Third-Party Risk Assessment

'Healthcare needs a better third-party risk assessment approach'

This was the message I delivered to the HIMSS Global Conference in Las Vegas March 8th through 12th.

Modern Healthcare has become a "whole village” effort. This includes a growing number of third-party vendors, suppliers and partners, each of which provides specific but highly critical functions across healthcare delivery. When one of these third parties is cyber-attacked the repercussions can be alarmingly broad across multiple providers, and at the same time devastating for both patients and providers.

Just look at the impacts that the Synnovis and Change Healthcare attacks have had on patient morbidity and mortality, let alone the financial impact and disruption to providers of healthcare services. The 2024 ransomware attack by a Russian group Qilin, against UK pathology provider Synnovis, a partnership with two of London's largest National Health Service (NHS) Trusts, resulted in the death of at least one patient, a measurable impact on many others, and over 120 cases of low-to-moderate harm, according to NHS data. The financial impact of the UHG Change Healthcare attack by Russian group ALPHV / BlackCat forced the cancellation of procedures following pre-authorization failures and many people to go without their pharmaceutical prescription medications for many weeks - some of which were critical to their survival. The outage which affected a third of US health systems, forced many smaller providers to the edge financially, resulted in the closure of care providers and pharmacies, and had an immeasurable (largely unreported) effect on patient morbidity and mortality.

With such broad and devastating impact, critical third party vendors have become an easy high impact target whether the intention is to create leverage for an ransom extortion payment, or to cause disruption to a critical national industry of an another nation.

This serious and now widely exploited vulnerability raises the question of how healthcare delivery organizations should more effectively assess, manage and plan for risks across their vendors, suppliers and partners? Plainly, expecting healthcare providers to risk-assess thousands of individual partners each year is a pipe dream given limited budgets and security resources. And the number of third parties is often in the thousands.

We therefore need a different approach, one that places the onus to be secure and compliant upon the third parties themselves, especially where those same third parties provide services to hundreds or thousands of different healthcare providers and where security control objectives are often shared or very similar.

Lack of Visibility

Understanding the scope of the risk surface is the first problem. With distributed purchasing authority, especially in academic medical centers, and legacy auto-renewing contracts, discovering just how many devices, applications, or other systems have access to a hospital's medical network is half of the battle.

One recent audit of a provider after a lengthy review of contracts and legal vendor agreements, discovered that the hospital's initial number was off by an order of magnitude. The provider was not only paying each year for services it hadn't used in decades, but the person who agreed to an auto-renewing contract had long since retired and in some cases had passed away. Random vendors it seemed, had legacy remote access to hospital networks to maintain and manage leased systems, and rather than shut down unknown remote access permissions, security had been told to leave these accounts up and running despite the risks, because of uncertainly of cutting off something important.

A Common Risk Assessment

In his presentation, Richard examined the need to better assess healthcare third parties, whether HIPAA Business Associates or simple business partners and suppliers. 

"Right now" he claimed, "we have things backwards with payers and providers expected to assess each of their vendors. This is not only impractical given the numbers, but also prohibitively expensive in time and resources. We need to squarely place the onus on vendors to prove that they meet or exceed payer and provider security policies and standards. Not the other way around."

"We do this by having our vendors bring us proof that they meet OUR security requirements in the form of a SOC 2 Type II attestation from a reputable auditor, or an ISO27001 or HITRUST certification, where the control objectives can be easily mapped to OUR risk and compliance requirements."

"This requires third parties to get onboard with a set of standardized common security controls under a recognized audit framework to validate that common security compliance and risk control objectives have been met and have proven to be repeatable, rather than a one-off point-in-time validation. And repeatability is critical here", he added. "Just look at some of the third party breaches and how they followed a recent point-in-time assessment."

Some vendors will be ISO 27001 certified, others may have shelled out for HITRUST, but neither are cheap. Some of these compliance requirements however, may need to be cross-mapped to a payer or provider's specific risk assessment objectives. For others, an SSAE 18 SOC 2 Type II attestation may be easier and more feasible, while larger third parties like Microsoft or Cisco will readily have both ISO and SOC 2s available for their customers.

Perhaps the biggest argument for a SOC 2 attestation over a certification is who pays. Cybersecurity certification costs usually need to come out of the security budget. A SOC 2 is often completed by the same company that performs the organization's annual financial audit and so is usually billed to accounting rather than security.

Separate Annual Assessments can be Expensive for Vendors

Most healthcare providers share the pool of third party vendors that provide healthcare systems or services for pathology, PACS, EMR, Cardiology, billing, etc. They also share the same pool of business software vendors - Microsoft, CloudStrike, Cisco, Oracle, AWS, GCP, etc. Each year the healthcare sector loads up many of these vendors with the exact same audit questions to assess and validate security risk and compliance. That can be a massive hit upon those that don't have a current SOC 2 ready to send.

While some third parties have made the move to SOC 2s, other have yet to do so. Plainly they need to review their options if maintaining staff sanity is a priority as audits and assessments ramp up.

Assessment Automation

Audits and assessments can be expensive and very time consuming. Thousands of artifacts to assemble and to match with control objectives, they require a complete project management infrastructure to manage properly to meet compliance dates, or for renewal of cyber risk insurance policies. Most of this is still conducted manually today despite better judgement by audit managers who see their workloads steadily increase year over year.

With a growing number and complexity of third, fourth, and fifth party vendors and suppliers to assess each year, auditors face an up hill challenge. Whether assessments are conducted by a dedicated hospital security and compliance team, or a recognized AICPA / BIG4 auditor like PwC, KPMG, Accenture, or Deloitte, incremental changes to manual labor intensive audit processes can never truly move the needle on costs and efficiency. That's why we need better automated audit tools that leverage AI to help drive efficiency, but ones that don't leverage complicated or proprietary frameworks. Its also important that many of the problems of AI based applications such as potential hallucinations are avoided by requiring use of HITL - especially in audit systems used to calculate and evaluate risk.

New Assessment Tools

Fortunately, new tools are beginning to emerge that support:

•  Automated evidence collection which maps to cross-framework controls

•  True contextual data evaluation that understands what submitted data means

•  AI validation that uploaded evidence meets each specific control

•  The full audit sign-off on the same platform that was used for readiness

•  AI enabled report generation – because who has time to write reports?

•  Full project management with task dependencies

•  SOC 2 AICPA standards for both readiness assessments and final audit

This new generation of tools simplifies and streamlines pre-assessment and audit activities. They reduce the amount of time needed for audits and assessments and streamline workflows while reducing cost and complexity. They are undoubtedly the future, but these improvements need to be paired with better visibility into what connects to medical networks and a focus upon third party vendors to provide a SOC 2 attestation of security controls. Only then will the growing morass of third party risks become more manageable for healthcare regulated entities. Only then will some semblance of normality, availability and safety be restored to the patient community reliant upon their health services.

