Can American Cybersecurity Technology Still Be Trusted?

The radical political transformation of the United States over the past few months has not gone unnoticed by the tech and cybersecurity sector – internally within the country or externally by that sector’s customers. While many see some of these changes as innocuous and hope that any storms will blow over, others see these changes as a fundamental shift with far more nefarious implications.

The decimation of scientific research agencies, the Cybersecurity Infrastructure Security Agency (CISA), the attempted firing of thousands of federal government employees across nearly every agency and department are one thing. The removal of impartial senior military and intelligence commanders who cannot be relied upon to be unquestionably loyal to the new commander-in-chief, is another thing entirely. Loyalty is everything to Donald Trump, and like any mafia boss, when absolute loyalty is not demonstrated it is to be punished publicly. “Kill the chicken to scare the monkey” as the Chinese idiom states.

Just look at Chris Krebbs, Director of the Cybersecurity and Infrastructure Security Agency in the Department of Homeland Security, who led CISA through the 2020 election and refused to support the MAGA lie that the election had been stolen when their cult leader lost. He was not only fired in the last days of Trump’s first presidency, but he and his next employer SentinelOne were very recently, openly and publicly persecuted - a full 4 years later by Trump in his second term. For Trump this was personal payback and in his narcissistic mind, totally justified for the lack of kowtowing to the wannbe king. 

    

Look at John Bolton, former US Ambassador to the United Nations under George W Bush, and US National Security Advisor in Trump's first term. Bolton has since become an outspoken critic of Trump’s mental decline and his errant foreign policy and has been a frequent guest on both right and left wing TV shows. His family house raided in the middle of the night by the FBI, an agency now controlled by Trump sycophant Kash Petal. The raid was plainly designed to send a message to anyone else who may dare to question the ‘Dear Leader’ in the White House. This is not just domestic politics and a retribution presidency, it’s a seismic shift in the America that everyone trusts, and the world is watching.

The fact is that the unshakable confidence in America that has persisted since World War II has been broken, and that break in confidence extends to American industry and its thriving technology sector. But for how much longer? This to anyone who works in the technology and cybersecurity sector should be very concerning.

So let me explain my concerns.

I have just spent the last ten days visiting security and technology leaders in Asia. I have worked internationally for nearly two decades with big American technology brands including Cisco, CSC, and now for Cylera. I visit Asia several times a year to present at various cybersecurity conferences, to visit customers, or just for a beach vacation in the depths of winter back home. This time however was different. Those that travel internationally will recognize that the reception of Americans outside of the country can be very different to the way other nationalities are welcomed. Fly to Europe or further afield and the comments about American politics and leaders can be quite surprising and sometimes openly hostile. Often this hostility is accompanied by derisory comments about the intelligence of the American electorate and the arrogance of its elected representatives. Foreigners will also quite vociferously question American foreign policy including the Gulf Wars, Afghanistan, Kosovo, and Bosnia, which all stir up a hot discussion even amongst American allies. But that’s not all I discovered during this visit.

I was out for drinks one evening with a number of CIOs and CISOs and the question arose can American technology be trusted? A CIO was considering whether to simply replace and upgrade his American wireless and cellular repeater technology or to consider a replacement strategy based upon cheaper Chinese technology. Putting aside historical issues of stolen American router source code and other “illegally acquired” technology IP, the Chinese tech today is highly innovative, feature rich, and often half the price he argued. And he was right. It’s cheaper and often better but at what price when it comes to security?

The table erupted as other security and technology leaders expressed their concerns about well-publicized and prolific state-sponsored hacking and especially about the various Chinese Typhoon attacks against telco systems. This includes concerns about backdoors and other vulnerabilities in Chinese manufactured technology systems and the fact that China cannot be trusted especially with anything that touches critical infrastructure of any kind. This coming from a mixed group of Asian and European leaders all living and working in Asia today, and all responsible for protecting their employers from an increasing tsunami of cyberattacks.

