UK Ambulance Service

The UK Ambulance Service is the latest target of Russian hackers according to a recent report.

Like much of the NHS and other critical infrastructure service providers across the country, Russian FSB and GRU spies along with criminal proxies have been engaged in a coordinated campaign to infiltrate and reconnoiter large parts of the UK’s critical infrastructure services. This includes the Civil Service, the Ministry of Defence, and many of their contractors.

One of the objects of these cyber-attacks has been key suppliers to the UK Ambulance Service. Here individuals working on the Ambulance Radio Program have been targeted from multiple directions by hackers in a credentials-harvesting campaign to potentially crash the entire communications system. This would leave ambulance command centres unable to communicate with drivers and the police or fire services or prevent them from receiving vital location information.

The incident is believed to form part of a new Russian cyber warfare campaign dubbed by UK intelligence sources “Cyber Wagner”, in reference to the hardline Russian mercenary group run by the late Yevgeny Prigozhin.

“This is the new front in Russia’s aggression against the West,” a western intelligence source monitoring the activity reported “We need to prepare Western states for more aggression and hybrid warfare from Moscow.”

This week, MI5 director Ken McCallum announced that Russia is on a “sustained mission” to create “mayhem” across Britain and Europe. The UK's "leading role" in supporting Ukraine means "we loom large in the fevered imagination of Putin's regime" and further acts of aggression on UK soil should be expected, he warned.

This would not be the first time that critical UK systems have been besieged by cyber adversaries. Russian GRU agents have carried out "arson, sabotage and more dangerous actions conducted with increasing recklessness" since the UK backed Ukraine in its war with Russia, he added.

The revelations come just months after hackers behind a catastrophic NHS cyber-attack in the summer were identified to be part of a wider cyber army working under the Kremlin’s protection trying to destabilise the UK.

In June, healthcare services were disrupted across London after a major cyber-attack targeted Synnovis, a pathology testing organisation, severely affecting services. This led to the cancellation of 8,349 acute outpatient appointments and 1,608 elective procedures across much of South London at King’s College Hospital, and Guy’s and St Thomas’ NHS Foundation Trusts and their associated hospitals and clinics.

Qilin, which was held responsible for the assault, is merely one arm of the wider web of hacking affiliates, using servers based in Russia to carry out attacks on UK critical infrastructure. The hackers said the incident was in response to “unspecified wars”. The attack on the NHS was a “major escalation” of the Kremlin’s use of cyber warfare through use of criminal proxies.

As tensions continue to escalate, these attacks become less about opportunity for criminal profits and more about the desire to inflict damage to the critical infrastructure of another country. The fact that the Kremlin appears to be enlisting the support of criminal groups is not exactly a surprising development for many. It is widely acknowledged, that for many years, the Russian State has been providing safe harbour to Russian organised crime syndicate members accused of crimes in other countries by refusing arrest or extradition requests. So long as perpetrators direct their criminal business to organisations outside of the Russian Federation, they are allowed to operate with near impunity.

Although no definitive connection has been proven between the Russian State, criminal gangs, or the Russian Mafia, a close working arrangement has been evident for quite some time according to cybersecurity experts. Despite this, certain state and non-state actors within Russia appear to be intent, if not on the cusp of, launching a cyberwar with the UK, Europe and North America.

Read More

Isn't it about time we secured BGP?

Border Gateway Protocol or ‘BGP’ as it is more often referred to as, has been a staple of internet routing since the heady days of 1989 when TCP was finally getting into its stride, and the internet as we know it, was in its infancy.

BGP enables routers to determine the most efficient paths for data to travel across networks to ensure scalability and efficiency. The protocol allows network backbone providers to announce routes across networks and is the primary routing protocol used to exchange routing information between different autonomous systems on the internet. The trouble is that like many things to do with the internet it was never really designed to be secure and this leads to all kinds of problems as we shall see.

BGP has been abused multiple times, since Al Gore claims to have invented the Internet. Joking aside - it was actually Vint Cerf and Bob Khan who are credited with the accomplishment, but BGP has suffered some pretty high-profile attacks that have caused outages, or even more alarmingly, to route traffic through a specific country – one known for its prolific cyber espionage practices.

In 2008, a Pakistani ISP wanted to block access to YouTube within Pakistan but accidentally announced a BGP route that led to all of YouTube’s global traffic being redirected through Pakistan. This caused a worldwide outage of YouTube for several hours, although YouTube has probably never been faster in Pakistan before or since.

Then in 2010, China Telecom “accidentally” advertised incorrect BGP routes that caused a significant amount of global internet traffic, including that of U.S. government and military sites, to be routed through China. Naturally, neither the US government nor the Department of Defense was very happy about that little so called “error”, especially considering at the time, not all government network traffic was being encrypted.

More recently in 2018 cybercriminals hijacked BGP routes for Amazon’s Route 53 DNS service to redirect traffic intended for MyEtherWallet, a popular cryptocurrency wallet service, to a malicious server owned by the perpetrators. The attackers then stole users' cryptocurrency by tricking them into entering their credentials on the fake site.

The White House naturally has been considering options to replace or upgrade BGP with an improved authentication scheme to remove opportunities for abuse and cybercrime, including any cyber espionage that nation states may be considering. Its proposed solution is the Resource Public Key Infrastructure (RPKI) - a security framework designed to enhance the security of BGP by providing a way to cryptographically verify the ownership of IP address blocks and the authorization of networks to announce specific routes.

To that end, the White House has released a guidance document for ways of improving upon BGP in a proposed roadmap to enhance internet routing security. This includes the adoption of new technologies including RPKI. As a government press release stated today, “these recommendations are of particular importance to the networks used by critical infrastructure owners and operators, state and local governments, and any organization dependent on internet access for purposes that the entity considers to be of high value.”

The press release went on to say that “by the end of the year, it is expected that over 60% of the Federal government’s advertised IP space will be covered by Registration Service Agreements (RSA), paving the way to establish Route Origin Authorizations (ROA) for Federal networks.”

The White House is obviously taking the risks of major BGP attacks very seriously and is looking to protect against these apparent threats immediately.

“Internet security is too important to ignore which is why the Federal government is leading by example by pushing for a rapid increase in adoption of BGP security measures by our agencies,” said White House National Cyber Director Harry Coker, Jr. “ONCD, along with our public and private sector partners, are guiding a risk-informed path forward towards our communal objective. We aim for this roadmap to mitigate a longstanding vulnerability and lead to a more secure internet that is vital to our national security and the economic prosperity of all Americans.”

The full roadmap can be read or downloaded in PDF here.

Read More

The Growing Rural Healthcare Cybersecurity Crisis

Rural America and Urban America can seem like two different worlds. Just look at the political map, or the disparity in wealth between ‘country folks’ and ‘city slickers’. Perhaps the most alarming difference, however, is the availability of basic healthcare services.

If you live in rural America, you could be 2- or 3-hours’ drive away from the closest renal dialysis center, or radiotherapy and chemotherapy clinic. You may also be several hours away from the nearest stroke or trauma center which in an emergency, could mean the difference between life and death.

