Preparing for cyberattacks: a case study of resilience in the health-care sector

Abstract

Nowadays, health-care organizations rely extensively on information technology and systems for providing high-quality services to their patients and exchanging data with external partners. However, these organizations, processes, and operations are vulnerable to criminal activities and digital security breaches, which has led health-care organizations to build various protection mechanisms, including firewalls, virus scanners, and security policies that enhance their ability to prepare for threats; design activities to be conducted during a cyberattack; and implement means to recover from an unfortunate event. Although these moves have been acknowledged in research and in practice, there is still little knowledge available on how organizations understand and perceive such events as well as their consequences. To this end, we conducted a qualitative case study that included 14 interviews with diverse key actors at a Finnish hospital. From them, we aimed to understand how the organization has prepared for cyberattack resilience. By generalizing our case research, we built a framework for analyzing and improving organizational resilience. This framework makes significant contributions both to theory and practice.