Cybersecurity Measurability: Three Magnified Vulnerabilities of USA Healthcare

<p dir="ltr">There are two defining characteristics of a healthcare provider: (1) geographic location and services available at their physical structure and (2) services available via their virtual Internet presence. For centuries we have focused on the first defining characteristic - now we need to shift our focus to understand and address issues that may arise from the new second defining characteristic.</p><p dir="ltr">This chapter is an updated summary of a paper originally presented at the ACM Cybersecurity in Healthcare (HealthSec) Workshop in October 2024 [<a href="link.springer.com/chapter/10.1007/978-3-032-13800-2_6#ref-CR39" target="_blank">39</a>].

We address issues related to Internet connectivity and virtual presence of USA healthcare providers, especially hospitals, when ransomware cyberattacks resulting in service outages occur. We show the cybersecurity posture of a large critical national infrastructure (USA healthcare) can be measured, mapped, and quantitatively baselined. Empirical measurability results reveal systemic issues in USA healthcare presenting “magnified vulnerabilities” in that a single exploit can have an outsized impact on an entire nationwide infrastructure.