Missing MFA
Weakness: The affected remote-access portal only required login details.
Risk: A stolen password could let an attacker enter.
Solution: Require MFA, such as a password plus a security key.
Change Healthcare
Ransomware Attack (2024)
Attackers used stolen login details to enter a system without MFA. The attack disrupted healthcare claims and payments.
Outdated Systems
Weakness: Old, unsupported software may stop receiving security updates.
Risk: Attackers could exploit known security flaws.
Solution: Test and install updates. Replace unsupported systems.
Poor Network Separation
Weakness: Unnecessary connections can let attackers reach other systems.
Risk: One infected device could lead to a wider outage.
Solution: Separate important systems and allow only necessary access.
Quick question 💭
A hospital’s old server still works. Should it skip security updates?
Show answer
No. Working does not mean secure. Test updates using sample claims, check the results, and prepare a backup and rollback plan before updating.