Healthcare Security Practice Analysis, Modelling and Incentivization

Abstract

The human aspect of information security practice has become a global concern. According to Verizon’s 2022 data breaches report, over 80% of data breaches were caused by the human aspect, and this trend has been consistent over the past three years. Among the industries, 22% of the violations occurred within healthcare. These breaches are widely caused by external actors (61%) who are motivated by financial gains. Ransomware through phishing attacks has been the preferred tactic. Such incidents have caused financial loss to some hospitals and resulted in the loss of human life. The security practice in relation to the human aspect is about how people comply with organizational security requirements towards safe-guiding the confidentiality, integrity and availability (CIA) of assets within an IT infrastructure. Technological security configurations have predominantly been relied on as the default and traditional information security controls. Through consistent development, the technological aspect has comparatively been enhanced and matured, thereby, increasing the puzzle for cyber-criminal to circumvent. As a result, cyber-criminals tend to exploit the human aspect as an easy entry point. This research work, therefore, delves into the human aspect of security practice aimed to contribute towards the fortification of ”the human firewall”, through incentivising the security practice of healthcare staff. Some research activities have been conducted in this area. However, initial state of-the-art studies revealed in-comprehensiveness in the existing efforts. As a result, comprehensive approaches were first explored for modelling and analyzing the security practice of healthcare staff in the aspects of data-driven and artificial intelligence or machine learning approaches, attack and defence simulations and psychological, social, cultural and work factors. Furthermore, motivational methods for incentivizing security practices were also explored. This is deemed to be a holistic approach towards enhancing security practices among healthcare staff. Within the area of data-driven, various methods, including, K-means clustering with iterative and discriminate clustering, were used to assess the security practice in electronic health records (EHR) logs in this research work. Through the assessment, an unusual session duration was revealed in which an average session of about 12,330 hours was detected. Meanwhile, at maximum, a healthcare staff session is estimated to be about 24 hours. Essentially, the K-Means iterative and discriminate (KID) model predicted normal security practices that could be explored towards the adoption of supervised machine learning methods for real-time abnormal detection and prevention of data breaches. Furthermore, in this project, the security practices of healthcare staff were assessed through SMS-based phishing simulation attacks. These attacks were performed having analysed and modelled scenarios through literature review work and observational measures. Through state-of-the-art studies, the in-the-wild-field study was adopted to perform a simulated SMS-based attack in a typical hospital. From a total of 167 participants (comprising nurses, doctors and other healthcare staff), about 101 (61%) were victims of the attack. This trend of high victims in a phishing attack was also identified in a related study in this work where out of 830 healthcare staff who were involved in a simulated email-based study, over 50% of the participant fell victim to the attack. Meanwhile, a cybercriminal might need just one person to click the malicious link in a real attack. The higher susceptibility among healthcare staff to the phishing attack, therefore, poses a higher phishing security behaviour risk within the healthcare sector. Additionally, comprehensive psychological, social, cultural, personal and work-related factors were identified, assessed and analyzed through in-depth literature reviews. Constructs from theories such as the health belief model (HBM), protection motivation theory (PMT), Theory of planned behaviour (TPB), General deterrence theory (GDT) and The big five (TBF) personality theory were adopted and assessed. Through that, variables such as agreeableness were assessed to be a significant positive predictor of self-efficacy (SE) risk and perceived severity (PS) risks. Following this revelation of varying security practice gaps, originating from multifaceted factors in the assessments, cognitive dissonance (CD) theory, together with other motivational methods, were identified and examined in a controlled experiment. So the CD was used as an independent variable while the other variables were the dependent variables in this controlled experiment. The findings in the experiment showed less susceptibility risk of the actual phishing clicks behaviour among the healthcare staff in the experiment group. To this end, inducing motivational factors such as cognitive dissonance, cues-to-action, and perceived severity, factors among healthcare staff could reverse this global security incident trend in the human aspect. Future research could explore the adoption of psycho-education with the aid of state-of-the-art training techniques such as virtual reality, and augmented or mixed realities to inculcate long-lasting conscious care behaviour among healthcare staff.