New Delhi: Cyber security has become very critical in every sector as cyber-attacks have been on the rise. Ransomware attacks are becoming increasingly common and involve hackers gaining control of a victim’s systems and demanding payment in exchange for restoring access to their data.
In the last few years, there have been some high-profile cybersecurity breaches. Dr Reddy’s and Lupin were victims in 2020 and All India Institute of Medical Science (AIIMS), Delhi suffered a ransomware attack in 2022 which reportedly originated from China. It took over two weeks to be rectified, allegedly the hackers demanded Rs 200 crore in cryptocurrency, but this wasn’t confirmed officially. The latest victim of a ransomware attack has been Sun Pharma after it was hit by an information technology (IT) security breach.
According to Check Point Research’s (CPR) 2023 Cyber Security Report, cyberattacks have reached an all-time high in response to the Russia-Ukraine conflict. Education and research are the most targeted sector but the healthcare sector has registered a 74 per cent increase year-on-year (YoY). Overall, global cyberattacks increased by 38 per cent in 2022 as compared to 2021.
The threat of cyber security breaches
No industry, including pharma, can expand in today’s constantly evolving and connected world without making necessary investments in digital solutions like IoT, cloud, apps, etc. While such tools and technology increase productivity, they also have intrinsic drawbacks, such as the potential for cyber-attacks if proper safeguards are not put in place.
Sudesh Anand Shetty, Partner, KPMG in India while sharing his views commented, “There has been a significant spike in the attacks within the pharma sector globally and in India as well. This sector has its own inherent set of highly-sensitive data which is lucrative for cybercriminals including intellectual property (R&D), patient data (including personally identifiable information, or PII), novel drug formulations, and clinical trial data. As businesses have moved to hybrid work environments and increased their dependence on digital systems, cyber-attacks have increased in general during and post the pandemic.” Adding further Shetty pointed out that phishing-linked attacks and exploits around remote desktop connectivity have been widely observed in their investigations and also third parties who have been given access to the company network are considered to be the weak links in such investigations. The perils of digital transformation, especially post-pandemic, have affected pharma and healthcare enterprises just like they have affected any other enterprise. This is especially true for businesses that have used the Internet of Things (IoT) to improve medical care and scale their operations affordably. Since most IoT devices aren’t designed with security in mind, they present serious cybersecurity threats.
According to Huzefa Motiwala, Director for Systems Engineering, India and SAARC, Palo Alto Networks, in the majority of organisations, IoT and OT devices usually make up more than 30 per cent of devices within corporate networks, 57 per cent of which are also susceptible to medium or high-severity cyberattacks. Furthermore, due to their tremendous diversity, lengthy lifecycles, and lack of coverage by conventional security controls, security teams who are rarely involved in purchasing find it incredibly difficult to secure these devices.
“Given that the global healthcare cybersecurity market is set to hit $51 billion by 2030, it is without question that the sector has felt the onslaught of the advanced threat landscape and has looked to tighten the ropes on novel vectors and tactics, techniques, and procedures (TTPs). This becomes a particularly important consideration for pharma and healthcare firms as they have access to extremely sensitive data, be it medical records or personal identity. We’ve seen such data become a major focus for attackers who have preferred using ransomware attacks against healthcare organisations. Regulation and compliance have also become a bone of contention as unstructured data can be a nightmare to handle when you have to abide by both state laws and national laws,” shared Motiwala.
When dealing with high-profile cyberattacks within the pharma and healthcare sector, it is important to recognise that such attacks take advantage of the need to keep these systems up and running continuously. This is not only limited to the hardware but also applies to the software running on said devices. As such, securing the cybersecurity stack requires great attention to detail, as even the smallest vulnerability is enough to invite a great deal of damage.
Challenges in implementing cyber-security measures
Despite the increased emphasis on cybersecurity within the last couple of years, it continues to be an area of improvement for most organisations. There isn’t one solution that fits all enterprises – especially given the advanced threat landscape and the diverse cybersecurity needs of players.
“The pharmaceutical industry is a prime target for cybercrime due to its reliance on intellectual property, patents, and real-time patient data. To improve customer delivery and supply chain operations, pharmaceutical manufacturers are embracing digital transformation. However, many companies do not incorporate security into their digital transformation plans, leaving them vulnerable to attacks such as ransomware,” stated Nikkhil K Masurkar, CEO, ENTOD Pharmaceuticals.
Adding to Masurkar’s views, Sandeep Peshkar, Senior Vice President, Arete remarked, “The healthcare and pharmaceutical sectors have cybersecurity challenges since they deal with extremely sensitive and classified (PHI) data. It is crucial to strengthen defences against these threats since the interconnectivity of devices and systems has increased the potential for data breaches. As digitalisation becomes a priority for every organisation, enhancing security architecture is essential to protect customer data against ever-evolving threats. For example, last year, the Indian healthcare sector recorded 1.9 million cyber incidents. Moreover, how can we forget the recent AIIMS cyber incident that compromised nearly 40 million health records? To accomplish this, it is essential to develop a comprehensive cybersecurity strategy that includes policies, training, awareness activities, and technological safeguards. We can only secure the safety of people throughout the world and preserve pharmaceutical and healthcare data via collaborative efforts.”