Read More

WHX Dubai

The digital healthcare evolution is leading to more and more highly innovative medical technology that helps to drive efficiency and patient outcomes. Machine Learning has hugely changed clinical decision support, while digital transcription applications are saving physicians hours of pajama time each week in record keeping (and at private hospitals helping them to get paid). AI has revolutionized medical imaging, allowing for lower patient radiation dosages to be used and AI recognition of cellular mass changes vastly improving early identification of cancer and other medical conditions.

BUT this technology also adds to and expands the cyber attack surface. A proliferation of AI based medical applications and a tsunami of medical and other IoT devices is making security almost unmanageable across our hospitals. And that is before you even consider the exponential growth of personal health sensors, interactive devices, and mHealth initiatives or the portalization of physician-patient secure messaging, appointment bookings and the secure posting of lab results. 

In 2026 you no longer need to make an appointment to see your primary care physician (PCP) to have him or her, share your latest test results. In many cases the data is posted long before the physicians office will ever call you to let you know the results, or to book an appointment with your PCP to walk you through them. Simply feed your lab results into Google or a growing host of AI medical assistants, and patients can receive instant medical advice - even if that advice deviates towards the mean, as all AI systems tend to do.

While this is a global healthcare concern, the Gulf is seeing perhaps one of the world's most accelerated and dramatic expansions and modernization of healthcare services with hundreds of new systems and applications connected to medical networks every week, and new hospitals and clinics sprouting up in almost every community. There is a revolution occurring here but neither governments or providers are prepared. 

The pace of technology adoption has outpaced the implementation of security tools and controls needed to protect that new technology from growing cyberattacks and data breaches. Some of this is plainly the result of the frenetic pace of adoption of new innovative tech and inadequate time or resources for security teams to keep up. But an increasing aspect of this "maturity gap" comes down to the out-of-date way in which technology and cybersecurity are perceived by executive healthcare leaders and government ministers. Rather than being seen as an integral part of the solution, an enabler of fantastic new medical services that will revolutionize patient care, they are seen as "a cost of doing business" or an "overhead" - a necessary evil to host these new AI systems and applications, and this is perhaps why the maturity gap exists between our adoption of new technologies and the security needed to safely deploy and use those technologies.

BUT the stakes are getting higher. What used to be the hospital security team defending against cyber attacks by simple criminal perpetrators out to steal and monetize PHI, has transformed into international terrorism and cyber extortion when hospitals are held to ransom - even though ransom payments are explicitly outlawed across an increasing number of countries for any critical national infrastructure (CNI) industry, many of which are owned and operated by national governments themselves. 

The intent of at least some of these attacks however is not to monetize a foothold, but to inflict damage and disruption on a population, or to exact retribution against that country's government for its support for Ukraine and its defense of its land and people. Ransom and other extortionary attacks are increasingly being used as part of Putin's grey or hybrid warfare against other countries. Many of these attacks unfortunately target hospital systems which are a soft target with high population impact. Just last week the conference heard, Polish hospitals and municipal water treatment systems were targeted in new cyber attacks, ostensibly conducted by Russian criminal groups, frequently used as proxies by the Kremlin to inflict maximum damage and disruption. Indeed, Russia's vast array of organized crime groups is allowed to operate with near impunity from prosecution in return for 'favors' to the government and a share of the spoils. The Kremlin is then able to claim 'plausible deniability' for criminal acts that it has ordered against other countries as part of its hybrid warfare campaigns.

While the odds were already stacked against hospital security defenders, the imbalance today is truly disproportionate. Whether highly organized and well funded mafia crime syndicates, or state funded, sponsored, and trained offensive cyber military units within the Russian GRU (Glavnoye Razvedyvatelnoye Upravlenie) - its military intelligence directorate; this is now a David versus Goliath problem. A well equipped army of thousands of professional attackers against a minuscule group of hospital security defenders. 

Hospitals typically have small generalist teams of cybersecurity personnel and often out-of-date technology tools with which to defend patients and health IT systems from attack. In fact medical providers are often forced to use out-of-date and end-of-life IT equipment because of inadequate IT investment and the difficulty of upgrading or replacing health IT systems that are in constant use. This is not just a security problem for providers, but chiefly a technology problem of out-of-date systems and applications many of which are rarely ever patched or updated.

This includes a huge and growing number of medical IoT devices that already make up 75% of connected IP assets across hospital networks. Many of these have a 15 or 20 year amortization schedule and many have underlying embedded operating systems based upon long out of support Microsoft operating systems, with a massive number of known and published exploits. While microsegmentation of these devices helps, many providers currently have little to no idea of what actually connects to hospital networks because of fragmented ownership, inadequate tools and poor visibility. Nor do they have an easy way to microsegment 'at-risk devices'. At the same time, providers are adding medical and other IoT systems to their networks each and every month, compounding existing problems. 

Providers of medical services therefore face a multi-dimensional threat scenario. A sprawling attack surface, out-of-date and end-of-life internal IT & IoT systems, inadequate visibility of their own networks, and highly capable and motivated adversaries that have them out-gunned and out-matched and every corner.

Plainly there is an increased need for national governments to become more actively involved in the cyber defense of CNIs, and especially healthcare providers, where attacks result in increased patient morbidity and mortality. Only governments have the resources and legal mandates to take on today's cyber perpetrators, and to do what it takes to defend their citizens from increasingly crippling hybrid warfare attacks from failing states. As of yet however, governments have by and large, chosen to play a low-key role in the direct defense of their CNIs for fear of escalation. As the number of citizens killed in hybrid cyber attacks slowly increases, so that approach will be likely be questioned.

These were just some of the topics of discussion at this years WHX Dubai conference where healthcare leaders from across the world gathered to put forward suggestions and recommendations for improving patient care, safety and outcomes through smart security.

Joining me on stage at this prestigious event were Professor Attila Hertelendy, Ph.D., Mike Fell,  Charles Aunger and Zekeriya Eskiocak to share their vast knowledge and experience.

Read More

Beware of Holiday Scams: How to spot Fake Links and avoid Phishing Attacks

‘Tiz the season to be jolly’ and between pre-holiday shopping and all the amazing deals that will be posted online for Boxing Day – (that’s December 26th for American shoppers), many of us will be avoiding the snow and shopping from the comfort of our homes, or between meetings from the company laptop as things wind down for the holidays.

But it’s important to remember that the season is not just about putting lights on the tree and stocking up on all kinds of drinks for expected, (and unexpected), guests, nor is it about wearing ugly Christmas sweaters and drinking mulled wine, cider, and hot toddies, it’s also ‘the season to be wary’. Wary about online shopping scams and last-minute deals that look too good to be true – because they very well maybe – untrue that is!

Our guards are down as we relax a little and look forward to meeting friends, attending a few parties, and enjoying some well-deserved downtime. The trouble is, that scammers know this too and each year they make a bonanza out of unaware, perhaps slightly tipsy, online shoppers looking for presents. Last year during the 2024 holiday season, the FBI’s Internet Crime Complaint Center received thousands of complaints about phishing and spoofing scams which drained more than $70 million from victims. And each year the number of victims increases.