    

Not to be trusted

China certainly has a long history of spying on its own people and spends nearly twice as much on internal security as it does on external security. It has the world’s most intensive surveillance network of CCTV cameras in every city, town, and village street. It has pioneered the use of AI facial recognition software to identify and track each of its nearly 1.4 billion residents. The Ministry of State Security (MSS) has listening posts across cities and in public spaces, intercepts conversations, phone calls, and decrypts secure IP-based communications while restricting access to the Internet via the legendary Great Chinese Firewall that blocks news coming into China and prevents Chinese citizens from communicating outside. The PRC has become the Big Brother state envisioned in George Orwell's novel "1984", which of course is banned in China. Only North Korea could aspire to greater levels of surveillance. I say 'aspire', because in the DPRK, the supply of electricity is intermittent at best outside of Pyongyang and surveillance technology requires power. 

The ruling 100.27 million strong Chinese Communist Party, (CCP), has for many years been accused of suffering from a well founded paranoia that China’s 1.4 billion citizens will rise up in a counter-revolution against the corruption of the country’s communist ruling elite. Perhaps that’s a real risk as rising living standards can no longer be assured to buy-off the population, but this concern builds upon fears from the comparatively minor 1989 Tiananmen Square student protests requesting more freedoms from the party, a protest that saw party hardliners send in the tanks against their own citizens for daring to challenge the party. A popular uprising against the party elite is undoubtedly one of Xi’s greatest concerns today. Rising disparities of income, declining job opportunities especially among China's millions of annual graduates, and a growing recognition that the 'social contract' that has allowed the CCP to remain in power has expired. 

While some of the security failings of Chinese tech can simply be attributed to sloppy coding and poor quality-assurance, a problem that China has faced for decades across every industry, the fact is that few trust the technology or the ability of those running those companies to manufacture quality product free from interference by Chinese state or military agencies. Xi Jin Ping has made it law across China for every company and citizen to work for the communist state’s interests. And few would risk all, to refuse a “request” by the Ministry of State Security to work on their behalf at any given time. That’s likely how China was able to insert hidden substrates into top-end Taiwanese SuperMicro motherboards being fabricated in Chinese factories. Motherboards that were later found to be calling home to China from the US Congress, from Google and Apple data centers, and other sensitive locations.

But America spies on other countries too and has infiltrated sensitive networks all over the world. WekiLeaks published documents appearing to reveal NSA phone intercepts on French Presidents Jacques Chirac, Nicolas Sarkozy, and François Hollande from 2006 to 2012. The NSA also reportedly hacked the Iraqi military command and control network long before the second Gulf War and had been listening in on Iraqi communications for years. When the action started, it was able to effectively shut down Iraqi military and other communications making the alliance military’s job that much easier. Iran’s uranium enrichment plant at Natanz was partially destroyed by the Stuxnet virus in a cyber-physical attack thought to have been developed by the NSA and delivered by Mossad. A virus that enabled the US and Israel to slow down Iraq’s quest to develop nuclear weapons, weapons that would likely be used against Iran’s enemies including Israel and perhaps even the USA.

Can the US be trusted by its allies and non-aligned countries?

The Trump Administration has threatened the future of NATO, Five Eyes, and the overall western alliance. It has imposed debilitating tariffs against its principle trading partners which is isolating the United States and threatening globalization. US attempts to annex Greenland and Panama and absorb Canada against its will as the fifty-first state, have all shattered whatever trust that the US held with the rest of the world. The recent discovery of US agents trying to stir up a Greenland insurgency against rule from Copenhagen have hugely angered European allies. As has America’s apparent switching of sides against NATO and the EU to align with Putinist Russia over a Ukrainian land succession for a (temporary) succession of hostilities. It has also sent a very strong and alarming message to the rest of the world that America can no longer be relied upon even for the alliances it leads.

The recent raid of a multi-million dollar Hyundai battery plant under construction in the US state of Georgia by masked and armed ICE agents and the arrest, chaining in shackles, and temporary disappearance of 475 mostly Korean advisors has sent a very powerful message worldwide that the US is no longer to be trusted, nor is it safe to visit or work in. 

