Welcome to the second module of the course! In this module we will explore the social factors that may influence human behaviour in relation to medical technologies. It is often mentioned that the ‘human is the weakest link’ in cybersecurity. And while the choices we make and the way we act can be problematic, we want to show how cybersecurity incidents often stem from a combination of factors, in the interaction between the human and technology. We will take an in-depth look at how social engineers try to exploit human emotions and natural responses. Additionally, we show how social media use can become problematic. Not just in terms of patient privacy, but also as a treasure trove for cybercriminals to obtain information.

One of the most well known cases of malware, or ransomware, is WannaCry (2017) that affected the National Health Service (NHS) in the UK especially hard. The case highlights the essence of cybersecurity in the healthcare domain. For this reason we dive deeper into threats against cybersecurity in healthcare organisations in this third module. We take a look at data breaches and the consequences such incidents may have. We explore methods and motives of hackers - what makes healthcare so attractive to them? Finally, we look at different types of malware and how they are deployed. For each of these topics, we provide cases that give an overview of the events and the consequences for the healthcare organisation that was victimised. These real life examples will bring contemporary cybersecurity challenges alive.

In the fourth module, we will move the focus to methods to improve cybersecurity. In this module, we will explore the concept of cyber hygiene: practices that improve cybersecurity. These are behaviours that individuals can do on their own, but also higher level practices that organisations should employ to remain secure and resilient. In particular, we will highlight digital communication and safe emailing, encryption, device management, password management, and software management. This includes updates and backups.

In the fifth and final module, we build on the social aspects of cybersecurity by exploring the concept of cybersecurity culture. We discuss how healthcare organisations may create or maintain an environment where cybersecurity practices might be ignored, promoted, or even discouraged - influencing the uptake of good cybersecurity behaviours. Often, policies and regulations are implemented to steer behaviour and improve cybersecurity. But as you will learn, merely implementing such policies may not be successful as workers may find ‘workarounds’, or ways to circumvent security measures. We will show how investing in cybersecurity culture may be necessary to prevent workarounds from being exploited, making employees more aware and invested in cybersecurity, and to improve cybersecurity in the healthcare organisation. Do you work for a hospital, clinic, medical practice, care centre, care provider, social care organisation, or nursing home? Do you want to improve your personal or your organisation’s cybersecurity (cyber security, IT security, information security, network security, computer security, awareness)? Then please visit www.securehospitals.eu to gain access to a range of resources. You can also join the Security providers and Trainers platform (see: https://www.securehospitals.eu/for-providers-and-trainers/) or our Community of Practice (see: https://www.securehospitals.eu/community/).