As for many other medical services, rural Americans must make do with what is available in their community - a local midwife rather than a maternity hospital or ‘new life center’ staffed with neonatal experts and incubators in case they are needed. Go into labor early or present as a high-risk pregnancy and be prepared to be ambulanced or worse, air-ambulanced at huge expense, to a city hospital where you and your infant can be cared for. Today, anything other than basic medical services usually means a long drive to the nearest city.

The trouble is, that what remains of rural health services is rapidly declining. Rural hospitals and entire rural health systems are closing, and those that remain open, are continuously reducing their specialist services, which may not be used enough to remain profitable or cover costs.

A new report from the American Hospital Association (AHA) states that 136 rural hospital closures have occurred between 2010 and 2021, and a record 19 closures in 2020 alone. Beckers, in a recent article reviewed a larger period claiming that nearly 200 rural hospitals have closed since 2005. What’s even more alarming is the pace of closure is accelerating. Eight rural hospitals closed in 2023, as many as in 2022 and 2021 combined, according to the Center for Healthcare Quality and Payment Reform's latest report.

As recently as this month, the Eastern Plains Healthcare Consortium (EPHC) stated during its annual conference that 20% of rural hospitals in Colorado are at risk of closing. They require a 4% operating margin to replace equipment and maintain existing services, however, nearly all are currently running in the red, some as much as -17%. EPHC estimates that some 30 rural Colorado hospitals will be forced to convert to emergency only services as Emergency Rural Health Hospitals to save closing altogether.

Some of these hospital closures are the result of cyber-attack and in particular, one recent Illinois hospital closure is blamed upon a 2021 ransomware attack that prevented it from submitting claims to payers for months, killing its cashflow and financial viability. Another small hospital had its entire payroll stolen in a cyberattack preventing it from paying any of its staff and placing it in financial peril.

The Change Healthcare cyberattack earlier this year has exacerbated the plight of small providers and in particular rural clinics and physician practices. Many physicians are struggling to keep their practices afloat according to the American Medical Association (AMA) and even though UHG, the owner of Change Healthcare, has publicly said it will provide relief in the form of Temporary Funding Assistance to impacted providers, this is very selective, one-sided and fraught with caveats according to Richard Pollack of the AHA in a letter to UHG.

Challenges for Rural Healthcare Providers

Rural providers face many challenges: finances, through rural depopulation and a disproportionate number of rural patients on Medicare and Medicaid, general resource constraints, and huge difficulty attracting and retaining nursing, physician, and other staff. Most notable of these is the lack of trained and experienced cybersecurity staff to protect rural providers from an increasing volume of cyberattacks.

These hospitals run on a small number of IT generalists and often find it difficult to patch systems in a timely manner, let along obtain the budget or expertise to implement the latest security tools and services. Many operate on end-of-life computer hardware and medical devices no longer supported by vendors. Compared to urban providers these hospitals are an easy target for criminals and are frequent victims of PHI breaches, ransomware, and other attacks.

Like their urban cousins, rural hospitals are undergoing a digital transformation to new clinical and IT systems. This involves the addition of more medical and other IoT systems including connected building management systems for HVAC, elevators, proximity door locks, CCTV cameras, and Pyxis drug cabinets. These systems dramatically expand the cyber threat surface and unless secured and maintained, can significantly elevate the risks of attack. But rural providers often lack the specialist skills to safely manage these systems. That is perhaps why, many are turning to a combination of Managed Services Providers (MSPs) and Managed Security Services Providers (MSSPs) to effectively outsource security and much of IT.

MSPs and MSSPs will manage a large number of hospitals at the same time and through a leveraged model can provide point expertise as needed in more or less any technology or vendor system. They can also implement advanced SaaS tools from Cylera and others to identify the growing number of connected assets and evaluate and prioritize risk remediation. Indeed, the incorporation of SaaS services is rapidly helping to drive improvements in rural provider cybersecurity, especially in medical device security, a growing problem for all healthcare providers.

The advent of managed services has become particularly important given a new assistance program for rural hospitals orchestrated by the White House and the AHA in June of this year. Microsoft and Oracle have agreed to provide free and heavily discounted cybersecurity resources to assist rural hospitals with access to many of their security tools and technologies. However, so far, relatively few rural hospitals are taking advantage of a free program designed to thwart ransomware attacks according to the White House this week. Only 350 of the 1,800 small and rural US hospitals are currently leveraging this assistance program.

It appears that without MSP or MSSP help, many rural providers are simply unable to accept or implement these discounted tools or utilize the free security assessments because they don’t have the manpower bandwidth to do so. This is the Catch22 of providing security assistance to rural health providers. Thankfully, for some, the MSP/MSSP buffer is helping to facilitate this today.

While near term improvements to rural hospital cybersecurity will be of great assistance in helping to reduce cyberattacks, there are still long-term structural problems of maintaining the continued presence of rural providers and access to healthcare services for rural communities. The healthcare industry faces many problems, not least of which is unmitigated cybersecurity risk. While urban providers can rely upon numbers to maintain services and a plentiful supply of cybersecurity talent nearby to avoid the worst of the attacks, rural providers face almost insurmountable challenges. This is undoubtedly a larger political question of healthcare reform that the next administration will need to prioritize.

Read More

When is Enough, Enough?

This week marks yet another dark moment for healthcare with yet another Russian cyber-attack against a supplier of critical services for two major London hospital trusts where over 200 life-saving operations and hundreds of other appointments have had to be cancelled, while ambulances have been placed in divert.

Impacted are King’s College Hospital, Guy’s and St Thomas’ - including the Royal Brompton and the Evelina London Children’s Hospital – along with their associated primary care services. This includes GP services across Bexley, Greenwich, Lewisham, Bromley, Southwark and Lambeth boroughs. All have had to revert to paper for blood tests and transfusions thanks to a ransomware attack against Synnovis, a provider of pathology services.

“This is having a significant impact on the delivery of services at Guy’s and St Thomas’, King’s College Hospital NHS Foundation Trusts and primary care services in south east London and we apologise for the inconvenience this is causing to patients and their families,” said an NHS spokesperson in statement.

Synnovis is a pathology partnership between Guy’s and St Thomas’ NHS Foundation Trust and King’s College Hospitals NHS Trust, and SYNLAB, Europe’s largest provider of medical testing and diagnostics. On Monday it was hit with a cyber extortion attack, evidently the work of a Russian criminal group known as Qilin, which has demanded a $50 million ransom payment to be made within 120 hours. As a result, an emergency was declared, the National Cyber Security Centre notified, and the Cyber Operations Team called in for assistance. All of Synnovis's IT systems are believed to be affected.

The incident follows a separate case at Synlab Italia, which in April involved a different Russian group known as Black Basta forcing the company's services offline. The group has been linked to the Conti ransomware group, an even more infamous Russian organized crime syndicate. Following this attack, it took the provider nearly a month to restore the majority of its systems. It appears Synlab Italia didn't pay whatever ransom was demanded of it as Black Basta claims it has Synlab's data available for download in its blog. Black Basta is also thought to have been responsible for the attack last month against US healthcare provider Ascension Health.

The attack this week against Synnovis however, appears to be the work of yet another Russian crime group known as Qilin. This ‘Ransomware for rent’ group has targeted IT firms, medical organisations, courts, the 'Big Issue', and appears to operate with Vladimir Putin’s blessing. 'Qilin', also known as 'Agenda', has hacked hundreds of victims over the two years it has been operating under its known identities. Qilin’s 112 known victims span 30 different countries, with Russia and the Commonwealth of Independent States – (ex-Soviet satellite countries) - being the notable exceptions. No need to wonder why!

According to a recent report by Bloomberg, while responding to questions about the breach through a messaging account long associated with the gang, a representative for the hackers said that they were very sorry for the people who suffered, but refused to accept responsibility for the human cost. They suggested 'the attack was justified because it was in retaliation for the British government’s involvement in unspecified wars'.

The Guy’s and St Thomas’ and the King’s College Hospital NHS Foundation Trust attacks are not unique events. In fact it's the third such attack in the past 12 months against NHS trusts. In June of last year, a Russian cybercrime gang called BlackCat hacked the Barts Health NHS Trust. Then earlier this year yet another Russian gang, INC Ransom, attacked NHS Dumfries and Galloway stealing 3 TB of protected health data.

The Russians have certainly cornered the cyber-extortion market, a criminal industry worth $14 billion as of 2022 and one growing rapidly at 73% according to SANS. Indeed, the growth of this industry appears to be directly linked to the number of ransoms being paid by victims, which in the first half of 2023 were estimated to have been more than $590 million. Cyber-extortion is according to the NCA and FBI, a form of cyber-terrorism. So, in effect, those who pay extortion payments could be breaking the law by giving money to wanted terrorists, yet many still do so and few of those who are directly financing this trade have been arrested or prosecuted thus far.

$590 million is also a valuable source of income and hard currency for Russia given all the trade sanctions the country is under following its partial invasion and ongoing war with Ukraine. What’s also apparent, is that no one in a criminal oligarchy like the Russian State is going to make $20 million a pop in ransom payments without sharing at least some of that new-found wealth with others all the way to the Mafia Don at the top, i.e. one Vladimir Vladimirovich Putin, reportedly the richest man in the world today.

But the costs of a ransom attack are far greater than merely the ransom payment (if payment is made), or the costs of forensic investigation, incident response, fines, lawsuits, and punitive damages. The costs when healthcare is attacked is measured in lives. How many patients die as a result of not receiving timely intervention and treatment (mortality), how many will die earlier than expected or are made to suffer for longer periods of time (morbidity), and how many patients are placed at risk thanks to critical IT and IoT systems being down and whose safety maybe compromised as a result.

Attacks against healthcare are not only an attack by a foreign adversary against a critical national infrastructure industry of a nation state, but also an attack that threatens the lives and wellbeing of its citizens. Attackers therefore run the risk that the full power of the state they attack might be used against them, kinetically, when all legal avenues fail to bring them to justice, or to stop their attacks. Russia does not regard cyber-attacks against other countries as a crime, nor does it honour extradition treaties with the rest of the world. Even then, its criminal justice system is irrevocably compromised and corrupted by money, power, and influence.

It is unknown to what extent the Kremlin is behind cyber-attacks against foreign critical national infrastructure, but Russia certainly turns a blind eye to it at the very least, by offering safe harbour to those engaged in this criminal activity. What is for sure, is that the criminal activities of some Russians, is helping to weaken and degrade many of Russia’s foreign adversaries. At the very least, the use of criminal proxies rather than official state assets, provides the Kremlin with some level of plausible deniability, no matter just how implausible that is now becoming, or how insincere Putin’s claims of denial are today.

Until such times as Russia finally fails as a state, and a new Russia adopts a real legal-judicial system - one uncorrupted by others so that criminals can eventually be held to account, the NHS and other providers of healthcare services including third parties, will need to seriously improve cybersecurity and operational resiliency of key systems needed by patients. The UK will also need to critically evaluate any single points of failure in application or underlying infrastructure, just as the US needs to following the recent UHG Change Healthcare attack. Relying on a single vendor or single application for critical parts of medical workflow can no longer be supported. The ability to switch out failed components of a modular architecture is already crucially needed, yet few healthcare providers have reached that level of resiliency today.

Out of all industries, health-care providers were the most targeted by ransomware gangs last year, according to a report by Cisco's Talos threat intelligence division. Cisco attributed the targeting to health-care organizations generally having “underfunded budgets for cybersecurity and low downtime tolerance.”

Given the criticality of IT and IoT in today’s digital health system and continuously rising cyber threats by adversaries, we need to focus a lot more time, effort, and money to build our healthcare services to be able to withstand all but the most destructive of attacks.

Read More

Mitigating Medical Device Vulnerabilities

How can health systems secure smart medical devices if manufacturers don't patch them regularly? Richard Staynings, chief security strategist at Cylera, discusses how organizations can mitigate that risk using their existing tools and technologies at HIMSS24 in Orlando, Florida.

 

Read More

Lockbit Take-Down

Many of us in the cybersecurity community woke this morning to very welcome news that the infamous Lockbit Ransomware as a Service (RaaS) crime syndicate was hit with a take-down action of much of its infrastructure. This was apparently led by the UK’s National Crime Agency (NCA), and the FBI, as part of an international law enforcement task force known as ‘Operation Cronos’.

Lockbit was one of the most prolific and destructive Russian Ransomware-as-a-Service (RaaS) groups, claiming over 2,000 victims worldwide and extorting over $120 million in ransom payments. It was, to put it mildly, ruthless, launching secondary and tertiary attacks against victims who refused to negotiate with the extortionists or to pay their extortion demands.

As part of its initial seeding of compromised networks with ransomware, it exfiltrated confidential information and threatened to publish this on its websites if payments were not made by the organization. When demanded ransoms were not received, the group contacted individuals whose information it had stolen, and demanded they pressure the victim organization to pay the ransom, or sometimes offered to exclude their information from a release if a payment was received.

    

Richard Staynings, Cylera

“Many times, corporate and individual victims paid the gang only to see their information posted publicly anyway” claimed Richard Staynings, Chief Security Strategist with Cheltenham based cybersecurity firm Cylera. “There is after all, no trust in thieves,” he added.

The group was also known to publicly taunt victims on its web site with a countdown clock when the information would be published unless payment was made.

Operation Cronos appears to have finally brought this criminal RaaS business to a halt, or at the very least slowed it down and ruined its reputation. Whether it stops the affiliates who use the RaaS to execute their attacks remains to be seem as it's likely that many of the Lockbit tools are still out there and affiliates are likely to have copies of these. 

It’s also quite likely, that many of the un-indicted perpetrators involved in Lockbit, will simply pick up and move into new crime groups to continue to ply their crafts as part of other cybercrime services. This has happened in the past when law enforcement took down other crime syndicates. It is also possible that a new Lockbit rises from the ashes and starts over again, perhaps even under the same name with some of the same people.

Some of these crime syndicates are thought to be associated with the Russian Mafia and many in the past have worked closely with the Kremlin, FSB and GRU for espionage purposes, or to punish other nations, while Mother Russia can claim plausible deniability.

Many of the cybercriminals who engage in ransomware and other forms of cyber extortion, are of Russian origin and are able to attack victims from within Russia and other former Soviet states with near impunity. This is largely thanks to a lack of extradition treaties between these countries and the rest of the world, combined with a legal system that is easily corrupted by those with power, influence or money.

The FBI has accused Russia of harboring cybercriminals for years, where as long as the perpetrators of cyber crime direct their craft against victims outside of Russia, then the Russian state will conveniently turn a blind eye. This makes it particularly difficult to bring criminals to justice so long as they don't leave the former soviet block of countries.

Of course some wanted criminals used to considering themselves above the law have traveled outside of the former Soviet states and have been arrested or renditioned back to the United States for trial and punishment. One of the more notable of these was Roman Seleznev, the son of a close Putin confident and a member of the Duma lower house of parliament, Valery Seleznev as reported some time ago by this site. 

Lockbit was the largest RaaS and worked by selling its criminal services, acting as a one-stop shop to customers known as affiliates. These affiliates then identified and attacked victims using the Lockbit framework of tools and services. Based upon volume, the affiliates then received between 60% and 80% of the ransom payments they were able to extort back from Lockbit. The Lockbit network consisted of hundreds of so called ‘bullet proof’ servers located all over the world. These have now been taken over by law enforcement as part of the Europol action. Copies of the Lockbit code, however, remain on PCs and servers in Russia and other countries where international law enforcement was unable to seize assets, since the crime of ransomware is not recognized in many of these countries.

It was perhaps inevitable that the NCA would lead this takedown effort following a January 2023 ransomware attack against part of the UK Royal Mail in which packages could not be mailed overseas for many weeks. The attack was identified as using Lockbit so the group must have been in the sights of the NCA ever since. The Royal Mail is a critical infrastructure industry (CII) of the UK so any attack against a CII would have garnered attention at the highest levels, just as Lockbit attacks against the NHS have done so in the past.

“While not all cyber crimes can be fully investigated, I am sure that Lockbit and its affiliates were prioritized by the NCA and the UK government following the Royal Mail attack,” said Staynings. “Lockbit ransomware attacks against NHS trusts was already sure to get the NCA’s attention, so the Royal Mail attack may have been the nail in the coffin for the group.”

“Gangs would be well advised to stay clear of national infrastructure industries if they want to avoid unnecessary attention. That goes not just for the UK, but for any law-abiding western power,” Staynings added.

While the Lockbit infrastructure was taken offline and decryption advice and keys posted on its servers, law enforcement reportedly obtained access quite some time ago. It's highly likely that they have been digging around and gaining intelligence on affiliates and those involved in building and maintaining the Lockbit service. It is also likely that they were mapping out the entire infrastructure so as to capture as much of it as possible in one go with a single legal seizure action.

This has resulted in the identification, indictment, and arrest of many of the gang’s generals. But it has also shed light on a much greater number of victims than has been reported, many of whom appear to have paid ransoms against the advice of law enforcement and national laws in their respective countries that forbid extortion payments to terrorists. Ransom and extortion are, after all, forms of terrorism.

“The cat is now out of the bag, and we could see legal actions against business leaders and their legal counsel, who made ransom payments against national laws and hid a cyberattack from shareholders, and the SEC, FCA, and others,” claimed Staynings.

Graeme Biggar, NCA

The NCA’s Graeme Biggar, said it assessed that the group was responsible for 25% of ransomware attacks in the last year including 200 that were known of in the UK - though he added that, there may have been many more. Indeed, total losses and damages from Lockbit and its affiliates could be in the billions of dollars. Whether this surpassed losses from ‘NotPetya’, another Russian cyberattack attributed to the Russian military GRU, remains to be seen.

NotPetya is thought to have caused between $10 and $12 billion in damages to global organizations attacked, including Maersk, Mondelez, Merck, WPP, Reckitt Benckiser, Saint-Gobain and TNT Express. 

Maersk alone lost $250 million and suffered a further $300 million in damages. The 2017 cyberattack currently stands as the single most damaging and costly attack of all time. Its attack code was designed to attack Ukraine, but the malware unintentionally spread right the way across the world, impacting Russian businesses as well.

As part of the seizures, more than 200 cryptocurrency accounts believed to be linked to Lockbit have been frozen, so it seems likely that once the investigation is complete, at least a few victims may receive some of their ransom payments returned, as has been the case in other confiscations.

“It’s great to see the home team win a game finally, but there’s a long way to the finals” claimed Staynings. “The trouble is that with cybercrime it takes many months or years to properly attribute actions. That includes victims, criminal actors, and all those involved in a cyberattack.”

“Undoubtedly, law enforcement needs to do things properly in order for prosecutions to stick and to identify all those involved in a criminal act. This was one of the better days, that’s for sure!” he concluded.

Read More

Building AI-based cybersecurity solutions

Richard Staynings, chief security strategist at Cylera, discusses the difficulties involved in being a cybersecurity professional, tackling bad actors and how AI can both improve and hinder strategies to ensure healthcare system security. (7m 14s).

Read More

ResonanceFM PassWord - The Security of IoT

Peter Warren host of 'PassW0rd' part of Future Intelligence (Fi). 

Join Richard Staynings and Peter Warren, host of 'PassW0rd' as they discuss the growing problem of the cybersecurity of IoT - the internet of things.

Future Intelligence (Fi) produces PassW0rd, its monthly hour long radio programme from London and Leipzig for broadcast on Resonance FM, London’s oldest independent radio station.

Read More

Been Vished Lately?

By Jon Taylor
Director and Principal of Security, Versa Networks

A lot of vendors lately have been talking about how they can help companies be “less hackable” through the implementation of advanced technology, reducing the attack surface, etc. One item you don’t hear security vendors talking much about is how companies can implement some basic security awareness policies that can also drastically reduce the chances of being compromised, or at least make it a bit harder for bad actors to gain access to the network.

One example that we can discuss in detail was an event that happened at the Defcon Social Engineering Village this year. One such opportunity was thoroughly demonstrated, although I honestly couldn’t believe my eyes (and ears!). On Day One they were having a vishing competition, where teams were placed into a sound booth with a phone dialing system, and they cold-called different businesses to probe for sensitive information on how these companies secured their environments. Now, one might say that there’s no way that someone doing this would really gather anything useful, but the results will absolutely surprise you, as they did me.

Vishing meets supply chain

Now, these vishers weren’t trying to call and gather information from the IT departments of major companies, but instead they were calling franchisees of large companies that we know (and love!). The competing teams were tasked with gathering some key pieces of information, and to do so were calling the individual franchises and acting as if they were from corporate parent company posing at the IT department, franchise relations, or even another franchisee. What’s interesting about this information is that it would have given these vishers the ability to backdoor and compromise not just the franchise, but also gain access to the corporate system as well. The information they were gathering ultimately centered around the franchise-accessed resources provided by the parent company, including technologies such as VPN/ZTNA services and secure websites published to the internet as examples. Some of the resources they were probing for were corporate ordering, timecard/revenue entries, other types of inventory control, etc. They would also ask questions about the type of antivirus/anti-malware being used on the machines, especially the point-of-sale terminals.

If the above sounds bad, it was actually worse. During the exercise, at some point they would have the "mark” go to a mocked-up website from a point of sale (POS) terminal that would self-install a piece of malware, which allowed them to gain access to the computer. Now imagine what would happen if this POS terminal became compromised in some way. Just the amount of credit card information alone would be incredibly valuable on the dark web if it was to be sold. Also, if this terminal had any type of access to the parent network, then the payload could allow the malicious actor to enter the parent corporate system and do anything from planting ransomware to exfiltrating sensitive data. During one call, an employee even offered to share her computer screen and show the visher how they logged into each system using a VPN service and offered up usernames and passwords. If this had been a real malicious actor gathering this information, then this would have been disastrous for both the parent company as well as the franchise as the incident response, public disclosure, and loss of reputation could cost millions.

Now one might say that this is an example of a small business being targeted so of course there isn’t going to be security awareness training, and as long at the parent company has the right security tools they will not be breeched. Well, the latest example of this is the MGM incident. The exact same thing happened to a major corporate brand where someone was able to perform a vishing exercise and ultimately gained access to the corporate environment.

Make people aware

So, what kind of “low-hanging fruit” items should any organization be doing? First off, there should be policies in place for any employee within the company to be able to accurately identify any other employees from the company. There should also be mandatory security awareness trainings for all employees including IT, and it should be renewed within one year of the initial training. In the case of a franchise model and because of the supply chain risk, the franchise parent company should implement these mandatory security awareness trainings as part of their franchise agreement.

Read More

What is the Cost of Loss?

Join Richard Staynings on The Segment: A Zero Trust Leadership Podcast as he explores the questions of 'Why is Resiliency so important?' 'What is Zero Trust?' and 'What is the Cost of Loss?' following a breach.

Tune in to this 45 minute podcast as Richard Staynings and host Raghu Nandakumara discuss very topical cybersecurity issues and concerns for healthcare and other industries.

Read More

The Maturity Paradox

The Healthcare industry has undergone a dramatic technological transformation over the past decade. From our frustrating interaction with a provider’s voice menu systems before we can speak with a human, to script-reading near-useless overseas calls center staff that attempt to sort out medical billing problems, we have finally entered the digital era. Gone are the days of calling a provider, simply jump on the online provider web portal or open the mHealth app on your smartphone and get what you need – well almost!

Long gone are the days of fat manila files full of medical records that no one ever looks at (unless there is a problem) and welcome-in the days of the electronic medical record (EMR) with seamless interoperability across primary, secondary, and tertiary health providers. The EMR that prevents 10 different nurses asking you the very same question on each visit (yeh right!)

Gone are the days of the suited elderly stoic medical doctor with his leather doctor’s bag and personalized stethoscope, and in are the days of the guy or girl dressed in sneakers and scrubs who looks barely old enough to have graduated high school let alone medical school.

Today’s doctor’s office is now a showcase in medical technology. Absent are the bookshelves full of leather-bound medical journals and in their place are a gadgets, gizmos, and computers that all report dutifully to the almighty EMR. The average hospital bed has between 8 and 12 medical devices. The average ER or ICU bed can have upward of 30 connected medical devices per bed.

But the hospital room of today is not just stuffed with medical devices but the room itself is connected and smart. It turns off the lights when the room is empty, it knows when to tell the HVAC that it needs negative air pressure for (infectious patients) or positive air pressure for immune-compromised patients. It also contains CCTV cameras that display at the nearby nurse station to identify when a patient is in need of attention and a whole heap of patient telemetry systems that report all kinds of vitals to those whose job it is to know. Healthcare of the 2020s is now highly technology dependent and full of advanced equipment, and the pace of change is evolving at an almost exponential rate.

Medical technology has transformed our ability to quickly diagnose medical conditions, to treat ailments, often by non-invasive means, and to quickly restore a patient back to a fully functioning member of society. Genomics-based personalized medicine may one day prevent the onset of disease and the breakdown or wearing out of the body’s components, and this may render all of us perfectly fit and mentally healthy well into our nineties and for some, even beyond.

Digital interoperability between discrete medical, public health, insurance, and population health systems is now driving the meaningful exchange of public health information (PHI). So, when you need to see a doctor while on vacation hundreds of miles or kilometers away from your home, that doctor will have access (with your permission) to your complete medical records and be able to prescribe the best possible course of treatment for you.

In Europe a German tourist can visit a Portuguese doctor while on vacation and be able to access their complete medical history. In the United States, we are not quite there yet, but other OECD countries have deployed a fully functional national medical record. In Australia, ‘My Health Record’, even allows the patient, to upload their fitness and other consumer medical data to their electronic patient record (EPR) from consumer devices like an Apple Watch or an iPhone. The technological enablement of healthcare has helped to contain costs and to drive provider efficiency by removing the need for duplicate tests and providing information at each physician’s fingertips. AI-based diagnostics is leading to targeted rather than broad treatments, this in turn leads to improved patient outcomes and reduced morbidity and mortality. However, digital transformation has come at a cost.

The fortress citadel of healthcare payers, providers and life sciences organizations is no longer able to secure healthcare data as it once did. That data is now extensively shared with patients, used for research to help drive better pharmaceuticals, healthcare tools and applications. This has greatly expanded the threat surface and healthcare data now spreads far beyond the walled confines of a doctor’s office or a hospital. Web portals where patients can check their insurance coverage, make appointments with providers, review test results, or chat with a physician are now widespread. So too are mobile health applications and a ubiquitous rise in the use of medical wearable sensors such as a Fitbit or an Apple Watch. These monitor patient activity, pulse and heart rate, and no doubt many other things in versions yet to be released. The medical data on all of us is steadily increasing. So too is the aggregate largely de-identified medical dataset used for training of artificial intelligence (AI).

Indeed, rising use of AI based machine learning (ML) is helping to drive clinical decision support and evidence-based medicine. AI has facilitated much safer low-dose radiological imaging and is driving the development of personalized medicine. But AI requires vast amounts of data for model development and training and so presents risks if not properly secured alongside its obvious benefits.

Healthcare IoT (HIoT) and the rise of the Internet of Medical Things (IoMT)

The same is true for medical devices and other healthcare IoT which are growing each year at a staggering 16% compound growth rate. These are connected to medical networks, communicate directly with critical healthcare IT systems such as the EMR and create, store, or transmit large amounts of PHI.

Without even considering their alarmingly rapid growth, these systems all present a huge cybersecurity risk. This is because most were never designed with security in mind. Nor have most been able to be patched when security vulnerabilities are discovered in their underlying operating code. What’s more, many have an amortized life span measured in decades rather than years as an inexpensive Windows PC might be, so these IoT systems will be with us for many years to come.

HIoT includes an array of typically large diagnosis machines – CT, X-Ray, PET, MRI, ultrasound; treatment systems such as ventilators, infusion pumps, defibrillators, radiotherapy, and chemotherapy devices; and a multitude of systems for patient monitoring and management. They also include a rising use of pharmacy and surgical robotic systems, as well as hospital building management systems for managing HVAC which provides hospitals with negative airflow to contain pandemic disease and clean rooms for surgery. These systems include a wide array of laboratories, CCTV, elevators, door locks, and other building systems critical to hospital workflow and safety.

The trouble is that most HIoT devices were built with very narrow design parameters, so they lack the hardware to run newer operating systems, or the storage to support a patched application if that increases the size of the application footprint. Many manufacturers refuse to spend money on developing or testing patches or security fixes because that cost was never built into their business model. Instead, they tell their customers to purchase a newer more secure device, even though there may be many years left on the amortization schedule of the existing system - a device which probably works perfectly, other than to present security risks to the medical network and safety risks to patients. Hospitals and their clinical engineering and cybersecurity teams are faced with the prospect in such cases of retiring early, perhaps millions of dollars in capital assets, patching these devices outside of vendor warranties, or implementing compensating security controls that will pass audit and allow the continued use of these devices till they can be fully written off. None of these options were until recently easy or appealing to healthcare leaders.

Medical devices are connected to the medical network on one side, and often a patient on the other side. They present one of the greatest patient safety and cybersecurity risks of all innovative new healthcare technology. They also present an open back door to hackers with the skills to compromise these simple devices.

Cybersecurity Risk

As healthcare data continues to become ever more valuable, its theft and sale on the dark web can command high prices. So too is the rising value of cyber-extortion where hospitals and other healthcare providers are held to ransom by mafia-like criminals. A closed hospital is one unable to treat patients in-need, and this has major implications for patient morbidity and mortality as well as to the community served by a ransomed hospital. Consequently, and because of lack of preparedness and under-funding in cybersecurity resiliency, healthcare providers tend to pay ransoms at a rate far higher than other industries and this is fueling the growth of an extortion industry that targets healthcare.

All of these factors - digital transformation, growth of AI, rapid expansion of HIoT / IoMT, and shortsightedness by healthcare executives and their government overseers responsible for fueling ransomware are all leading to declining security as the rapid pace of adoption for new healthcare technology far outpaces the cybersecurity needed to keep patients safe and hospitals secure.

Cybersecurity can be a very effective enabler of new riskier opportunities for patients and their care teams to engage together via technologies. But without a corresponding improvement in cybersecurity, new technologies just add risk to an already highly risky industry.

As we continue to introduce new technology to hospitals, so the digital maturity of health IT is outpacing the cybersecurity maturity of healthcare providers, and this leads to a technical debt, gaps which adversaries are easily willing and able to exploit and monetize. This is the Maturity Paradox.

"Health care has traditionally underinvested in information technology," claims Dr. John Halamka, chief information officer of Beth Israel Deaconess Medical Center in Boston. Halamka, who has been a CIO since the 1990s, says just a decade ago, pretty much all health records were paper. Then, in a period of a few years, hospitals switched to electronic records. But the security of digital health data has not kept up with its growth. Other industries, like financial services and the federal government, have devoted more than 12 percent of their IT budgets to cybersecurity. Health care averages just half that.

Read More

New Cybersecurity Testing Lab Opens in Cheltenham

A new cyber security laboratory has recently opened close to Cylera's UK offices in Cheltenham, and near GCHQ, the UK’s intelligence agency. The 5,200 sq ft lab plans to test IIoT, IoT, OT, ICS, SCADA and embedded devices which now make up a surprising percentage of connected endpoints. These devices are largely regarded by the profession as being inherently insecure and rarely patched against security vulnerabilities by their owners. The greatest problem however is that vulnerabilities are usually unknown by either owners or manufacturers.

The lab’s prime goal is to test vulnerability of vehicles, private jets, and aircraft engines. With this, the laboratory aims on strengthening industrial systems against malicious cyber activities.

This was the subject of my radio interview with BBC Radio Gloucestershire this morning. Listen to the 7 minute discussion below.

Read More

NewsTALK

Today I had the privilege to fly to Dublin, Ireland and come into the studio at 6am for a strong cup of coffee with Joe Lynam, host of newsTalk Breakfast Business and to share a few thoughts on the growing problem of cyber-crime and the security of the Irish Health Services Executive.Its been two years since the Saint-Petersburg-based Wizard Spider / Trickbot attack that crippled the HSE resulting in severe disruption of health services across Ireland and a backlog of elective procedures for many patients.

Listen in to our 6 minute conversation where we discuss the challenges of securing the internet of medical things (IoMT) and the broader healthcare life sciences industry. We also discuss the growing threat surface and who the greatest threats are to security.

Joe Lynam & Richard Staynings

Read More

FDA Implements New Rules

The March 29th FDA rule changes for the acceptance of new medical devices is a long awaited and major step in the right direction towards improving the security of medical devices. Finally, after more than a decade of pressure from cybersecurity leaders and healthcare providers, manufacturers of medical devices are to be held to a much higher standard of security design, manufacture, and support, of the devices they produce and sell, or lease to providers.

This includes the broader sharing of security information including a Software Bill of Materials (SBoM) of the components within each device and the testing and disclosure of any known vulnerabilities. No longer can manufacturers simply produce devices and move onto the next innovation. They now have a legal duty of care to support those devices they produce from now on. This change goes into effect on Oct 1st and sets a new standard of acceptance by the FDA. Devices submitted that do not adequately demonstrate adherence to the new requirements will likely be refused acceptance and will not be cleared for use.

The fact that the rules were published on the last Friday in March on the very last day that Congress stipulated in its Consolidated Appropriations Act of 2023, (signed into law on Dec. 29), shows just what a herculean task these rules must have been for the FDA and the very small team tasked with the security of medical devices. The size of that team looks to be expanded over coming months, but the government is not renowned for moving quickly so these rules were likely framed by the existing small team headed by Dr. Suzanne Swartz in the Office of Strategic Partnerships & Technology Innovation at CDRH. This is a group with a long history of dialog with manufacturers and healthcare cybersecurity leaders, with in-depth knowledge of both medical and cybersecurity concerns.

"I would expect there to be many more changes to the rules published by FDA over the next year or two as requirements are refined and clarified more definitively,” claimed Richard Staynings, Chief Security Strategist with Cylera and Adjunct Professor of Cybersecurity and Health Informatics at the University of Denver, who has been following these changes closely.

“The manufacturing industry has a long history of claiming not to understand many years of voluntary FDA Pre-Market Guidance, and so avoided making changes. I suspect that some will try the same approach now that the rules are mandatory,” suggested Staynings. “This reluctant approach to change, combined with I suspect, some real ambiguities despite the hurried best efforts of the FDA, will manifest itself in minor changes becoming necessary to the rules.”

Indeed, the FDA final guidance recently published, only impacts new devices being submitted for approval. The new rules fail to address those medical devices that are already approved and in use by medical providers. With a lifespan between 8 and 20 years, legacy medical devices will be a feature of hospitals and other providers for many years to come. They number in the millions, and many are considered a security risk in today’s already vulnerable connected digital healthcare networks.

Hospitals have proven time and time again that amortization schedules on medical and IT equipment are not to be overwritten by gaping security vulnerabilities unless severe patient safety risks can be demonstrated. This means that providers will need to continue to employ compensating IoMT security controls and widescale use of micro-segmentation of at-risk medical devices using network access control (NAC) and software defined networking (SDN), capabilities they already own though may not realize they do.

“I would suspect that in 2024, we will see additional FDA rules that provide increased security guidance on legacy devices and introduce new requirements for manufacturers.” Claimed Staynings. “At the very least this will need to include publication of SBoMs for legacy devices and vulnerability disclosures. It ideally should also require manufacturers to test and make security patches available for legacy devices, though mandating this retroactively on already approved devices may be difficult. Furthermore, the legal mandate behind rule changes, may need some level of amendment to the Protecting and Transforming Cyber Health Care (PATCH) Act of 2022.”

The Importance of an SBoM

Despite being a vital step in the security of medical devices, publication of SBoMs is not a panacea, nor are SBoMs foolproof, they merely provide security teams with a better understanding of vulnerabilities when a component in a device is found to be vulnerable elsewhere. Given the widespread re-use of hardware and software components, and software libraries by developers and systems manufacturers today, this will be useful to some providers. Smaller providers, and those with less mature security teams will be unlikely to benefit from published SBoMs since they lack the depth and breadth of capabilities to do much about known vulnerabilities already. Small and ill-equipped hospital security teams are slowly going away however as health systems merge or take advantage of outsourced security specialists. “Knowing that a number of security vulnerabilities exist, and being able to do something about those vulnerabilities are two separate things,” claimed Staynings.

The New Manufacturer Paradigm

Over the next six months manufacturers of ‘cyber’ connected medical devices will need to evaluate the security of the devices they have in development to consider each’s overall security protections, to test each device for security vulnerabilities and to build and maintain improved security documentation including an SBOM and develop improved capabilities to support new requirements around security vulnerabilities disclosure. “This should not be ‘news’ to any of them given the passage of the PATCH act on March 15th 2022, over a year ago, or years of FDA guidance preceding the act. In fact, all manufacturers have seen the writing on the wall for quite some time”, claimed Staynings. “Manufacturers should examine the new FDA rules very closely and seek immediate clarification if they don’t understand fully, so that their devices are not refused acceptance come October.”

A Welcome Reset

“The passage of the new rules is a welcome reset for medical device security,” claimed Staynings during an interview with SCMedia. This has been one of several open backdoors to securing healthcare for quite some time, and with the growth in medical devices hitting 18% per annum in 2022 this is both a growing concern and gaping risk, that is now finally after much effort, being addressed by new FDA rules.

Read More

New FDA Rules Go Into Effect

Yesterday the FDA gave notice that as of Oct 1st it will “refuse to accept” medical devices and related systems unless they meet its new cybersecurity requirements which went into effect March 29th, 2023. These requirements are embodied in new FDA final guidance on its Refuse to Accept (RTA) policy relating to cybersecurity in medical devices, specifically for “Cyber Devices” as defined in the newly-amended FD&C Act (Section 524B).

These powers come out of the Protecting and Transforming Cyber Health Care (PATCH) Act of 2022 and the provisions which were funded under the Consolidated Appropriations Act of 2023 signed into law on Dec. 29. Given the passage of both acts last year, and growing demands for improved medical device cybersecurity going back at least a decade, this should come as no surprise to manufacturers.

Indeed, pre-market FDA security guidance prior to the new law has stipulated increased security requirements, though many manufacturers have not yet implemented this guidance. Under the new powers, improvements in the cybersecurity and ongoing support of medical devices is now mandatory.

This means that if you’re a company building a medical “cyber device”, it is now a requirement that you build your device to be secure by design, develop strategies to monitor and maintain the security of that device post-market and for the life of the device, generate and maintain a software bill of materials, and generate the requisite documentation proving you’ve done so as part of your FDA regulatory submission.

A New Era in Medical Device Security

The days of build, sell, and forget, are now over. While some manufacturers were better than others about cybersecurity and ongoing patch support, others were plainly borderline negligent. The refusal to patch known highly vulnerable medical devices resulted in the FDA issuing its first ever medical device recall in 2017 following the very public disclosure of critical security vulnerabilities from the hacking of a St Jude Medical cardiac defibrillator. St Jude Medical had a long history of refusing to patch its insecure medical devices, and shortly after the disclosure, the company was sold to Abbott Labs reportedly at a big discount.

Submissions to FDA need to include a software bill of materials, which must contain all commercial, open-source, and off-the-shelf software components, while complying with other FDA requirements “to demonstrate reasonable assurance that the device and related systems are cybersecure.” This allows healthcare provider security teams to immediately understand and react to their exposures when CVEs are published for individual software components rather than wait for medical device manufacturers to assess and publish their own vulnerability disclosures.

Device manufacturers will need to submit plans to monitor, identify and address in a "reasonable timeframe" any determined post-market cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosures and plans. “While the language here is vague and not specific, it’s a big improvement over current arbitrary disclosure practices” claimed Timur Ozekcin, CEO of Cylera.

Developers must now design and maintain procedures able to show, with reasonable assurance, “that the device and related systems are cybersecure” and create post-market updates and patches to the device and connected systems that address “on a reasonably justified regular cycle, known vulnerabilities,” according to the guidance.

If discovered out-of-cycle, the manufacturer must also make public “critical vulnerabilities that could cause uncontrolled risks,” as soon as possible. “This appears to be weaker requirements than the originally proposed 30-day patch availability requirement, as is common for other software when critical vulnerabilities are discovered, but it’s a lot better than the current situation,” added Ozekcin.

“These changes mark a much-needed improvement to the security of connected medical devices, but they don’t cover the millions of legacy devices currently in use in our hospitals and clinics. Unless the FDA introduces rules to address these legacy devices then it may take many years before the security of the healthcare industry is significantly impacted,” claimed Richard Staynings, Chief Security Strategist with Cylera. “Medical devices have an expected lifespan of between 8 and 20 years in some cases, so the security of these systems will more than likely be an issue till 2043 and that’s too long,” he added.

While not all connected medical devices will develop security vulnerabilities, many will over the course of their lifetime and amortization schedule. What is needed is a way to better identify medical and other healthcare IoT connected devices, understand their risks and accurately profile devices so that software defined networking (SDN) tools like network access control (NAC) can be used to segment and isolate potentially at-risk systems. AI based tools like Cylera MedCommand now automate this entire process leading to seamless orchestration of security policy across the healthcare network.

For more information on how Cylera solves the problem of cyber-securing legacy medical devices, please contact us to request an overview and demo. 

This story was first posted here

Read More

What Security Professionals Need to Know About Safeguarding Medical Devices and Hospital IoT

 

Medical devices are becoming increasingly interconnected and vulnerable to cyber-attacks. As a security professional, it’s crucial that you understand the risks and how to safeguard these devices. Episode S5E3 of the Brilliance Security Magazine Security Podcast will provide an overview of the medical IoT landscape and critical considerations for protecting these devices.

Listen in as Richard Staynings, Chief Security Strategist at Cyleraand Steve Bowcut, Editor at Brilliance Security Magazine discuss what security professionals need to know about the ever-increasing threats against IoT devices in the medical environment. They cover the vulnerable devices, the information threat actors seek, the types of attacks they launch, and effective mitigation strategies.

Click on the image below to take you to the Brilliance Security Magazine Podcast where you can listen on Spotify or your favorite podcast application or just listen in from the web page directly.

Read More

2023 Predictions

As 2022 draws to a close, what can we learn from a year marked by Russia's invasion of Ukraine, crippling cyber and kinetic attacks against critical infrastructure not just in Ukraine but across the world, and a continued rise in cyber attacks and ransomware globally? A year in which Russia, China and Iran have all become victims of cyber attacks, perhaps reaping the seeds sown by each of them in the past. And a year which saw the costs of cyber-crime move well above its $6 trillion 2021 levels even though the year is not over yet and the full costs counted.

Can and should we extrapolate trends identified over the past year and claim that these trends will continue in their upward path, or is the cyber threat landscape more complicated than we generally assume it to be.

With both Russia and China, the two greatest perpetrators of cyber-crime, increasingly isolated from the rest of the world, and with growing domestic dissent in China, Iran and Russia, are geopolitical moves against autocrats likely to change the world's three most egregious offensive cyber actors?

2022 - A Year in Reflection

In 2022 we saw a massive collapse and re-alignment of organized crime groups following the Russian invasion of Ukraine in February. Prior to the war, these groups consisting of perpetrators located right across the Commonwealth of Independent States (CIS) were united predominantly by their use of the Russian language. During the invasion, Ukrainian and other non-Russian members pulled out of many of these Russian led groups, and some even turned on their former gangs exposing their inner most secrets and the identities of leaders. This break up caused a dip in attacks in March and April and was further hampered by many global ISPs withdrawing from business in Russia. The result was a dramatic reduction in the Internet bandwidth into Russia for many of these groups to use.

Since the onset of war, many of the leaders of these crime gangs, who operate under the eye of the Russian Mafia, who in turn operate with impunity under the oligarchs and ultimately the Kremlin, have quit the profession, scared that Russia will collapse along with Putin’s protective umbrella. Many are worried that they might be identified, caught, and prosecuted. Most have taken their millions in ill-gotten gains and ran, going deep underground. This has left a power vacuum in Russian organized crime syndicates where young, fearless, and ruthless new leaders have taken over. This has led to reckless attacks including the targeting of healthcare providers. A ‘live today die tomorrow’, ‘get rich quick’ mentality now persists as many of those involved are scared of being conscripted by the Russian Army and being sent off to die in Ukraine. Some of these cybercriminals have even acted upon their disdain for the Putin dictatorship, by launching cyberattacks against the Kremlin itself, a very risky proposition indeed.

At the same time, the affiliates of many of these ransomware-as-a-service (RaaS) groups have gone rogue, distancing themselves from Russia and from RaaS providers. With re-alignment complete, the gloves have been taken off and affiliates are hunting freely by themselves and are prepared to take much higher risks than previously allowed. Again, this includes the targeting of healthcare and other national critical infrastructure industries.

Unsurprisingly this has piqued the attention of the FBI, Homeland Security, and other law enforcement groups. Its also one of the main reasons behind the recent FBI warning about one of these groups in particular, Daixin. This group is widely accredited with the September / October ransomware attack against Common Spirit Health, the second largest US healthcare provider. The attack impacted hundreds of provider facilities across most US states, denying timely care to millions of US citizens.

If we thought that the threat landscape was bad in 2021, 2022 has turned into the wild west with rogue gun-slingers on every corner and dead bodies mounting up on every street! For an easy target like healthcare, prospects don’t look good. With its collection of out-of-date weapons, no money to buy new tools, and very small ill-equipped teams, it stands almost no chance defending against an increasingly out-of-control and rabid gang of adversaries.

But the Russian and other CIS gangs aren’t the only things that healthcare needs to be concerned about. Increased offensive activity against providers has been seen coming from both China and Iran. With Iran recently appearing to side with Putinist forces. With threats of further sanctions from Europe and the USA, and rising internal revolt against the theocratic dictatorship that runs the country, Iranian forces are on the offensive. So too is China, and now that Xi has unchecked power over the CCP and the country for life, it is likely that China’s massive PLA cyber army will launch new offensives against western critical infrastructure providers, as China increasingly uses cyber weaponry against its perceived enemies.

Any healthcare CEOs that still have their heads buried in the sand, thinking that a cyberattack is unlikely to impact their hospitals, had better find a deep cave in which to hide, because the noise of collapse in 2023 will be omnipresent.

"We are seeing 2 to 3 ransomware attacks against US healthcare providers each and every day at the moment,” claimed Richard Staynings, Cylera's Chief Security Strategist in a recent interview. “That is not about to go down any time soon, so long as hospital boards and CEOs keep paying the ransoms. Instead of paying the criminals holding them to extortion, they need to invest properly in security and IT which is totally underfunded. This is especially so if you analyze the risks or compare the healthcare industry with other industries such as financial services. It’s somewhat analogous to crime victims paying protection money to the mafia, while refusing the properly fund the police or the FBI" he added.

"I wish that I had a more positive prediction for 2023 but that would be putting lipstick on the pig" claimed Staynings.

Are we doing a better job today of defending against attacks than we were a few years ago? Many cybersecurity leaders would say that we are but that the goal posts have moved. Some health systems have prioritized cybersecurity, but most have a long way to go. And that comes back to governance, leadership, and the prioritization of cybersecurity. Most cybersecurity leaders would agree that it's not where it needs to be right now.

Nor unfortunately is the level of cyber protection being provided by Homeland Security, the FBI and others. Governments are never quick to act but plainly, expecting small critical access facilities to protect themselves against highly sophisticated nation-state actors and organized crime syndicates is ridiculous.

As Staynings puts it, "it’s not even analogous to David and Goliath. It’s more akin to a lone Maasai warrior armed with a spear going up against an entire regiment armed with machine guns. The Maasai warrior stands almost no change at all!"

Read More