It's not just the charges on your credit card or the packages that never show up, its identity theft and a heap of other dangers including malware and even ransomware, getting on your computer - and by extension the company network if you shop from the office.

Type Squatting and Homograph Attacks

While shopping online, scams are getting harder and harder to detect. Even a careful examination of the URL can be misleading as numbers and even Cyrillic characters are substituted for letters. While goog1e.com upon careful examination will reveal a number ‘1’ substituted for the letter ‘l’, most people in a hurry might not notice. This is known as typo squatting and is surprisingly common where fake URLs closely mimic real ones, such as using “PayPa1” instead of “PayPal.”

Sadly, most people don’t even check the full URL of their online shopping cart which may have been hijacked before entering their credit card number and completing a transaction. Using a phone or tablet, and chances are that the full URL might not even be displayed. While Google has the money and foresight to purchase all domains that could appear close to its domain names, other online stores might not have the warewithal or the resources to do so, especially when different Unicode character sets are used. Criminal perpetrators know this and are increasingly exploiting this.

These attacks are known as known as IDN Homograph Attacks, and trick users by substituting Latin letters with visually identical Cyrillic ones (like 'a' for 'ɑ', 'o' for 'о') to create fake sites (e.g., www.google.com vs. www.googlе.com where the 'e' is Cyrillic 'е') that steal credentials; examples include using Cyrillic 'a' (а), 'o' (о), 'T' (Т), 'P' (Р) to mimic real domains for phishing shoppers. Apple: www.apple.com can be spoofed as www.аpple.com (Cyrillic 'а'). Microsoft: www.microsoft.com can become www.microsоft.com (Cyrillic 'о') and the list goes on and on.

To avoid these attacks its best to type the URL directly into a browser, or use a well-established and trusted bookmark rather than a link from another web site. It’s also good to avoid URL shorteners when shopping or banking, and to hover over embedded URL links before clicking as the link might not be what it appears to be.

Social media and many web sites today are powered by syndicated ads where the main site may have very little control over the legitimacy of those rotating ads. Look for red flags such as an “@” symbol within the URL or two web addresses combined using a question mark, especially if the first part looks like a trusted site such as Google.com or Apple.com.

Avoid unknown but familiar sounding domains. While https://www.ebay.com/mye/myebay/watchlist is legitimate https://www.ebay.mywatchlist.xy is probably not legitimate. And watch out for social media messages that ‘appear’ to be from friends who you have not chatted with before. Never trust always validate. Send a message to the sender asking a question that only your real friend will know the answer to or call them and ask did you send me a message via facebook, whatsapp, or whatever. Scammers often hijack or impersonate social media accounts belonging to people you know so this is a common attack vector. If a message from a relative or friend suddenly sounds aggressive, sales-driven or out of character, especially if it includes a link, verify by contacting them directly before clicking.

What to do if you already clicked a scam link?

If you’ve clicked on a suspicious link, the outcome depends on your device’s security protections. Firewalls or antivirus software may block the threat automatically. Without protection, however, action may be needed.

Make sure that your endpoint protection is up to date and watch for signs of malware like unusually slow performance. Reboot and test if you are concerned. Phones are not immune. If infected, avoid using financial apps, clear your browser cache, delete unfamiliar apps or perform a factory reset. Contact your device’s tech support if needed.

Once you have validated that your device is running fine, check your bank and credit card accounts. This is super important this time of year especially. If you see a transaction you don’t recognize, immediately ask family members who may have access to your cards. Check the transaction date, as purchases may take a day or two to post and merchants may not have a credit card ‘merchant name’ that reflects their ‘doing business as’ name. It’s not uncommon for a major brand like a hotel chain to post your room charges under a merchant name you don’t recognize as many hotel properties are franchises as an example. Dates and amounts usually help to sort this out so check against your calendar. If you are still at a loss, then contact the institution if the charge remains unidentified and ask for clarification or to report a fraudulent charge. The card company will invalidate your card and send you a new one in 5 business days usually or less if you ask.

Report the scam: If you lost money, report the incident to the Federal Trade Commission and your local police department. Reporting helps authorities warn others and reduce future victims. The FTC can also help you if your credit card or bank can’t, or won’t, process a credit to your account for a fraudulent transaction. You usually have a maximum of 60 days to report a fraudulent transaction after which you will need the FTC’s help to reverse a charge so don’t leave unknown charges to languish. Staying alert and informed is your best defense against holiday scams and the best way to keep the season joyful and secure. So be vigilant and check your transactions regularly.

Read More

Cyber Resilience for Global Health Systems

I recently returned from the Global Cybersecurity Forum Annual Meeting 2025, perhaps the most prestigious of cybersecurity conferences. This is an event populated by former and current Presidents, Prime Ministers, Sheiks, Sultans, Emirs, Princes, and delegates from the European Commission, United Nations, World Economic Forum, and countless other global bodies. And of course, it has all the pomp and grandeur one expects from a high-level event in the Kingdom of Saudi Arabia.

This year’s focus was upon “Scaling Cohesive Advancement in Cyberspace” across the world. It was built upon the pillars of fostering better alignment, redefining cyber economics and economic cohesion, strengthening cyber inclusion, adopting a behavioral lens on cyberspace, and harnessing technological advancements to tackle fast-evolving challenges in Cyberspace.

The invite-only two day event drew delegates from all over the world to hear more than one hundred experts and thought leaders present to attendees and engage in meaningful discussions. This was my second year attending the event as a presenter, and this year led a discussion panel with fellow healthcare security and AI evangelist, Professor Attila Hertelendy from FIU on “Cyber Immunity: Strengthening Cyber Resilience for Global Health Systems.”

Much of the conference was focused upon the protection of critical national infrastructure industries like healthcare, an industry undergoing a dramatic digital transformation throughout the world and across much of the Gulf region, but especially so in the developing world. These healthcare technology-adopting nations need to embrace the lessons learned and avoid the mistakes made by Europe and America. An uptick in attacks against critical infrastructure is on the rise globally with a hugely disproportionate impact on populations when hospitals and other healthcare delivery facilities are targeted.

When the power or water grid are attacked we can revert to flashlights, candles, and bottled drinking water until services are restored. When healthcare is attacked and hospital systems go dark, patients immediately begin to suffer, with modern diagnosis, treatment, patient monitoring and management systems unable to be used. The longer these systems remain dark, the greater the probability that patients will die or be harmed by delayed or inadequate treatment. Ransomware attacks are especially heinous and lead directly to patient morbidity and mortality as we have seen in an increasing number of recent cyber attacks.

More in my early morning interview with the Saudi Press Agency below:

Read More

Online Gambling

Amidst the rapid digital transformation sweeping Indonesia, a new threat is emerging: online gambling. This phenomenon is not just an online game, but part of a global criminal network with billions of rupiah in daily turnover.

English Translation of Live Broadcast Transcription Merdeka.com 03 Oct 2025. Ilustrasi penerima Bansos (Istimewa) (©© 2025 Liputan6.com).

Online Gambling: A Global Criminal Business Amidst Indonesia's Digital Transformation

Many online gambling cases in Indonesia target vulnerable low- and middle-income groups.

Merdeka.com 03 Oct 2025

At the Global Cybersecurity Forum 2025, held on October 1-2 in Riyadh, Saudi Arabia, Richard Staynings, Professor of Cybersecurity – ITC & Healthcare Informatics at the University of Denver, explained that online gambling has long been a favorite tool for cybercriminal groups.

"The internet completely disregards national boundaries, and that's allowed online gambling to flourish. It's used not only for gaming but also for money laundering from various criminal activities," he told merdeka.com.

In Indonesia, online gambling platforms often target low- to middle-income individuals. Offers of initial bonuses, illusory wins, and the lure of "getting rich quick" are enticing entry points. However, behind the scenes, the mechanisms are designed to ensure players' money is never returned.

"They deliberately target the gullibility of people with limited knowledge of cyber risks. Players are lured in with free gambling credits and given the impression they've won, then directed to deposit their own money to increase their winnings. Ultimately, the funds are withheld and never paid out," Staynings explained.

This pattern isn't unique to Indonesia. He believes global syndicates deliberately target the most vulnerable groups. This phenomenon reveals a new facet of cybercrime: it's not just about technology, but also about manipulating social psychology.

Richard Staynings merdeka.com

Regulatory and Educational Challenges

Indonesia is currently at a crossroads. On the one hand, digitalization is driving the economy. However, on the other hand, expanding internet access is opening up opportunities for transnational criminals.

“The rapid growth of Indonesia's digital population must be balanced with higher cyber awareness. The government's job is to ensure the public understands the risks and how to protect themselves,” said Staynings.

He cited the example of several countries in Asia that have successfully suppressed online gambling through massive education campaigns. Digital literacy has proven more effective than simply blocking sites as new ones spring up the next day and it quickly becomes a game of whack-a-mole.

“We need to educate the public about the dangers of online crime. Gambling is just one facet of a broader cyber threat,” he added.

Ransomware and Mobile Apps: The Next Threat

Besides online gambling, another increasingly prominent threat is ransomware targeting mobile apps. With Indonesia's population increasingly reliant on smartphones, these attacks pose a significant challenge.

"Small phone screens make users more easily distracted. They respond to instant messages without thinking, and that's what cybercriminals exploit," Staynings explained.

Even more worrying, around 98% of Android apps on the Play Store were recently detected as having security vulnerabilities. He believes the responsibility lies with both platform providers and app developers to ensure user security and privacy.

The Coordinating Ministry for Political, Legal, and Security Affairs is seriously strengthening digital literacy to prevent online gambling in the Riau Islands, given that thousands of residents are suspected of being involved. Learn about the government's efforts to address this serious threat! Merdeka.com

The Long Road Ahead

Fighting online gambling and other cyber crimes is not an overnight task. It requires synergy between regulation, technology, and society.

For Indonesia, which is pursuing digital transformation, this challenge demands a holistic approach: public education, strong regulations, and collaboration between the government and the private sector. As Staynings emphasized, "Cybersecurity is not just about technology, but also about public awareness and preparedness."

Indonesia, with more than 220 million internet users, is one of the largest markets and a fertile breeding ground for global criminal syndicates.

"This is not just a national legal issue, but a global issue. Indonesia has a huge opportunity to strengthen its cyber resilience, provided it can learn from other countries that have already faced this problem," Staynings concluded.

Digital transformation opens many doors of opportunity, but also pitfalls. Without adequate awareness and protection, the public will become victims in a larger game orchestrated by cross-border cybercriminals.

[Ends]

Original Story published in Bahasa at https://www.merdeka.com/dunia/judi-online-bisnis-kriminal-global-di-tengah-transformasi-digital-indonesia-476391-mvk.html 

Copyright © 2025 merdeka.com KLY KapanLagi Youniverse All Rights Reserved.

Read More

Can American Cybersecurity Technology Still Be Trusted?

The radical political transformation of the United States over the past few months has not gone unnoticed by the tech and cybersecurity sector – internally within the country or externally by that sector’s customers. While many see some of these changes as innocuous and hope that any storms will blow over, others see these changes as a fundamental shift with far more nefarious implications.

The decimation of scientific research agencies, the Cybersecurity Infrastructure Security Agency (CISA), the attempted firing of thousands of federal government employees across nearly every agency and department are one thing. The removal of impartial senior military and intelligence commanders who cannot be relied upon to be unquestionably loyal to the new commander-in-chief, is another thing entirely. Loyalty is everything to Donald Trump, and like any mafia boss, when absolute loyalty is not demonstrated it is to be punished publicly. “Kill the chicken to scare the monkey” as the Chinese idiom states.

Just look at Chris Krebbs, Director of the Cybersecurity and Infrastructure Security Agency in the Department of Homeland Security, who led CISA through the 2020 election and refused to support the MAGA lie that the election had been stolen when their cult leader lost. He was not only fired in the last days of Trump’s first presidency, but he and his next employer SentinelOne were very recently, openly and publicly persecuted - a full 4 years later by Trump in his second term. For Trump this was personal payback and in his narcissistic mind, totally justified for the lack of kowtowing to the wannbe king. 

    

Look at John Bolton, former US Ambassador to the United Nations under George W Bush, and US National Security Advisor in Trump's first term. Bolton has since become an outspoken critic of Trump’s mental decline and his errant foreign policy and has been a frequent guest on both right and left wing TV shows. His family house raided in the middle of the night by the FBI, an agency now controlled by Trump sycophant Kash Petal. The raid was plainly designed to send a message to anyone else who may dare to question the ‘Dear Leader’ in the White House. This is not just domestic politics and a retribution presidency, it’s a seismic shift in the America that everyone trusts, and the world is watching.

The fact is that the unshakable confidence in America that has persisted since World War II has been broken, and that break in confidence extends to American industry and its thriving technology sector. But for how much longer? This to anyone who works in the technology and cybersecurity sector should be very concerning.

So let me explain my concerns.

I have just spent the last ten days visiting security and technology leaders in Asia. I have worked internationally for nearly two decades with big American technology brands including Cisco, CSC, and now for Cylera. I visit Asia several times a year to present at various cybersecurity conferences, to visit customers, or just for a beach vacation in the depths of winter back home. This time however was different. Those that travel internationally will recognize that the reception of Americans outside of the country can be very different to the way other nationalities are welcomed. Fly to Europe or further afield and the comments about American politics and leaders can be quite surprising and sometimes openly hostile. Often this hostility is accompanied by derisory comments about the intelligence of the American electorate and the arrogance of its elected representatives. Foreigners will also quite vociferously question American foreign policy including the Gulf Wars, Afghanistan, Kosovo, and Bosnia, which all stir up a hot discussion even amongst American allies. But that’s not all I discovered during this visit.

I was out for drinks one evening with a number of CIOs and CISOs and the question arose can American technology be trusted? A CIO was considering whether to simply replace and upgrade his American wireless and cellular repeater technology or to consider a replacement strategy based upon cheaper Chinese technology. Putting aside historical issues of stolen American router source code and other “illegally acquired” technology IP, the Chinese tech today is highly innovative, feature rich, and often half the price he argued. And he was right. It’s cheaper and often better but at what price when it comes to security?

The table erupted as other security and technology leaders expressed their concerns about well-publicized and prolific state-sponsored hacking and especially about the various Chinese Typhoon attacks against telco systems. This includes concerns about backdoors and other vulnerabilities in Chinese manufactured technology systems and the fact that China cannot be trusted especially with anything that touches critical infrastructure of any kind. This coming from a mixed group of Asian and European leaders all living and working in Asia today, and all responsible for protecting their employers from an increasing tsunami of cyberattacks.

    

Not to be trusted

China certainly has a long history of spying on its own people and spends nearly twice as much on internal security as it does on external security. It has the world’s most intensive surveillance network of CCTV cameras in every city, town, and village street. It has pioneered the use of AI facial recognition software to identify and track each of its nearly 1.4 billion residents. The Ministry of State Security (MSS) has listening posts across cities and in public spaces, intercepts conversations, phone calls, and decrypts secure IP-based communications while restricting access to the Internet via the legendary Great Chinese Firewall that blocks news coming into China and prevents Chinese citizens from communicating outside. The PRC has become the Big Brother state envisioned in George Orwell's novel "1984", which of course is banned in China. Only North Korea could aspire to greater levels of surveillance. I say 'aspire', because in the DPRK, the supply of electricity is intermittent at best outside of Pyongyang and surveillance technology requires power. 

The ruling 100.27 million strong Chinese Communist Party, (CCP), has for many years been accused of suffering from a well founded paranoia that China’s 1.4 billion citizens will rise up in a counter-revolution against the corruption of the country’s communist ruling elite. Perhaps that’s a real risk as rising living standards can no longer be assured to buy-off the population, but this concern builds upon fears from the comparatively minor 1989 Tiananmen Square student protests requesting more freedoms from the party, a protest that saw party hardliners send in the tanks against their own citizens for daring to challenge the party. A popular uprising against the party elite is undoubtedly one of Xi’s greatest concerns today. Rising disparities of income, declining job opportunities especially among China's millions of annual graduates, and a growing recognition that the 'social contract' that has allowed the CCP to remain in power has expired. 

While some of the security failings of Chinese tech can simply be attributed to sloppy coding and poor quality-assurance, a problem that China has faced for decades across every industry, the fact is that few trust the technology or the ability of those running those companies to manufacture quality product free from interference by Chinese state or military agencies. Xi Jin Ping has made it law across China for every company and citizen to work for the communist state’s interests. And few would risk all, to refuse a “request” by the Ministry of State Security to work on their behalf at any given time. That’s likely how China was able to insert hidden substrates into top-end Taiwanese SuperMicro motherboards being fabricated in Chinese factories. Motherboards that were later found to be calling home to China from the US Congress, from Google and Apple data centers, and other sensitive locations.

But America spies on other countries too and has infiltrated sensitive networks all over the world. WekiLeaks published documents appearing to reveal NSA phone intercepts on French Presidents Jacques Chirac, Nicolas Sarkozy, and François Hollande from 2006 to 2012. The NSA also reportedly hacked the Iraqi military command and control network long before the second Gulf War and had been listening in on Iraqi communications for years. When the action started, it was able to effectively shut down Iraqi military and other communications making the alliance military’s job that much easier. Iran’s uranium enrichment plant at Natanz was partially destroyed by the Stuxnet virus in a cyber-physical attack thought to have been developed by the NSA and delivered by Mossad. A virus that enabled the US and Israel to slow down Iraq’s quest to develop nuclear weapons, weapons that would likely be used against Iran’s enemies including Israel and perhaps even the USA.

Can the US be trusted by its allies and non-aligned countries?

The Trump Administration has threatened the future of NATO, Five Eyes, and the overall western alliance. It has imposed debilitating tariffs against its principle trading partners which is isolating the United States and threatening globalization. US attempts to annex Greenland and Panama and absorb Canada against its will as the fifty-first state, have all shattered whatever trust that the US held with the rest of the world. The recent discovery of US agents trying to stir up a Greenland insurgency against rule from Copenhagen have hugely angered European allies. As has America’s apparent switching of sides against NATO and the EU to align with Putinist Russia over a Ukrainian land annexation in return for a succession of hostilities. A ploy most likely rooted in lucrative mineral contracts for the Trump family crime syndicate. It has also sent a very strong and alarming message to the rest of the world that America can no longer be relied upon even for the alliances it leads.

The recent raid of a multi-million dollar Hyundai battery plant under construction in the US state of Georgia by masked and armed ICE agents and the arrest, chaining in shackles, and temporary disappearance of 475 mostly Korean advisors has sent a very powerful message worldwide that the US is no longer to be trusted, nor is it safe to visit or work in. 

The arrest and deportation of European tourists arriving in the USA for minor ESTA infractions have caused Canada, the UK, and several European nations, to issue travel advisories for their citizens due to concerns about new immigration policies, and potential arbitrary detentions. The result is a significant decline in visitors, an empty DisneyWorld this summer, and lots of availability on US international flights and many hotels.

Does that political distrust extend to American technology?

The short answer is yes. American technology companies – Google, Apple, Microsoft, Oracle, Amazon, and others are all 'tarred by the same brush' along with thousands of other US-based highly innovative tech companies. Nor have they done a good job of distancing themselves from the chaos of the White House. Quite the contrary in fact, as the leaders of many of these companies have openly become Trump sycophants. The recent Oligarch’s Dinner at the White House where each tech billionaire leader took turns to sickeningly pay homage on camera to the ‘Dear Leader’ is proof enough. This removed any plausible distancing between American Big Tech and Trumpism. But paying homage to Trump can have a huge cost, as Elon Musk discovered when Tesla sales plummeted world wide, damage that appears to be permanent. 

When trust in America vanishes, so does trust in its technology companies and its technology products and services. For cybersecurity companies, that eradication of trust could be devastating just as Kaspersky found itself in near ruin thanks to its Russian ties.

The big question is what can the American technology sector do to distance itself from the chaos going on in Washington DC and can its reputation be saved before it’s too late, or does the whole sector go the way that Tesla went?

Read More

Stalled spending on healthcare cybersecurity has impact

A recent report by research application security company Indusface, gave the US healthcare industry its worst privacy and security report yet. Over the past 24 months the report detailed a staggering 1,200 security and privacy breaches of which 83% of incidents exposed patient health information (PHI). This marks a new milestone for the industry and once again raises alarm bells about the lack of investment in healthcare IT or the prioritization of cybersecurity to offset rising attacks and escalating concerns related to patient safety.

Texas topped the charts with 66 data breaches exposing the data of over 14 million Texans with 4 millions of these attributed to a single breach at Concentra Health Services in January 2024. California came in second with over 9 million patient records exposed with approximately half attributed to Blue Shield of California’s sharing of patient data with Google Pixel used for advertising.

“The healthcare sector is vulnerable to these breaches due to both the vast amount of sensitive patient data, which is often sold to third parties for a high price, and weak or outdated software and systems,” said Venky Sundar, founder and president of Indusface. 

Many of these alarming trends were backed by data in the recently published 2025 Verizon DBIR. The report confirmed that exploits have now overtaken phishing as a leading cause of data breaches. Not only is the healthcare industry running on old, often out-of-date and end-of-life, highly vulnerable software, but the application of patches, even when these are available, is slower than just about any other industry. The report listed an average lag time of over 200 days between the announcement of vulnerabilities, and the patching of vulnerable systems. Unlike other industries however, many of these critical systems are responsible for keeping patients alive or maintaining the confidentiality, integrity, and availability (CIA) of their personal health and identity data.

“If we compare healthcare to other industries, we can see a big difference in the investment in and prioritization of cybersecurity,” claimed Richard Staynings, Chief Security Strategist with New York based healthcare cyber security company Cylera. “The financial services industry reinvests a good chunk of its operating profits in modern IT and well-equipped cybersecurity teams and tools. Healthcare, because much of the industry is setup to be ‘not for profit’, tends to downplay both its operating margins, and the percentage of operating profits allocated to cyber security. Putting aside the massive difference in the size of profits between industries, or the way operating margins are calculated, healthcare providers currently spend less than one tenth of what financial services spends - even though lives are at stake in hospitals, clinics, and other care facilities. Healthcare payers on the other hand have much bigger revenues with profits in the tens of billions of dollars annually, yet have still suffered some massive cyber attacks.

The difference may be attributable to how boards and senior executives perceive and quantify both enterprise risk and cybersecurity return on investment (ROI) in one industry compared to the other. Risk is calculated by multiplying probability of loss by potential impact of loss. When this risk involves money, any high risk identified by a bank of potentially losing a million dollars in assets, or not being able to conduct business with customers for several hours (resulting in billions of dollars of lost revenue), will create a very compelling ROI for cybersecurity spend to quickly remediate that risk. In this case, the costs of 'action' are often tiny compared to the possible or probable costs of 'inaction'.”

Healthcare doesn’t qualify risk in the same way. Risks are usually perceived in different terms as clinical or operational risk. What is the risk of a 90-year-old patient undergoing anesthesia for a procedure? What is the probability of a negative outcome of a particular patient undergoing surgery compared to not being given that surgery? Business risks like operating profit typically come second, while cybersecurity risks often don’t even make it to the board room agenda for discussion.

Of course, some operational risks are becoming increasingly important as evidenced by many health systems declaring bankruptcy or going out of business entirely following a cyber attack. The recent UHG Change Healthcare attack exposed the PHI of over 190 Americans. It more alarmingly, also caused a national outage which resulted in thousands of providers unable to bill for millions of services for weeks on end, or to receive pre-authorization for scheduled procedures or pharmaceutical medications. This caused major cash-flow problems resulting in expensive emergency bank loans to cover staff and other overheads while delaying hundreds of money-earning procedures as surgical staff sat idle for weeks or had to be furloughed.

Operational risks are not just limited to outages of critical third parties but often to core hospital systems when a denial-of-service (DOS) attack or a ransomware attack is launched against a payer or provider. Both attacks are considered ‘availability attacks’ as they essentially render critical systems unavailable for use, stopping most business activity in its tracks. DOS attacks don’t generally last long, usually a few hours or a day or so before the attacker’s systems are blocked, and traffic is restored. However, a ransomware attack will encrypt vital systems and data, shutting these down until a ransom payment is made, or the victim is able to rebuild and restore critical data and systems. The result is often a partial or full hospital outage for many weeks or sometimes several months.

Any outage will have an impact on financial operations, but this may also result in clinical or safety risk to patients by negatively impacting patient morbidity and mortality, and therefore legal liability of providers. But so too, will any cyberattack against patient data unless forensic investigation can irrefutably prove that regulated data was not touched or accessed by hackers. The HIPAA regulation terms this as a ‘data breach’, while security professionals would define this as an attack against the ‘confidentiality’ of protected data. Thus, regulatory risk, clinical risk, and liability risk are far more significant across healthcare when attacked. Despite this, investment in healthcare cybersecurity significantly lags behind other industries like financial services, even though lives maybe at stake.

Until such times that the industry gives greater priority to protecting the information systems that power modern digital healthcare, the sector will continue to be recognized as an easy target to attack by criminals. While growing regulatory fines, restitution, and punitive damages awarded by class action lawsuits are slowly changing the equation between ‘the costs of action versus inaction’, much of the US healthcare delivery industry stands on the edge of bankruptcy, despite the huge sums spent on health insurance each year. With basic concerns of survivability, healthcare cybersecurity will more than likely continue to be underfunded until meaningful structural healthcare reform is enacted. 

These risks exist before the Trump Administration's plans to decimate public healthcare funding under Medicaid and Medicare by removing 18 million patients from eligibility. These changes will disproportionately impact rural healthcare providers, whose patient populations heavily rely upon publicly funded healthcare programs. Even though 20% of rural patient populations typically have employer based private health insurance, this will not be enough to keep rural hospitals open, especially on top of UHG Change Healthcare losses. This could result in some rural populations being isolated from critical health services and potentially becoming 4 or 5 hours drive from the nearest trauma or stroke center. A journey many patients will be unlikely to survive. 

The impacts of policy changes and unmitigated cybersecurity risks will therefore lead to significant changes in patient morbidity and mortality.

In the absence of countries legislating to outright ban the payment of ransoms and other forms of extortion payments to cyber terrorists, it’s likely that ransomware will continue to plague the health sector given the criticality of this critical national industry. It’s therefore probable, that healthcare cyber attacks will continue to grow in both size and scope for the foreseeable future and as a result, that access to critical healthcare services can no longer be guaranteed.

Read More

What is Cyber Espionage and why is it so concerning?

It's often said that there are two types of healthcare organizations, those that know they have been hacked and those that are still ignorant of the fact. In other words, just about everyone has already been hacked at least once by now. And that includes healthcare payers, providers, bio-pharma and the proliferation of healthcare vendors and suppliers.

But while cyberattacks against availability of IT systems and data - principally Denial of Service (DOS) and Ransomware cyber extortion attacks seem to make the headlines almost every week, there are other stealthier attacks taking place in the background - almost constantly in fact. This involves the exfiltration of non-public data. Sometimes this is used for extortion in secondary and tertiary ransomware demands. This is often via a threat to release confidential non-public data unless an additional ransom is payed to the criminal perpetrators.

Other times, it is for the sale and monetization of data - patient identities, their prescriptions which can be filled and sold on the street, or other PHI or PII data - employee banking information for example. And sometimes perpetrators deliberately search for high value intellectual property data. This last category is usually referred to as 'cyber espionage', and only occasionally makes the front page of the press, usually then only when some government official makes a stink about the sheer levels of cyber espionage and intellectual property theft taking place.

