPAA. The reason for this is multi-faceted.<\/p>\n\n\n\n For starters, healthcare organizations have a ton of surface to cover. Medical devices, many of which are now online, are additional attack vectors, and given their functions and interdependence, their security is even more complicated. Then there\u2019s the entire need to secure and, at times, transfer sensitive medical records that adds another degree of complexity. And those records are valuable, with some fetching upwards of $1,000 on the dark web<\/a>. <\/p>\n\n\n\n Health care systems are also uniquely vulnerable to phishing attacks. Employee turnover at hospitals is high,20 and there is a constant influx of new employees (eg, trainees) who may have no prior cybersecurity training, which creates a continuous stream of newly susceptible employees. Hospital systems are vulnerable due to significant end point complexity, a term used to describe the large number of IT devices that could be targeted in an attack.<\/p><\/blockquote>\n\n\n\n Remember, 91% of cyber attacks begin with an email<\/a>. 1 out of every 101 email is malicious<\/a>. And all it takes is one to infect or target the right system, which in turn could influence a significant number of downstream systems, and suddenly there\u2019s a full-blown catastrophe.<\/p>\n\n\n\n RELATED: <\/strong>What if getting phished could kill you?<\/a><\/em><\/p>\n\n\n\n That only underscores the importance of good email security,\nwhich clearly starts with proactive employee education.<\/p>\n\n\n\n There are a number of different strategies you can employ to help defend against phishing, and at one point or another we\u2019ve covered each of them<\/a>. For improving security within your own organization, deploying S\/MIME certificates at scale<\/a>, setting up SPF<\/a> and DKIM<\/a>, and using DMARC<\/a> will all help with the health of your organization\u2019s email systems. They will also help ensure more of your emails get delivered outside of the organization, too.<\/p>\n\n\n\n\u201c\u2026these click rates represent a major cybersecurity risk for hospitals.\u201d<\/h2>\n\n\n\n
![\"Science!\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Science-300x271.jpg\")
<\/figure><\/div>\n\n\n\n![\"Click](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Click-Rate-by-Hospital.png\")
<\/figure><\/div>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Statistic.jpg\")
<\/figure><\/div>\n\n\n\n![\"Phishing](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Phish-Subject-Lines.jpg\")
<\/figure><\/div>\n\n\n\n![\"phishing](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Click-Rate-by-Category.png\")
<\/figure><\/div>\n\n\n\nFall is Phishing Season<\/h2>\n\n\n\n
![\"phishing](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Click-Rate-by-Season.png\")
<\/figure><\/div>\n\n\n\nPhishing Simulations Really Do Work<\/h2>\n\n\n\n
![\"phishing](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Click-Rate-by-Year.png\")
<\/figure>\n\n\n\n![\"phishing](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Click-Rate-by-Campaign.png\")
<\/figure><\/div>\n\n\n\nWhy is the healthcare industry such a big target?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/bigstock-Basic-Rgb-267087301-300x300.jpg\")
<\/figure><\/div>\n\n\n\nHow else can organizations improve email security?<\/h2>\n\n\n\n
![\"Hashed](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg\")
<\/figure>\n","protected":false},"excerpt":{"rendered":"