[New Wave] In the 'With Corona' Era... Strengthening Security in Medical Institutions Is Necessary

Since the COVID-19 pandemic, large hospitals, pharmaceutical companies, and other healthcare-related facilities and businesses have become prime targets for hackers. Recently, major domestic hospitals have suffered damages such as customer information leaks due to successive cyberattacks, raising awareness about the security of medical institutions that handle sensitive and critical medical information.

According to the "2020 Health and Medical Informatization Survey Results" announced by the Ministry of Health and Welfare, 41.7% of domestic hospitals do not block access to external commercial email, which serves as an entry point for hackers. Additionally, only 65.7% of hospitals completely delete patients' personal information.

Hackers exploit these vulnerabilities to attack medical institutions and steal various personal and medical information. The stolen information is then used to carry out more sophisticated Advanced Persistent Threat (APT) attacks targeting individuals. For example, if a smishing message impersonating a hospital is sent according to an individual's hospital appointment schedule, the attack is highly likely to succeed.

Moreover, hackers demand ransom by taking critical information hostage or paralyzing medical infrastructure through ransomware attacks targeting medical institutions. These attacks are extremely dangerous as they can directly affect patients' lives and cause greater harm. For instance, Ireland's public healthcare institution, the Health Service Executive (HSE), experienced a halt in computer operations after its internal system containing medical records was attacked by hackers. In the United States, a university hospital in New Jersey paid hackers $670,000 (approximately 800 million KRW) to recover from a ransomware attack.

The Korean government is also preparing measures to strengthen support for responding to cyber incidents targeting medical institutions through the Ministry of Health and Welfare, in response to the increasing cyber security threats. However, to counter increasingly sophisticated cyberattacks, preventive measures must precede reactive responses. It is necessary to strengthen the security level of medical institutions themselves by deploying cybersecurity experts internally and establishing more robust security systems.

Currently, in Korea, only tertiary general hospitals are required to obtain ISMS certification and undergo regular security inspections under the Information and Communications Network Act and other regulations. However, beyond basic security checks mandated by relevant laws and regulations, all medical institutions pursuing digitalization should proactively invest in security and conduct more active security inspection activities.

If there are limitations in internal security management activities, regularly utilizing services such as penetration testing or vulnerability assessments by security experts is also an option. Through security inspections that consider technological trends and social phenomena, vulnerabilities in medical information systems can be diagnosed based on realistically possible hacking issues, and corresponding security measures can be established to respond to the latest threats from hackers.

As the world prepares to enter the "With COVID-19" era, medical information will become even more valuable as core data, and online-based medical services will expand further. It is time for everyone to join forces to welcome a safer With COVID-19 era by strengthening the security levels of medical institutions.

Choi Jeong-su, Head of Core Research Team, Raon White Hat