The Art of Espionage

'Espionage' according to the Oxford Dictionary is the practice of spying or of using spies, typically by governments to obtain political and military information.

So 'cyber espionage' is chiefly about obtaining political and military information, not by the use of spies like 007 James Bond, but by means of cyber attacks and infiltration of non-public information systems.

The advent of the internet and the connectivity of government and health systems to the internet has made cyber espionage that much easier. You no longer need someone on-site or in-country - an insider threat,  spy or double agent to obtain valuable information. KGB spies like Rudolf Abel, Kim Philby, Oleg Gordievsky, Aldrich Ames, and Anna Chapman for example are a thing of the past in this age of hyper connectivity.

Today all governments spy on one another - even between friends and allies. The US NSA was accused of hacking and listening into the French President’s cell phone some years ago according to Wikileaks, and at that time at least, before the tariff war, France and the USA were friends and allies.

The USA spies on Iran to ascertain the level of uranium enrichment it has achieved since Trump in his first term pulled out of the Iran Nuclear Deal thinking he could negotiate a better deal and failed. The USA also spies on China, North Korea and Russia about each of these nation's military capabilities and a wide variety of other useful data points.

The Art of Cyber Espionage and IP Theft

But countries also occasionally spy on other forms of data. Enter the Peoples Republic of China and the huge revelation exposed by the Mandiant APT1 Report in 2013. If you have not yet read this, or a summary of this report, you really should do. It changed the game and our understanding of cyber espionage against commercial businesses.

APT1 is otherwise known as PLA Unit 61398 (61398部队) a military unit of the Chinese Communist Party, Peoples Liberation Army. These aren’t criminal hackers they are employees of the Chinese Communist State. They are paid to hack, but not just government or military secrets - in this case intellectual property and commercial trade secrets from businesses in other countries.

China is famous for its Great Leap Forward, Mao’s attempt between 1959 to 1961 to take China from a feudal agrarian society to an industrial powerhouse. It failed and resulted in the death of 45 million people. Most of these starved to death, under Mao’s ill-conceived and badly run collective agriculture and industry policy. That’s more than double the total number of soldiers that died during WWII across all theaters to provide some perspective just how big a human calamity this was.

After decades of isolation from the rest of the world, China has since the 1990s, once again been attempting another Great Leap Forward through rapid modernization and industrialization becoming the factory of the world for consumer goods. This time around however, China largely succeeded and has taken millions of its people out of abject poverty, through industrialization, urbanization and education.

Ownership of the Means of Production

But in China the 'means of production' is owned almost entirely by the state. CCP state owned industries dominate and even hold a majority share in joint ventures with global firms which are only allowed to own a 49% stake.

The ruling CCP also puts together 5 year plans. These ambitious documents usually discuss how China will be the global leader in EVs, or the largest manufacturer of pharmaceutical drugs, or the global leader in aeronautical engineering, etc.

But to reach these lofty goals, to make up for the lost years of communist isolationism and stagnation under Mao, and a lack of history, knowledge, and experience, China has had to obtain technologies, manufacturing capabilities, and a heap of other proprietary commercial trade secrets from industry leaders outside of the PRC - usually by what ever means at its disposal. Mostly this means through 'cyber espionage' and is supplemented by process and procedure skills brought back from Chinese diaspora working overseas.

According to a 2022 report by Cybereason one China state actor alone, APT41, has siphoned off trillions of US dollars in intellectual property theft from approximately 30 multinational companies within the manufacturing, energy and pharmaceutical sectors. The Cybereason investigation entitled 'Operation CuckooBees' was shared with the FBI, and discovered APT41 actively engaged in 'stealing the IP of drugs around diabetes, obesity, depression.' Cyber-criminals were focused on obtaining blueprints for cutting-edge technologies, the majority of which were not yet patented, the report stated.

Chinese IP theft has included the theft of pharmaceutical drug formations, clinical trail methodologies and practices, manufacturing IP and much, much else. It has short-cut 50 plus years of IP development by global pharmaceutical companies, sometime including experimental drugs developed at over a decade or more at the costs of hundreds of millions of dollars, pounds and euros in R&D. China has even patented some these stolen experimental drugs and attempted to sell them back to the global markets that invented them and financed their research.

Levels of Cyber Espionage and IP Theft

Between 2018 and 2019, Bayer and Roche were both targeted by nation-state APT cyber attacks, aimed at industrial espionage, and attempting to steal valuable intellectual property. Both companies claimed to have contained the breaches without significant data or intellectual property loss, but other biotech and pharmaceutical organizations have fared less well.

During COVID-19, both China, and to a lesser extent Russia, Iran, and the DPRK, were discovered to be attacking US, UK, German and other hospitals and bio-labs, in an attempt to steal cutting edge research into vaccine development and treatment regimens. This resulted in CISA, the US Cybersecurity Infrastructure Security Agency, having to issue a warning about cyberattacks by China and others.

Intellectual property theft through cyber espionage for the Peoples Republic of China is strategic, state directed and financed, and seen as being critical for national development. Commercial trade secrets are stolen by the Chinese army and passed directly to army-run state-owned industries. These industries then leverage stolen research, or copy IP for incorporation in new pharmaceutical drugs and other products, which can then be sold on domestic or even overseas markets.

According to the US Select Committee on the Chinese Communist Party, Chinese intellectual property theft was in 2023, estimated to cost the US taxpayer $600 billion per year. This is why 'cyber espionage' is considered so important today for both China which is acquiring it, and the rest of the world which is losing it through cyber theft.

China though is not just engaged in IP theft. Many of its cyber espionage attacks have been focused upon leverage in state negotiations. The cyberattack against Singapore Health (SingHealth in 2018) resulted in the theft of not only medical records but also prescription records for the Prime Minister and his entire cabinet. Again, this was a CCP China advanced persistent threat (APT) attack not to sell the exfiltrated data but to use it as leverage in Sino-Singapore trade negotiations.

The Global Impact of Cyber Espionage

Cyber espionage is one of the most significant and underreported threats to global security, economic stability, and technological innovation. As the digital frontier expands, so does the ease with which nation-states, particularly China, can infiltrate systems, steal intellectual property, and exploit sensitive data for strategic gain. Unlike conventional cyberattacks aimed at disruption or ransom, cyber espionage is systematic, state-sponsored, and deeply embedded in long-term national development strategies. With hundreds of billions lost annually to IP theft and growing evidence of espionage-driven leverage in geopolitical negotiations, the global community must recognize cyber espionage not just as a cybersecurity issue, but as a critical challenge to sovereignty, economic fairness, and the future of innovation.

Read More

The Change Healthcare Breach & the Need to Secure Third Party Vendors

The Change Healthcare cyberattack, which exposed data of an estimated 190 million people, cost UnitedHealth Group (UHG) around $2.87 billion in 2024, including $1.7 billion in direct response costs. Final costs after all the regulatory and punitive fines, damages, and restitution could be much higher, as with any healthcare breach.