The arrest and deportation of European tourists arriving in the USA for minor ESTA infractions have caused Canada, the UK, and several European nations, to issue travel advisories for their citizens due to concerns about new immigration policies, and potential arbitrary detentions. The result is a significant decline in visitors and near empty US international flights and hotels.

Does that political distrust extend to American technology?

The short answer is yes. American technology companies – Google, Apple, Microsoft, Oracle, Amazon, and others are all tarred by the same brush along with thousands of other US-based highly innovative tech companies. Nor have they done a good job of distancing themselves from the chaos of the White House. Quite the contrary in fact, as the leaders of many of these companies have openly become Trump sycophants. The recent Oligarch’s Dinner at the White House where each tech billionaire leader took turns to sickeningly pay homage on camera to the ‘Dear Leader’ is proof enough. This removed any plausible distancing between American Big Tech and Trumpism. But paying homage to Trump can have a huge cost, as Elon Musk discovered when Tesla sales plummeted world wide, damage that appears to be permanent. 

When trust in America vanishes, so does trust in its technology companies and its technology products and services. For cybersecurity companies, that eradication of trust could be devastating just as Kaspersky found itself in near ruin thanks to its Russian ties.

The big question is what can the American technology sector do to distance itself from the chaos going on in Washington DC and can its reputation be saved before it’s too late, or does the whole sector go the way that Tesla went?

Read More

Stalled spending on healthcare cybersecurity has impact

A recent report by research application security company Indusface, gave the US healthcare industry its worst privacy and security report yet. Over the past 24 months the report detailed a staggering 1,200 security and privacy breaches of which 83% of incidents exposed patient health information (PHI). This marks a new milestone for the industry and once again raises alarm bells about the lack of investment in healthcare IT or the prioritization of cybersecurity to offset rising attacks and escalating concerns related to patient safety.

Texas topped the charts with 66 data breaches exposing the data of over 14 million Texans with 4 millions of these attributed to a single breach at Concentra Health Services in January 2024. California came in second with over 9 million patient records exposed with approximately half attributed to Blue Shield of California’s sharing of patient data with Google Pixel used for advertising.

“The healthcare sector is vulnerable to these breaches due to both the vast amount of sensitive patient data, which is often sold to third parties for a high price, and weak or outdated software and systems,” said Venky Sundar, founder and president of Indusface. 

Many of these alarming trends were backed by data in the recently published 2025 Verizon DBIR. The report confirmed that exploits have now overtaken phishing as a leading cause of data breaches. Not only is the healthcare industry running on old, often out-of-date and end-of-life, highly vulnerable software, but the application of patches, even when these are available, is slower than just about any other industry. The report listed an average lag time of over 200 days between the announcement of vulnerabilities, and the patching of vulnerable systems. Unlike other industries however, many of these critical systems are responsible for keeping patients alive or maintaining the confidentiality, integrity, and availability (CIA) of their personal health and identity data.

“If we compare healthcare to other industries, we can see a big difference in the investment in and prioritization of cybersecurity,” claimed Richard Staynings, Chief Security Strategist with New York based healthcare cyber security company Cylera. “The financial services industry reinvests a good chunk of its operating profits in modern IT and well-equipped cybersecurity teams and tools. Healthcare, because much of the industry is setup to be ‘not for profit’, tends to downplay both its operating margins, and the percentage of operating profits allocated to cyber security. Putting aside the massive difference in the size of profits between industries, or the way operating margins are calculated, healthcare providers currently spend less than one tenth of what financial services spends - even though lives are at stake in hospitals, clinics, and other care facilities. Healthcare payers on the other hand have much bigger revenues with profits in the tens of billions of dollars annually, yet have still suffered some massive cyber attacks.

The difference may be attributable to how boards and senior executives perceive and quantify both enterprise risk and cybersecurity return on investment (ROI) in one industry compared to the other. Risk is calculated by multiplying probability of loss by potential impact of loss. When this risk involves money, any high risk identified by a bank of potentially losing a million dollars in assets, or not being able to conduct business with customers for several hours (resulting in billions of dollars of lost revenue), will create a very compelling ROI for cybersecurity spend to quickly remediate that risk. In this case, the costs of 'action' are often tiny compared to the possible or probable costs of 'inaction'.”

