Discrete risk assessment models for healthcare cybersecurity

Ransomware, phishing, unauthorized access, insider misuse, and device attacks are all threats to the healthcare industry as they rely on electronic health records (EHRs), cloud services, telemedicine, and connected medical devices.Qualitative matrices can give subjective results, and more sophisticated quantitative methods may need a long time of historical data.In this study, discrete risk assessment models have been proposed to evaluate the healthcare cybersecurity in an transparent and consistent way.The framework is based on five-level discrete scales for threat likelihood, vulnerability severity, asset criticality, data sensitivity, operational impact and control effectiveness.These factors determine scores of risk and threats of inherent and residual risk, and rank the threats as negligible, low, moderate, high and critical.Ten healthcare scenarios were used for evaluation and ransomware and unpatched medical devices were the most significant threats.Once these measures of multifactor authentication, network segmentation, encryption, secure backups, patch management and access monitoring were implemented, risk was reduced by 59.7%.The proposed framework helps to provide better threat differentiation, threat interpretability, control evaluation and better prioritization of cybersecurity investments, and helps to provide patient safety as well as continuity of clinical services.