# Cybersecurity in Hospitals: An Evaluation Model
## 2 Background
### Cyber-Attack Types in Hospitals
#### 2.2.3 Loss or Theft of Equipment or Data  
The loss of equipment decreases the productivity of hospitals on the one hand and endangers patients on the other hand [10]. Devices such as laptops, tablets, phones, and USBs in hospitals are considered as parts of the hospital's equipment [7]. If this equipment is stolen, it can end up in the hands of attackers who might take advantage of the situation [7]. Those devices might contain sensitive information or data, and the loss might be catastrophic if they are not password-protected. Some vulnerabilities increase the chance of the occurrence of this type of attack, such as a less-frequent assent inventory schedule, lack of physical security practices (i.e., leaving offices open), lack of awareness, and lack of data encryption. In addition, patient safety will be compromised. This type of attack will disrupt the services offered and break the trust between the patients and the organization [7]. 2.2.4. Insider, Accidental, or Intentional Data Loss  
Advances in the healthcare technology have led to the use of paperless systems [11]. This fact minimizes the availability of data in physical forms and increases its availability in digital forms [11]. This leads to increases in losses of data or attacks to steal data. Insider accidental data loss is considered a type of unintentional loss caused by honest mistakes [7]. Honest mistakes could be because of a degree of negligence or errors due to procedures and policies [7]. On the other hand, intentional insider loss of data is considered malicious loss or theft. This threat is caused by an employee or any person who uses the hospital's technology and network to benefit personally. Some of the reasons for this type of threat are negligence in sharing data, a lack of data monitoring, a lack of access limitations to sensitive data, and a lack of awareness. This threat can affect patient safety if a patent's data are altered somehow, such as an alteration to a prescribed medication [7]. 2.2.5. Attacks against Connected Medical Devices  
According to the Saudi FDA, a medical device is defined as \"an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or another similar or related article, including a part or accessory, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease\" [5, 7]. Medical devices have been evolving in the past decades and have been digitalized instead of remaining analog [12]. Modern medical devices depend on software programs that require connections to external devices and servers, which increases the risk of attacks [12]. Attacks against connected medical devices are initiated by taking control of the care provider's computer [7]. This is possible through email phishing and other methods [7]. Once the attacker is in the network, they can control the connected devices, power them off, reboot them, and alter their settings [7]. The system's vulnerabilities that make this threat possible include patches to maintain medical devices not being implemented correctly [7]. Failing to update medical equipment within the required time can be another reason for this type of threat [7]. The unavailability of the cybersecurity information from the medical devices to the hospital is another system vulnerability [7]. Medical devices can be invasive or non-invasive. Most medical devices are connected to a network to function. Cyber-attacks on medical devices can affect patients' safety in several ways. For instance, attacking implanted medical devices, such as implantable cardioverter defibrillators (ICDs), can result in fatalities [13]. In addition, patients might not receive the desired outcome from the medical device due to cyber-attacks [7]. This can happen when patients' data in their medical records are altered or changed, causing inaccurate assessments or treatments [13]. A threat to medical devices in a hospital causes broad hospital operational impacts due to medical devices being unavailable [7]. 2.3.