Healthcare doesn’t qualify risk in the same way. Risks are usually perceived in different terms as clinical or operational risk. What is the risk of a 90-year-old patient undergoing anesthesia for a procedure? What is the probability of a negative outcome of a particular patient undergoing surgery compared to not being given that surgery? Business risks like operating profit typically come second, while cybersecurity risks often don’t even make it to the board room agenda for discussion.

Of course, some operational risks are becoming increasingly important as evidenced by many health systems declaring bankruptcy or going out of business entirely following a cyber attack. The recent UHG Change Healthcare attack exposed the PHI of over 190 Americans. It more alarmingly, also caused a national outage which resulted in thousands of providers unable to bill for millions of services for weeks on end, or to receive pre-authorization for scheduled procedures or pharmaceutical medications. This caused major cash-flow problems resulting in expensive emergency bank loans to cover staff and other overheads while delaying hundreds of money-earning procedures as surgical staff sat idle for weeks or had to be furloughed.

Operational risks are not just limited to outages of critical third parties but often to core hospital systems when a denial-of-service (DOS) attack or a ransomware attack is launched against a payer or provider. Both attacks are considered ‘availability attacks’ as they essentially render critical systems unavailable for use, stopping most business activity in its tracks. DOS attacks don’t generally last long, usually a few hours or a day or so before the attacker’s systems are blocked, and traffic is restored. However, a ransomware attack will encrypt vital systems and data, shutting these down until a ransom payment is made, or the victim is able to rebuild and restore critical data and systems. The result is often a partial or full hospital outage for many weeks or sometimes several months.

Any outage will have an impact on financial operations, but this may also result in clinical or safety risk to patients by negatively impacting patient morbidity and mortality, and therefore legal liability of providers. But so too, will any cyberattack against patient data unless forensic investigation can irrefutably prove that regulated data was not touched or accessed by hackers. The HIPAA regulation terms this as a ‘data breach’, while security professionals would define this as an attack against the ‘confidentiality’ of protected data. Thus, regulatory risk, clinical risk, and liability risk are far more significant across healthcare when attacked. Despite this, investment in healthcare cybersecurity significantly lags behind other industries like financial services, even though lives maybe at stake.

Until such times that the industry gives greater priority to protecting the information systems that power modern digital healthcare, the sector will continue to be recognized as an easy target to attack by criminals. While growing regulatory fines, restitution, and punitive damages awarded by class action lawsuits are slowly changing the equation between ‘the costs of action versus inaction’, much of the US healthcare delivery industry stands on the edge of bankruptcy, despite the huge sums spent on health insurance each year. With basic concerns of survivability, healthcare cybersecurity will more than likely continue to be underfunded until meaningful structural healthcare reform is enacted. 

These risks exist before the Trump Administration's plans to decimate public healthcare funding under Medicaid and Medicare by removing 18 million patients from eligibility. These changes will disproportionately impact rural healthcare providers, whose patient populations heavily rely upon publicly funded healthcare programs. Even though 20% of rural patient populations typically have employer based private health insurance, this will not be enough to keep rural hospitals open, especially on top of UHG Change Healthcare losses. This could result in some rural populations being isolated from critical health services and potentially becoming 4 or 5 hours drive from the nearest trauma or stroke center. A journey many patients will be unlikely to survive. 

The impacts of policy changes and unmitigated cybersecurity risks will therefore lead to significant changes in patient morbidity and mortality.

In the absence of countries legislating to outright ban the payment of ransoms and other forms of extortion payments to cyber terrorists, it’s likely that ransomware will continue to plague the health sector given the criticality of this critical national industry. It’s therefore probable, that healthcare cyber attacks will continue to grow in both size and scope for the foreseeable future and as a result, that access to critical healthcare services can no longer be guaranteed.

Read More

What is Cyber Espionage and why is it so concerning?