This was obviously a landslide attack - bigger and more impactful than all other healthcare cyberattacks anywhere in the world. This attack by Russian group ALPHV completely overshadowed the Chinese theft of 78.8 million medical records during a 2015 cyberattack against Anthem, now Elevance Health – at the time the largest healthcare data breach in history.

While any cyber-attack against a critical national infrastructure industry like healthcare is huge, the impact of the Change breach impacted the Availability of healthcare services for a significant percentage of Americans who were unable to receive approval for medical procedures or even to pick up their pharmaceutical prescriptions. Yet our healthcare regulations which date from 1996 are myopically focused on the protection of Confidentiality – something that is already lost to the vast majority of Americans thanks to countless overlapping cyber attacks.

When all is said and done and dust finally clears after the Change attack, a number of smaller hospitals, clinics and other healthcare providers will have gone out of business depriving entire communities of tertiary healthcare, while patient morbidity and mortality figures will have spiked as a result of denial of needed medical procedures, or life extending prescription medications. This may have appeared to be a simple ransomware attack, but the national security implications are significant.

You can bet that the Russians and Chinese watched what happened with the Change failure and took extensive notes.

Above all there is a very concerning danger that a similar or even bigger more impactful cyber attack could be executed against US healthcare through UHG or another dominant third party vendor that controls much of the US healthcare industry. As consolidation and vertical integration of US healthcare continues unabated, the emergence of single points of critical failure is inevitable and nothing is 'too big to fail'. Especially in times of 'hybrid' or 'grey warfare' between nation states.

CHIMSS

This was the subject of a cybersecurity panel discussion this week at the Colorado HIMSS CxO Advocacy Breakfast Summit, where over 200 local Colorado healthcare leaders gathered with Hal Wolf, President and CEO of HIMSS to discuss the state of the healthcare industry in Colorado.

With ransom attacks soaring in both the number of hospitals being hit and the extortion amount demanded, ransomware has become and existential threat to the survival of many healthcare delivery providers. According to the FBI, the healthcare industry is the top recipient of ransomware attacks because of its fragility, the need to restore patient services quickly, and its intolerance for downtime.

The Change cyberattack raised many concerns about the security of third-party vendors and single points of critical failure in a highly complex and intertwined healthcare ecosystem.

Huge single points of failure like Optum Health which owns Change Healthcare under UnitedHealth Group, dramatically increases risk impact when that organization is attacked. This is especially concerning where “providers cannot quickly pivot to other healthcare clearing houses and service providers”, claimed Howard Haile, CTO at Intermountain Health. “Very few were able to do this, and very few are setup to make such a switch quickly” he exclaimed.

“It taught us that third-party assessments for risk aren’t very effective,” Haile added. “This wasn’t just a vendor going down. You suddenly can’t bill or receive payment; your entire revenue cycle grinds to a halt. It’s not the same as losing access to a few patient records, it’s an existential threat to your operations.”

Another concern raised by Rick Bohm, CISO at Point Solutions Group is that the industry doesn’t properly assess risks of third-party vendors. “We are not testing third party systems to find vulnerabilities until it’s too late. I can guarantee that I can find similar vulnerabilities in the vast majority of vendor systems that healthcare relies upon every day” he claimed.

With literally thousands of third party vendors, suppliers and outsourced services providers its impossible for a Regulated Entity (RE) to audit each of its third parties or to collect and validate SOC2 attestations of security compliance.

“Furthermore, we don’t know what connects to our medical networks” added Richard Staynings, Chief Security Strategist with Cylera. “75% of connected assets – network endpoints – are not managed by IT and at most providers, security teams currently have very limited visibility into these IoT systems. Many don't even have an accurate count of what connects to their networks.

“Many of the medical devices on our networks are 20+ years old, written in EPROM, a programming language from the 1980s – and they are the secure ones! The newer devices run on Windows Embedded, in many cases using the same generation of code as Windows 95 or Windows XP and we all know how secure each of those are today. No one in this room would conduct their Internet banking on a Windows 95 or XP machine, yet we keep patients alive using similar era technology,” Staynings concluded.

Yet, identifying assets, and assessing risks of IoT can be very time consuming and resource intensive. This is where AI comes into its element by automating the entire process because hospital CISOs can’t hire and retain enough staff to do this by any other means.

“Used correctly, AI can be very powerful and very time saving. At Cylera we use Machine Learning (ML) to run passive protocol analysis engines that tell us what systems are communicating over the medical network and from that, can easily identify and risk assess devices unmanaged by IT,” Staynings stated. “That helps healthcare providers build ‘Zero Trust’ across their networks through segmentation and isolation of at-risk devices and other medical systems."

There are certainly many good uses of AI across healthcare to help drive improvements in accuracy and efficiency, as other panels at the CHIMSS event discussed. The concern is when AI algorithmic / training data is poisoned by mis-labeled or deliberately inaccurate data. “We need to be on the lookout for adversarial machine learning and data poisoning,” agreed both Staynings and Bohm.

The recent supply chain attack against GitHub Action and other third parties is a growing concern and in healthcare we use hundreds, if not thousands of third-party vendors, suppliers, and outsourcers. Knowing that your vendors and their systems are secure and meet or exceed your security standards is now absolutely critical for an industry like healthcare.

Read More

North Korea pulls off largest-ever theft in digital asset history

The 21 February heist of Bybit, a Dubai-based cryptocurrency exchange removed a staggering $1.46 billion in cryptoassets according to initial reports. In fact, this incident is likely the biggest known financial theft of all time. Bybit is the world’s second-largest cryptocurrency exchange by trading volume, with over 50 million registered users worldwide as per a September 2024 report.

Bybit disclosed that over 400,000 Ethereum and staked Ethereum coins were stolen during the heist. These were initially stored in a "Multisig Cold Wallet," however the funds were somehow transferred to a hot wallet and then siphoned into wallets controlled by the attackers.

"The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic," Bybit explained.

Investigation

According to crypto fraud investigator ZachXBT, the exploiter has already split 10,000 ETH out of the roughly 401,346 ETH stolen in the attack to 48 addresses.

An independent investigation has revealed connections to the infamous Lazarus group. A day after the attack was disclosed by ByBit, Blockchain investigator ZachXBT shared findings connecting the hack to the DPRK-backed hacking group. ZachXBT submitted a detailed analysis of test transactions and connected wallets used just before the exploit, along with multiple graphs and timing analysis, which were added in its X post.

DPRK Crime State

The United States, South Korea, and Japan said in January that North Korean state-backed hacking groups stole over $659 million worth of cryptocurrency last year. Indeed, crypto and other financial theft is the primary avenue through which the heavily sanctioned Hermit Kingdom is able to obtain hard currencies for trade in illicit goods for its nuclear weapons and rocket programs. 

However, one month earlier, blockchain analysis company Chainalysis painted a more dire picture, saying North Korean hackers stole $1.34 billion in cryptocurrency in 47 cyberattacks throughout 2024, breaking their previous record of $1.1 billion from 2022.

Read More