Cyber ​​attacks of the hospital cost $ 600k/hour. Here is how AI changes mathematics

In recent years, medical facilities were not as vulnerable as it is now; Hackers had an unwritten rule not to focus on institutions or services where a disruption could put people in physical danger.

But that is no longer the case: ransomware-as-a-service has produced and stolen medical information has become very authorized, stimulating threat actors to attack hospitals at unprecedented levels.

Alberta Health Services (AHS) does not intend to make itself vulnerable – the medical system strengthens its defense with AI.

AI-reinforced cyber-ups use of cyber security platform SecuronixAHS has shortened its average time to respond to high priority incidents with more than 30%. It also reduced false -positive warnings by 90% and workload by 2 to 3 hours a day, resulting in hundreds of thousands of dollars in savings.

“Many hospital networks are big thick, easy goals,” Richard Henderson, AHS Executive Director and Ciso, told Venturebeat. “I don’t sleep much because I am just terrified of getting that phone call at 2 o’clock that the whole of our environment has fallen due to ransomware.”

Do the work of 1,000 (or considerably more) SOS analysts

AHS is the second largest hospital network in North America and the world’s largest copy of the EPIC platform of the Electronic Healthcare Records (EPD).

Henderson explained that he and his team are responsible for cyber security for 106 hospitals, 800 clinics, 20,000 doctors and 150,000 employees who serve 4.5 to 5 million Albertans. He described AHS as a ‘solid on-Prem organization’, where every facility is connected to the same epic installation.

So, Henderson noticed: “If it goes down, it will go down for everyone. And it is not hyperbole for me to say that if it goes down, it can have an impact on the life of a patient.”

It is also not an exaggeration to say that a complete malfunction of Epic-ongnacht is whether the ransomware-related or not the province of Alberta can easily cost somewhere between $ 500,000 to $ 600,000 per hour, he said.

To prevent such situations, AHS has used the “full spread” of the Securonix platform in its environment. This includes the threat detection, research and response of the CyberSecurity Company (TDIR) possibilities via its AI -drive security information and event management (SIEM) platform. This offers log management, behavioral analyzes and a security data in one package.

Henderson explained that the Terabytes medical network consumes data in its Siem and depends on the Cloud-Native Architecture of Securonix to handle data standardization and routing. Snowflake feeds a large part of that backend.

Behavioral analysis is a crucial part of the AHS detection strategy. The Securonix platform constantly learns how normal looks for its users, endpoints and systems, Hondenson explained, which helps his team to catch ‘the subtle things’, as a familiar account that behaves ‘a little’.

“It’s looking for patterns and sewing things together,” said Henderson. “You can hire 1,000 security analysts and you would still not have enough people to search all the telemetry that consume modern digital companies.”

AHS lowers the time for resolution and improves response times

For example, AHS-AI-driven tools learn what normal network behavior looks in its hospitals. When something unusual happens – such as a device that suddenly talks to an external server, contact has never been contacted before – marks it immediately. This can lead security teams to a wrongly configured tool that may have been used if it would have unnoticed.

“In the past, this kind of wrong configurations have led to catastrophic ransomware outbreaks in other hospital networks,” said Henderson.

Or, if another example, a load can come up like potentially suspiciously, but it is obscured, which means that people have to try to find out what it is and what it does, Henderson noted. Now they can ask the platform to deobfuscate and determine what the attacker tried to do, and in “literally” it does all the work.

“In recent years that they can talk to a computer as if you are talking to a person, has just changed how people think about AI,” he said. “Natural language processing has been around for a long time, but not at this level, and it keeps blowing me how good it is.”

As a result, AWS has been able to shorten the time to a solution and improve its ability to respond faster. Henderson said the average time to respond to high priority incidents is more than a third than last year.

This is because AI does the heavy work, analysts helps to understand what is happening and what an attacker is trying to achieve, Henderson noted. In modern cyber security, AI has become crucial for network detection, end point protection, e -mail filtering and other cyber security functions. “My people save hours a day with the help of AI tools,” he said.

The Securonix platform has also helped to reduce noise, with AHS seeing a substantial decrease in false positives that reach its junior analysts, which “really helps with the focus and burnout avoids,” said Henderson.

He noted that there is much discussion about AI who replaces the lower layers of security operations. But from his perspective: “AI is not going to replace junior staff. What it will do is help them learn faster, do their work better and to protect the business environment.”

Increased attacks make education critical

Because AHS is so large, with many facilities about the province, the Henderson team must follow where the majority of the incidents take place. This can help them complete whether one specific geographical region is the target of another.

Henderson pointed out that Calgary and Edmonton are the two largest cities in Alberta, so of course you would think that they would wear a significant victim of attack volume. But that is not always the case; Smaller rural hospitals are often the target because threat factors assume that their defense is weaker.

AI enables him and his team to keep an ongoing dashboard where incidents occur to plan extra outreach if necessary. Henderson spends a considerable amount of time on the human side of safety, he said, by training the nurses and doctors of AHS in earlier attack campaigns, so that they understand what they should look for.

“So when we see an increase in our rural hospitals, I will definitely build an educational campaign to say:” They focus on rural hospitals because they think you are an easier target. These are the types of things you should look for, “he explained.