It's often said that there are two types of healthcare organizations, those that know they have been hacked and those that are still ignorant of the fact. In other words, just about everyone has already been hacked at least once by now. And that includes healthcare payers, providers, bio-pharma and the proliferation of healthcare vendors and suppliers.

But while cyberattacks against availability of IT systems and data - principally Denial of Service (DOS) and Ransomware cyber extortion attacks seem to make the headlines almost every week, there are other stealthier attacks taking place in the background - almost constantly in fact. This involves the exfiltration of non-public data. Sometimes this is used for extortion in secondary and tertiary ransomware demands. This is often via a threat to release confidential non-public data unless an additional ransom is payed to the criminal perpetrators. Other times, it is for the sale and monetization of data - patient identities, their prescriptions which can be filled and sold on the street, or other PHI or PII data - employee banking information for example. And sometimes perpetrators deliberately search for high value intellectual property data. This last category is usually referred to as 'cyber espionage', and only occasionally makes the front page of the press, usually then only when some government official makes a stink about the sheer levels of cyber espionage and intellectual property theft taking place.

The Art of Espionage

'Espionage' according to the Oxford Dictionary is the practice of spying or of using spies, typically by governments to obtain political and military information.

So 'cyber espionage' is chiefly about obtaining political and military information, not by the use of spies like 007 James Bond, but by means of cyber attacks and infiltration of non-public information systems.

The advent of the internet and the connectivity of government and health systems to the internet has made cyber espionage that much easier. You no longer need someone on-site or in-country - an insider threat,  spy or double agent to obtain valuable information. KGB spies like Rudolf Abel, Kim Philby, Oleg Gordievsky, Aldrich Ames, and Anna Chapman for example are a thing of the past in this age of hyper connectivity. 

Today all governments spy on one another - even between friends and allies. The US NSA was accused of hacking and listening into the French President’s cell phone some years ago according to Wikileaks, and at that time at least, before the tariff war, France and the USA were friends and allies.

The USA spies on Iran to ascertain the level of uranium enrichment it has achieved since Trump in his first term pulled out of the Iran Nuclear Deal thinking he could negotiate a better deal and failed. The USA also spies on China, North Korea and Russia about each of these nation's military capabilities and a wide variety of other useful data points.

The Art of Cyber Espionage and IP Theft

But countries also occasionally spy on other forms of data. Enter the Peoples Republic of China and the huge revelation exposed by the Mandiant APT1 Report in 2013. If you have not yet read this, or a summary of this report, you really should do. It changed the game and our understanding of cyber espionage against commercial businesses.

APT1 is otherwise known as PLA Unit 61398 (61398部队) a military unit of the Chinese Communist Party, Peoples Liberation Army. These aren’t criminal hackers they are employees of the Chinese Communist State. They are paid to hack, but not just government or military secrets - in this case intellectual property and commercial trade secrets from businesses in other countries.

China is famous for its Great Leap Forward, Mao’s attempt between 1959 to 1961 to take China from a feudal agrarian society to an industrial powerhouse. It failed and resulted in the death of 45 million people. Most of these starved to death, under Mao’s ill-conceived and badly run collective agriculture and industry policy. That’s more than double the total number of soldiers that died during WWII across all theaters to provide some perspective just how big a human calamity this was.

After decades of isolation from the rest of the world, China has since the 1990s, once again been attempting another Great Leap Forward through rapid modernization and industrialization becoming the factory of the world for consumer goods. This time around however, China largely succeeded and has taken millions of its people out of abject poverty, through industrialization, urbanization and education.

Ownership of the Means of Production

But in China the 'means of production' is owned almost entirely by the state. CCP state owned industries dominate and even hold a majority share in joint ventures with global firms which are only allowed to own a 49% stake.

The ruling CCP also puts together 5 year plans. These ambitious documents usually discuss how China will be the global leader in EVs, or the largest manufacturer of pharmaceutical drugs, or the global leader in aeronautical engineering, etc.