Speaking on the challenges faced by organisations in implementing cyber-security measures, Parag Khurana, Country Manager, Barracuda Networks India commented, “The healthcare and pharmaceutical industries are increasingly vulnerable to cyberattacks due to the sensitive nature of the data they handle. The biggest challenges to cybersecurity in these industries include the growing sophistication of hackers, the proliferation of connected devices, and the shortage of cybersecurity professionals. Our research finds healthcare (12 per cent) is one of the five key industries that ransomware attackers target.”
According to Palo Alto Networks’ pharma and healthcare, firms accounted for one-fifth of all ransomware incidents.
Enhancing cyber-security architecture
To guard against cyberattacks and the potential loss of sensitive and important data, pharmaceutical companies have implemented a ‘zero trust’ policy for securing their IT assets and applications. Additionally, cyber security measures including implementation of privileged access management (PAM), encryption, upgrading firewalls and associated rules, intrusion detection and prevention systems (IDS IPS), regular software upgrades and patches, regular security assessments and penetration testing by third parties are being undertaken by organisations. These cyber security measures are not only being implemented by organisations themselves but are being extended to their critical third parties. Adoption of endpoint detection & response (EDR) versus the use of traditional anti-virus software is also being observed by pharma companies.
“To strengthen defences against cyberattacks, healthcare and pharmaceutical organisations must implement robust security protocols, enhance employee security awareness training, and invest in advanced cybersecurity technologies. It’s critical to recognise that cybersecurity is not just an IT issue, but a business-wide concern that requires a comprehensive approach,” remarked Khurana.
He added, “As the stakes of cyberattacks continue to rise, there is an urgent need for healthcare organisations to adopt comprehensive cybersecurity solutions. Deploying a web application firewall is one of the most important steps to protect the organisation, and a part of a larger strategy:
- Prevent credential loss by implementing anti-phishing capabilities in email as an email-borne threat is still the number one threat vector.
- Secure applications and access with multi-factor authentication (MFA) as well as implement web application security for all SaaS applications and infrastructure access points to protect against DDoS attacks or bad bots.
- Back up critical data with a secure data protection solution that help to implement disaster and recovery capabilities when needed.
Dr Anil Kukreja, Vice President – Medical Affairs and Regulatory, AstraZeneca India voiced, “Cyberattacks is a serious concern and should not happen, ideally speaking, because we need to respect the privacy of all the companies. Everyone needs to be made aware of all the possible phishing attacks. We must enhance the awareness of all the employees working in the organisation, specifically for such incidents. We need to protect and take all precautions, particularly to avoid such incidents.”
Commenting on the criticality of safeguarding information security, Jitendra Mishra, VP-CIO, Akums Group, stated, “It is very important from any organisation’s perspective to ensure that before venturing to any application or network they should do 100 per cent assessment by viewing what type of a vulnerability they can come across.”
“Before deploying any software, there has to be a risk assessment for such an initiative not only for the application or a network person but mostly we ignore the IoT part and when we see that IoT is the current theme which is happening very fast in a smart manufacturing environment. So, we have to look into the overall perspective of information security not restricted to the network or application point of view. Even your printer and connected devices are also vulnerable. We have to look into the holistic picture of information security, we have to have a proper risk assessment, and we have to create user awareness. Each user that is a part of the connected devices must be aware of what are the vulnerabilities and what are the do’s and don’ts. This is very important to create awareness across the organisation. We have to have proven policies and governance mechanisms including proper risk assessment, and quarterly exercises with third parties apart from internal self-inspection. We have to create some governance, and general control of information security in all aspects, we have to look into that and it should be a part of our everyday success and everyday journey of information technology,” concluded Mishra.
“One solution to mitigate the risk of attacks is to enforce least-privilege policies to limit an attacker’s ability to move laterally within a network. Additionally, organizations can mandate secure transfer protocols and strong authentication procedures to ensure their developer environments are secure. Identity access management is critical in avoiding expensive, long-lasting harm, and the pharmaceutical industry should prioritise strict management of identities and permissions,” added Masurkar.
He added, “Automation, machine learning, and advanced analytics can provide granular insight into the permissions and actions of all human and nonhuman identities, allowing security teams to identify high-risk permissions and automate the rightsizing of permissions. Other basic security practices, such as conducting regular cybersecurity assessments, keeping software up-to-date, using encryption, partnering with security experts, and monitoring network activity, should also be implemented.”
The rise of technologies such as artificial intelligence (AI) and machine learning (ML) has opened up a plethora of possibilities, bringing with it newer threats. AI technologies such as ChatGPT have the potential to be used by hackers to develop error-free, fail-proof malicious codes quickly, and phishing emails, and messages can be disseminated rapidly. The speed and ease of writing malware will lead to an increased frequency of data breaches. Cybersecurity is paramount for pharma organisations as YoY threats have been on the rise. Owing to how detrimental downtime can be for pharma and healthcare firms, manually ensuring that all connected devices are up-to-date on their latest software is impractical.
A completely visible network enables IT teams to quickly pinpoint which devices are running on outdated software and automate certain updates that can do away with vulnerabilities that would have crept into the network otherwise. However, another issue with the devices being used within these sectors is that often, the supported life of these devices can be far shorter than their usable life. This compounded with the low tolerance to downtime, making them high-value, low-effort targets. The lack of end-of-life software support means they often are not able to support the latest cybersecurity protocols and solutions – thus providing an easy-in for cyber attackers looking to compromise critical functions within the enterprise.
