708 posters, 8 topics, 16 sessions, 1,190 authors, 600 institutions
ePostersLive by SciGen Technologies S.A. All rights reserved.
ISQua's 39th International Conference 2023
August 27 - 30, 2023 | Seoul, Republic of Korea
P802
ASSESSMENT OF INFORMATION SECURITY AWARENESS IN HEALTHCARE BY SOCIAL ENGINEERING EXERCISE
Poster Presenter
Part of Topic
Patient Safety & Quality Improvement
Assessment of Information Security Awareness in Healthcare by Social Engineering Exercise
INTRODUCTION
•As cyberattacks continue to grow, the healthcare sector has continued to react to cybersecurity concerns that threaten patient safety and privacy.
•Many cyber incidents in the healthcare sector have compromised technical defense mechanisms by applying social engineering (SE) tactics that exploit human vulnerabilities.
aim
•Humans represent the weakest link in cybersecurity chains. Research showed that human error is involved in more than 90% of security breaches.
•This study aims to investigate employees’ information security awareness (ISA) to appropriately recognize social engineering attacks in healthcare institutions.
METHOD
A long-term social engineering exercise is implemented to observe employees’ responses to mock attacks and to evaluate the effectiveness of such a risk reduction scheme.
1.Send out a mock SE attack monthly to all employees.
2.The date and time of sending mock SE mails to given employees are selected randomly.
3.The contents and subjects of the mock mails are different each month.
We conducted such simulated SE attacks continuously from 2019/01 to 2022/05.
RESULTS
•This study assesses the workforce’s ISA and identifies the vulnerable workforce with a susceptible likelihood of social engineering attacks.
•The analysis implies that the job type influences the workforce’s awareness. The table below implies that a portion of employees contribute multiple violations over the 40-month exercise. The number of violated RD employees is larger than the total staff number as most RD staff are contract-based research assistants. Furthermore, they are likely prone to view mock SE emails as their primary duty is to explore and research diversified information from the web.
•The IT and Accounting & Statistics types have the least VRs as their job duties train them to be precaution and preserve. Even though IT staff possess higher ISA sense, a portion (22.5%) of the IT staff still are vulnerable to SE attacks.
•50% of the staff in the hospital belong to the Medical Staff type and 38% are nurses. Therefore, the behaviors of these two job types represent most of the hospital’s behaviors. Overall, the evaluation indicates that an employee’s job type may affect his/her SE violation rate and that some job types tend to be SE-prone and some are not.