But to reach these lofty goals, to make up for the lost years of communist isolationism and stagnation under Mao, and a lack of history, knowledge, and experience, China has had to obtain technologies, manufacturing capabilities, and a heap of other proprietary commercial trade secrets from industry leaders outside of the PRC - usually by what ever means at its disposal. Mostly this means through 'cyber espionage' and is supplemented by process and procedure skills brought back from Chinese diaspora working overseas.

According to a 2022 report by Cybereason one China state actor alone, APT41, has siphoned off trillions of US dollars in intellectual property theft from approximately 30 multinational companies within the manufacturing, energy and pharmaceutical sectors. The Cybereason investigation entitled 'Operation CuckooBees' was shared with the FBI, and discovered APT41 actively engaged in 'stealing the IP of drugs around diabetes, obesity, depression.' Cyber-criminals were focused on obtaining blueprints for cutting-edge technologies, the majority of which were not yet patented, the report stated.

Chinese IP theft has included the theft of pharmaceutical drug formations, clinical trail methodologies and practices, manufacturing IP and much, much else. It has short-cut 50 plus years of IP development by global pharmaceutical companies, sometime including experimental drugs developed at over a decade or more at the costs of hundreds of millions of dollars, pounds and euros in R&D. China has even patented some these stolen experimental drugs and attempted to sell them back to the global markets that invented them and financed their research.

Levels of Cyber Espionage and IP Theft

Between 2018 and 2019, Bayer and Roche were both targeted by nation-state APT cyber attacks, aimed at industrial espionage, and attempting to steal valuable intellectual property. Both companies claimed to have contained the breaches without significant data or intellectual property loss, but other biotech and pharmaceutical organizations have fared less well.

During COVID-19, both China, and to a lesser extent Russia, Iran, and the DPRK, were discovered to be attacking US, UK, German and other hospitals and bio-labs, in an attempt to steal cutting edge research into vaccine development and treatment regimens. This resulted in CISA, the US Cybersecurity Infrastructure Security Agency, having to issue a warning about cyberattacks by China and others.

Intellectual property theft through cyber espionage for the Peoples Republic of China is strategic, state directed and financed, and seen as being critical for national development. Commercial trade secrets are stolen by the Chinese army and passed directly to army-run state-owned industries. These industries then leverage stolen research, or copy IP for incorporation in new pharmaceutical drugs and other products, which can then be sold on domestic or even overseas markets.

According to the US Select Committee on the Chinese Communist Party, Chinese intellectual property theft was in 2023, estimated to cost the US taxpayer $600 billion per year. This is why 'cyber espionage' is considered so important today for both China which is acquiring it, and the rest of the world which is losing it through cyber theft.

China though is not just engaged in IP theft. Many of its cyber espionage attacks have been focused upon leverage in state negotiations. The cyberattack against Singapore Health (SingHealth in 2018) resulted in the theft of not only medical records but also prescription records for the Prime Minister and his entire cabinet. Again, this was a CCP China advanced persistent threat (APT) attack not to sell the exfiltrated data but to use it as leverage in Sino-Singapore trade negotiations. 

Read More

The Change Healthcare Breach & the Need to Secure Third Party Vendors

The Change Healthcare cyberattack, which exposed data of an estimated 190 million people, cost UnitedHealth Group (UHG) around $2.87 billion in 2024, including $1.7 billion in direct response costs. Final costs after all the regulatory and punitive fines, damages, and restitution could be much higher, as with any healthcare breach.

This was obviously a landslide attack - bigger and more impactful than all other healthcare cyberattacks anywhere in the world. This attack by Russian group ALPHV completely overshadowed the Chinese theft of 78.8 million medical records during a 2015 cyberattack against Anthem, now Elevance Health – at the time the largest healthcare data breach in history.

While any cyber-attack against a critical national infrastructure industry like healthcare is huge, the impact of the Change breach impacted the Availability of healthcare services for a significant percentage of Americans who were unable to receive approval for medical procedures or even to pick up their pharmaceutical prescriptions. Yet our healthcare regulations which date from 1996 are myopically focused on the protection of Confidentiality – something that is already lost to the vast majority of Americans thanks to countless overlapping cyber attacks.

