Skip to content Skip to navigation

Report: Healthcare Industry Needs to Improve Application Security Practices

October 18, 2016
by Heather Landi
| Reprints

The healthcare Industry significantly lags behind other industries when it comes to fixing security vulnerabilities and has the highest prevalence of cryptographic and credentials management issues, according to a security report by Veracode. Given the recent ransomware and other cyber attacks on healthcare organizations, the industry’s low performance on these application security benchmarks is troubling, the Veracode report states.

In its annual State of Software Security Report (SoSS), Veracode, a software security firm, presents metrics drawn from code-level analysis of billions of lines of code across 300,000 assessments performed over the last 18 months.

The report revealed that the continued and persistent use of components in software development is creating systemic risk in the country’s digital infrastructure. However, the report also found that companies achieve accelerated benefits when their application security programs reach maturity. These finding indicate that the growing trend of focusing on digital risk at the application layer and building security into DevOps processes (DevSecOps) can yield great results for organizations in reducing risk without slowing down software development.

One of the key findings of the report is that the prevalent use of open-source and third-party components is creating unmanaged risk. Approximately 97 percent of Java applications contained at least one component with a known vulnerability, according to the report authors.

“The prevalent use of open source components in software development is creating unmanaged, systemic risks across companies and industries,” Brian Fitzgerald, CMO at Veracode, said in a statement. “Today, a cybercriminal can focus on a single vulnerability in one component to exploit millions of applications. Software components are used by every industry and for software of all kinds, and given our dependence on applications, the ease at millions of applications can be breached has the potential to create havoc in our digital infrastructure and economy.”

When looking at healthcare specifically, healthcare as an industry now has the lowest vulnerability fix rate, second-lowest OWASP (Open Web Application Security Project) pass rate and the highest prevalence of cryptographic and credentials management issues. The healthcare industry OWASP policy compliance pass rate is 33 percent, with government being the lowest at 25 percent.

According to the report authors, one of the most telling measures of the state of software security by industry is the vulnerability fix rate. When looking at fix rates by industry vertical, the healthcare industry ranks last for its vulnerability fix rate, and it lags the top performer, manufacturing, by a two-to-one ratio when it comes to fixing critical cyber errors.

“Does the gap reflect an inability to appropriately address vulnerabilities once they’ve been found, or does it point to some other structural constraint that holds healthcare back?” the report authors asked.

The research also highlights the challenges that still exist in software development more broadly. For example, 60 percent of applications failed basic security requirements upon first scan, which means fewer than four out of 10 applications pass security policy requirements on initial assessment. “The fact that this number fundamentally doesn’t change year over year indicates that there’s a lot of software out there that has still not been brought through a formal security improvement process—whether unremediated legacy code or new code that’s not developed via a rigorous secure software development lifecycle (SDLC),” the report authors wrote.

The report found that when companies follow best practices and implement programs with consistent policies and practices for secure development, they are able to remediate vulnerabilities at a higher rate. The study showed that the top quartile of companies fix almost 70 percent more vulnerabilities than the average organization. Additionally, best practices like remediation coaching and eLearning can improve vulnerability fix rates by as much as six-times.

According to the report, giving software developers more power improves security as developers using sandbox technology to scan apps prior to assurance testing show a significant improvement in fix rates.

Additionally, training matters, the report authors wrote, as best practices like remediation coaching and eLearning can improve vulnerability fix rates by as much as six times over.





ONC National Coordinator Gets Live Look at Carequality Data Exchange

Officials from Carequality have stated that there are now more than 150,000 clinicians across 11,000 clinics and 500 hospitals live on its network. These participants are also able to share health data records with one another, regardless of technology vendor.

American Red Cross, Teladoc to Provide Telehealth Services to Disaster Victims

The American Red Cross announced a partnership with Teladoc to deliver remote medical care to communities in the United States that are significantly affected by disasters.

Report: The Business of Cybercrime in Healthcare is Growing

While stolen financial data still has a higher market value than stolen medical records, as financial data can be monetized faster, there are indications that there is ongoing development of a market for stolen medical data, according to an Intel Security McAfee Labs report.

Phishing Attack at Baystate Health Potentially Exposes Data of 13K Patients

A phishing scam at Baystate Health in Springfield, Mass. has potentially exposed the personal data of 13,000 patients, according to a privacy statement from the patient care organization and a report from MassLive.

New Use Cases Driving Growth in Health Data Exchange through Direct

In an update, DirectTrust reported significant growth in Direct exchange of health information and the number of trusted Direct addressed enabled to share personal health information (PHI) in the third quarter of 2016.

Insurers to CBO: Consider Private Insurers’ Data in Evaluations of Telemedicine

Eleven private insurers, including Aetna, Humana and Anthem, are urging the Congressional Budget Office (CBO) to consider the experience of commercial insurers when evaluating the impact of telemedicine coverage in Medicare.