State of Threats in Healthcare & Critical Infrastructure | FortinetLIVE

### Overview In this FortinetLIVE session, Rick Peters, Field CISO for Operational Technology (OT) in North America at Fortinet, speaks with Troy Ament, Fortinet's Field CISO for Life Sciences and Healthcare. Together, they examine the intersection of critical infrastructure, operational technology, and healthcare security heading into 2022. The discussion highlights how the rapid digital transformation prompted by the COVID-19 pandemic expanded attack surfaces and attracted targeted adversary activity, creating critical challenges around operational resilience, supply chains, and clinical continuity.

### Key Topics - **Digital Acceleration and Changing Attack Surfaces:** Over the course of the pandemic, healthcare organizations underwent massive shifts, including remote workforce mobilization (such as moving thousands of employees home in weeks), dramatic expansion of virtual visit platforms from roughly 100 to over 45,000 monthly visits in large systems, data sharing with local and state governments, and automated tracking of PPE and ICU capacities. In life sciences and pharmaceutical manufacturing, rapid vaccine production amplified visibility and made these organizations prime targets. - **Evolution of Adversary Tactics:** While attackers largely held off targeting providers in the initial months of 2020, they soon exploited the strain on health systems. Spikes in ransomware caused major disruptions, prompting tens of millions of dollars in ransom demands. Attacks have also expanded beyond hospital facilities to upstream third-party cloud service providers offering payroll, staffing, billing, revenue cycle services, and electronic medical records (EMRs). - **Convergence of Healthcare and Operational Technology:** Both OT and healthcare share critical dependencies on reliability and safety. Both sectors face high consequences from outages and must proactively protect distributed environments that span on-premises equipment, cloud platforms, and software-defined networking.

### Technical Details - **Zero Trust and Multi-Factor Authentication:** Health systems are increasingly adopting Zero Trust principles to minimize blast radiuses and attack footprints. This adoption is accelerated by cyber insurance requirements, notably driving multi-factor authentication (MFA) adoption beyond previous ~70% levels. - **Integrated Security Architecture:** The speakers advocate for moving away from fragmented tools toward integrated mesh or fabric-based security architectures that embed governance and protection directly into clinical workflows and business systems. - **Behavioral Analysis and Telemetry:** Enhancing situational awareness requires utilizing behavioral analysis and data-driven visibility to recognize anomalous adversary activity early across IT, OT, and connected domains.

### Takeaways - **Operational Downtime Awareness:** Executive leadership and CEOs now recognize that cyber incidents can cause two to three months of severe operational downtime, shutting down critical workflows such as EMR access and electronic prescription routing. - **Maturing Security Operations:** Healthcare entities that weathered near-misses have demonstrated that investing in mature security operations centers and proactive defenses significantly reduces operational damage. - **Collaborative Defense:** Cybersecurity in critical infrastructure cannot be tackled in isolation. Healthcare and OT organizations must treat cybersecurity as a team sport, working closely with external partners and peers to build resilience as threats evolve into 2022.