Healthcare organizations have accelerated their cloud migration since the pandemic but are lagging behind in implementing security measures, according to the latest research from Trend Micro, putting them at a higher risk of cyber threats than ever before.
“These projects are not simple, they’re not quick, and there is definitely a more holistic view to them that must be taken. You can’t just say we’re going to move this server from our data centre into the cloud, and hey, we’re in the cloud. That’s not a way to find those efficiencies; that’s not a way to change,” said Mark Nunnikhoven, vice-president of cloud security at Trend Micro, in an interview with ITBusiness.ca.
Globally, remote work, cost savings and improved IT agility were three main reasons for switching to cloud-based infrastructure. Skills shortages and a lack of understanding of security responsibilities remain the biggest challenges for Canadian healthcare organizations in effectively migrating to the cloud.
Approximately 50 per cent of the healthcare organization surveyed in Canada also highlighted skills gaps as a persistent barrier to migrating to cloud security solutions.
Other key takeaways from the survey specific to Canada:
- Skills shortages: Half (49 per cent vs. 43 per cent globally) revealed that skills gaps are a persistent barrier to migrating to cloud security solutions.
- Day-to-day operations: Setting and maintaining policies (32 per cent vs. 34 per cent), patching and vulnerability management (29 per cent vs. 32 per cent), and misconfigurations (35 per cent vs 32 per cent) were challenges of protecting cloud workloads.
- Increased costs: 43 per cent(same as global result) have spent more on capital expenses and paying for contracted-out services. In comparison, 43 per cent (vs. 39 per cent globally) have spent more on operational and training costs since migrating.
“A server is a server regardless of where it is, but how it runs day to day changes significantly whether that’s sitting in your own healthcare organization’s data centre or sitting in one of the major cloud providers. And the challenge here is that working in the cloud really requires a new set of skills, and there’s a big shortage of those skills. It’s sort of combining two really difficult skill sets together, cloud awareness as well as security skills, and so the two of them together are hard to find,” explained Nunnikhoven.
He adds that healthcare organizations need to understand that they can try things at a smaller scale because, in the cloud, you only pay for what you use instead of having to invest a massive amount of money all at once.
“You can actually start really simple, and that starts to enable a lot more innovation. I would say the biggest challenge or threat to healthcare organizations is not having that broader view and not having the skill set to start to take advantage of that. And that’s very understandable, that’s not to blame them. The number one priority for healthcare organizations is always patient outcomes, and it always should be,” he explained. “But only if you take a little bit of a step back and look at some of the positive use cases around the world and healthcare organizations migrating to the cloud, you get to understand that if you really embrace it and get people who really know how to leverage it, you can see some fantastic positive outcomes in delivering healthcare more efficiently to your patients.”
You moved the cloud – now what?
One of the figures from Trend Micro’s research suggests that even with the shift to digital underway across healthcare, only 38 per cent of Canadian healthcare organizations surveyed say they understand their part of the shared responsibility model when it comes to cloud infrastructure. Globally, the number of organizations expressing confidence in their understanding of that model is 48 per cent.
“I think the biggest challenge, especially for healthcare organizations, is understanding how things work in the cloud, and that’s not necessarily just the technology, but the operating model of working with a cloud service provider,” said Nunnikhoven.
It’s a different type of relationship that healthcare organizations are used to, he notes. If a healthcare organization is running a server in the cloud, the cloud provider is going to take care of the physical machine, making sure that the hardware is working well, the network is connected, and there is productive power. The cloud provider then hands over the keys to the healthcare organization, giving them the power to oversee the operating system. It’s up to the organization what they do with the keys, explains Nunnikhoven.
“But, you still need to know how to manage all that, and that model spreads across everything in the cloud. It’s key for organizations to understand how to fulfill their responsibilities in the model,” he emphasized.
Day-to-day operations are still giving healthcare firms headaches:
The research findings are based on a survey of more than 2,500 IT decision-makers in 28 countries, including Canada, across several industry sectors. For healthcare organizations, in particular, the results revealed that 88 per cent had accelerated their cloud adoption because of the pandemic, on par with the global finding.