Dataset Information

Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions.

ABSTRACT:

Importance

Cybersecurity is an increasingly important threat to health care delivery, and email phishing is a major attack vector against hospital employees.

Objective

To describe the practice of phishing simulation and the extent to which health care employees are vulnerable to phishing simulations.

Design, setting, and participants

Retrospective, multicenter quality improvement study of a convenience sample of 6 geographically dispersed US health care institutions that ran phishing simulations from August 1, 2011, through April 10, 2018. The specific institutions are anonymized herein for security and privacy concerns.

Exposures

Simulated phishing emails received by employees at US health care institutions.

Main outcomes and measures

Date of phishing campaign, campaign number, number of emails sent, number of emails clicked, and email content. Emails were classified into 3 categories (office related, personal, or information technology related).

Results

The final study sample included 6 anonymized US health care institutions, 95 simulated phishing campaigns, and 2?971?945 emails, 422?062 of which were clicked (14.2%). The median institutional click rates for campaigns ranged from 7.4% (interquartile range [IQR], 5.8%-9.6%) to 30.7% (IQR, 25.2%-34.4%), with an overall median click rate of 16.7% (IQR, 8.3%-24.2%) across all campaigns and institutions. In the regression model, repeated phishing campaigns were associated with decreased odds of clicking on a subsequent phishing email (adjusted OR, 0.511; 95% CI, 0.382-0.685 for 6-10 campaigns; adjusted OR, 0.335; 95% CI, 0.282-0.398 for >10 campaigns).

Conclusions and relevance

Among a sample of US health care institutions that sent phishing simulations, almost 1 in 7 simulated emails sent were clicked on by employees. Increasing campaigns were associated with decreased odds of clicking on a phishing email, suggesting a potential benefit of phishing simulation and awareness. With cyberattacks increasing against US health care systems, these click rates represent a major cybersecurity risk for hospitals.

SUBMITTER: Gordon WJ

PROVIDER: S-EPMC6484661 | biostudies-literature | 2019 Mar

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions.

Gordon William J WJ Wright Adam A Aiyagari Ranjit R Corbo Leslie L Glynn Robert J RJ Kadakia Jigar J Kufahl Jack J Mazzone Christina C Noga James J Parkulo Mark M Sanford Brad B Scheib Paul P Landman Adam B AB

JAMA network open 20190301 3

<h4>Importance</h4>Cybersecurity is an increasingly important threat to health care delivery, and email phishing is a major attack vector against hospital employees.<h4>Objective</h4>To describe the practice of phishing simulation and the extent to which health care employees are vulnerable to phishing simulations.<h4>Design, setting, and participants</h4>Retrospective, multicenter quality improvement study of a convenience sample of 6 geographically dispersed US health care institutions that ra ...[more]

PMID: 30848810

Similar Datasets

Project description:Success of phishing attacks depend on effective exploitation of human weaknesses. This research explores a largely ignored, but crucial aspect of phishing: the adversarial behavior. We aim at understanding human behaviors and strategies that adversaries use, and how these may determine the end-user response to phishing emails. We accomplish this through a novel experiment paradigm involving two phases. In the adversarial phase, 105 participants played the role of a phishing adversary who were incentivized to produce multiple phishing emails that would evade detection and persuade end-users to respond. In the end-user phase, 340 participants performed an email management task, where they examined and classified phishing emails generated by participants in phase-one along with benign emails. Participants in the adversary role, self-reported the strategies they employed in each email they created, and responded to a test of individual creativity. Data from both phases of the study was combined and analyzed, to measure the effect of adversarial behaviors on end-user response to phishing emails. We found that participants who persistently used specific attack strategies (e.g., sending notifications, use of authoritative tone, or expressing shared interest) in all their attempts were overall more successful, compared to others who explored different strategies in each attempt. We also found that strategies largely determined whether an end-user was more likely to respond to an email immediately, or delete it. Individual creativity was not a reliable predictor of adversarial performance, but it was a predictor of an adversary's ability to evade detection. In summary, the phishing example provided initially, the strategies used, and the participants' persistence with some of the strategies led to higher performance in persuading end-users to respond to phishing emails. These insights may be used to inform tools and training procedures to detect phishing strategies in emails.

Project description:BackgroundAttacks on health care in armed conflict and other civil disturbances, including those on health workers, health facilities, patients and health transports, represent a critical yet often overlooked violation of human rights and international humanitarian law. Reporting has been limited yet local health workers working on the frontline in conflict are often the victims of chronic abuse and interferences with their care-giving. This paper reports on the validation and revision of an instrument designed to capture incidents via a qualitative and quantitative evaluation method.MethodsBased on previous research and interviews with experts, investigators developed a 33-question instrument to report on attacks on healthcare. These items would provide information about who, what, where, when, and the impact of each incident of attack on or interference with health. The questions are grouped into 4 domains: health facilities, health workers, patients, and health transports. 38 health workers who work in eastern Burma participated in detailed discussion groups in August 2013 to review the face and content validity of the instrument and then tested the instrument based on two simulated scenarios. Completed forms were graded to test the inter-rater reliability of the instrument.ResultsFace and content validity were confirmed with participants expressing that the instrument would assist in better reporting of attacks on health in the setting of eastern Burma where they work. Participants were able to give an accurate account of relevant incidents (86% and 82% on Scenarios 1 and 2 respectively). Item-by-item review of the instrument revealed that greater than 95% of participants completed the correct sections. Errors primarily occurred in quantifying the impact of the incident on patient care. Revisions to the translated instrument based on the results consisted primarily of design improvements and simplification of some numerical fields.ConclusionThis instrument was validated for use in eastern Burma and could be used as a model for reporting violence towards health care in other conflict settings.

Project description:BACKGROUND:The allocation of health resources in primary health care institutions (PHCI) is crucial to health reform. China has recently implemented many reform measures emphasizing the provision of primary health care services, with equity as one of the major goals. The aim of this study was to analyze the quantity, quality, and distribution of health resources in Liaoning Province from 2005 to 2017. METHODS:Data were drawn from the annual financial report from 2005 to 2017 and information from the Liaoning Province Department of Statistics. Numbers of beds and physicians were used as indicators of health resources. Capital assets per bed, value of medical equipment per bed, operational space per bed, and number of physicians with different educational levels were used as indicators of quality of health resources. Concentration indices (CI) and Gini coefficients were calculated. RESULTS:There was a steady rise in health resources in PHCI. From 2005 to 2017, the quality of health resources improved. The CI of beds showed an overall downward trend, indicating an improvement in the disparity among PHCI. There was a similar trend in the CI of fixed assets per bed. The Gini coefficients of physicians overall and physicians with different educational levels were almost always <?0.3, showing preferred equity status. There was a decreasing trend in the Gini coefficients of PHCI physicians with bachelor's degrees or higher and physicians with associate's degrees. The proportion of health resource of PHCI in health system increased from 2005 to 2009, before decreasing from 2009 to 2017 and the percentage of physicians overall and physicians with bachelor's degrees or higher in PHCI declined after 2011. CONCLUSIONS:There was an improvement in the quantity and quality of health resources in PHCI from 2005 to 2017. The distribution of health resource allocation in PHCI also improved. The findings revealed that the measures for the improvement of PHCI physicians' educational level has been successful and the measures taken by the government in health reform to strengthen the primary health care system have not been successful.

Dataset Information

Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions.

Importance

Objective

Design, setting, and participants

Exposures

Main outcomes and measures

Results

Conclusions and relevance

Publications

Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets