## 2 Background and Literature Study
### Necessity of Data Security and Privacy
\begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Cyber Attack Name** & **Description** & **Mitigation** & **Impact Example** \\ \hline SQL Injection [48] & Malicious code injected via web application vulnerabilities to gain unauthorised access. & Use parameterised queries, input validation, and access controls to restrict unauthorised database access. & Community Health Systems in the US lost 4.5 million patient records in a 2014 SQL Injection attack [38]. \\ \hline Zero-Day Exploits [49] & Using undiscovered hardware or software flaws for unauthorised access. & Implement intrusion detection/prevention systems, monitor for unusual activity, and stay updated with security advisories. & Hacking Team’s 2015 breach revealed several zero-day vulnerabilities in widely used software [39]. \\ \hline Insider Threats [50] & Staff or subcontractors with access to patient data might inadvertently cause harm or steal information. & Set access controls, monitor user behaviour, run background checks, and offer regular cybersecurity training to staff. & A former employee of a New York health system was indicted in 2015 for stealing information on over 12,000 patients and selling it on the dark web [40]. \\ \hline Phishing [51] & False emails trick users into revealing sensitive data. & Provide cybersecurity training, use email filters, and employ two-factor authentication to prevent phishing attacks. & Anthem, a US health insurer, lost 78.8 million patient details in a 2015 phishing attack [41]. \\ \hline Password Attacks [52] & Cracking passwords for unauthorised access; includes brute force or dictionary attacks. & Enforce strong password regulations, regular changes, and complexity requirements, and establish two-factor authentication. & During a credential-stuffing attack on Magellan Health in 2020, 365,000 patients’ information was stolen [42]. \\ \hline Malware [53] & Dangerous software, like viruses, trojans, and ransomware, that can steal data or corrupt systems. & Implement anti-malware software, perform routine backups, and keep systems updated with security patches. & The NHS in the UK faced the WannaCry ransomware in 2017, demanding ransom for file decryption [43]. \\ \hline Supply Chain Attacks [54] & Infiltrating healthcare systems through third-party hardware or software providers. & Monitor third-party vendors, enforce strict contracts, and conduct routine risk assessments. & Cyber-attack on software developer SolarWinds compromised businesses, including healthcare providers, in 2020 [44]. \\ \hline Social Engineering [55] & Coercing individuals into disclosing private information or performing certain tasks. & Regular cybersecurity training, and impermentiing security controls like spam filters and two-factor authentication. & Save the Children suffered a BEC attack in 2018, costing them GBP 1 million due to a fraudulent money transfer [45]. \\ \hline Misconfiguration [56] & Misconfiguring medical equipment or systems makes them vulnerable to intrusions or data breaches. & Adopt automated configuration management systems, secure configuration practices, and conduct routine auditing/testing of system configurations. & In 2018, 500,000 patients’ information was stolen due to a misconfigured ransomware attack in the US [46]. \\ \hline DoS/DDoS [57] & Overwhelming healthcare systems with traffic causes breakdowns or inaccessibility. & Implement network segmentation, deploy DDoS mitigation services/hardware, and create a DDoS response strategy. & It impacts the care services, and it can happen anytime. It has a massive amount of service interruptions [47]. WannaCry sensorware in 2017 [43] has a service denial impact. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Attacks most likely to target the healthcare industry and their mitigations. Malware: Any software that is intentionally designed and developed to cause damage to a computer, server, client, or computer network. It can take many forms, including viruses, worms, trojans, ransomware, spyware, adware, and more.