When all is said and done and dust finally clears after the Change attack, a number of smaller hospitals, clinics and other healthcare providers will have gone out of business depriving entire communities of tertiary healthcare, while patient morbidity and mortality figures will have spiked as a result of denial of needed medical procedures, or life extending prescription medications. This may have appeared to be a simple ransomware attack, but the national security implications are significant.

You can bet that the Russians and Chinese watched what happened with the Change failure and took extensive notes.

Above all there is a very concerning danger that a similar or even bigger more impactful cyber attack could be executed against US healthcare through UHG or another dominant third party vendor that controls much of the US healthcare industry. As consolidation and vertical integration of US healthcare continues unabated, the emergence of single points of critical failure is inevitable and nothing is 'too big to fail'. Especially in times of 'hybrid' or 'grey warfare' between nation states.

CHIMSS

This was the subject of a cybersecurity panel discussion this week at the Colorado HIMSS CxO Advocacy Breakfast Summit, where over 200 local Colorado healthcare leaders gathered with Hal Wolf, President and CEO of HIMSS to discuss the state of the healthcare industry in Colorado.

With ransom attacks soaring in both the number of hospitals being hit and the extortion amount demanded, ransomware has become and existential threat to the survival of many healthcare delivery providers. According to the FBI, the healthcare industry is the top recipient of ransomware attacks because of its fragility, the need to restore patient services quickly, and its intolerance for downtime.

The Change cyberattack raised many concerns about the security of third-party vendors and single points of critical failure in a highly complex and intertwined healthcare ecosystem.

Huge single points of failure like Optum Health which owns Change Healthcare under UnitedHealth Group, dramatically increases risk impact when that organization is attacked. This is especially concerning where “providers cannot quickly pivot to other healthcare clearing houses and service providers”, claimed Howard Haile, CTO at Intermountain Health. “Very few were able to do this, and very few are setup to make such a switch quickly” he exclaimed.

“It taught us that third-party assessments for risk aren’t very effective,” Haile added. “This wasn’t just a vendor going down. You suddenly can’t bill or receive payment; your entire revenue cycle grinds to a halt. It’s not the same as losing access to a few patient records, it’s an existential threat to your operations.”

Another concern raised by Rick Bohm, CISO at Point Solutions Group is that the industry doesn’t properly assess risks of third-party vendors. “We are not testing third party systems to find vulnerabilities until it’s too late. I can guarantee that I can find similar vulnerabilities in the vast majority of vendor systems that healthcare relies upon every day” he claimed.

With literally thousands of third party vendors, suppliers and outsourced services providers its impossible for a Regulated Entity (RE) to audit each of its third parties or to collect and validate SOC2 attestations of security compliance.

“Furthermore, we don’t know what connects to our medical networks” added Richard Staynings, Chief Security Strategist with Cylera. “75% of connected assets – network endpoints – are not managed by IT and at most providers, security teams currently have very limited visibility into these IoT systems. Many don't even have an accurate count of what connects to their networks.

“Many of the medical devices on our networks are 20+ years old, written in EPROM, a programming language from the 1980s – and they are the secure ones! The newer devices run on Windows Embedded, in many cases using the same generation of code as Windows 95 or Windows XP and we all know how secure each of those are today. No one in this room would conduct their Internet banking on a Windows 95 or XP machine, yet we keep patients alive using similar era technology,” Staynings concluded.

Yet, identifying assets, and assessing risks of IoT can be very time consuming and resource intensive. This is where AI comes into its element by automating the entire process because hospital CISOs can’t hire and retain enough staff to do this by any other means.

“Used correctly, AI can be very powerful and very time saving. At Cylera we use Machine Learning (ML) to run passive protocol analysis engines that tell us what systems are communicating over the medical network and from that, can easily identify and risk assess devices unmanaged by IT,” Staynings stated. “That helps healthcare providers build ‘Zero Trust’ across their networks through segmentation and isolation of at-risk devices and other medical systems."

There are certainly many good uses of AI across healthcare to help drive improvements in accuracy and efficiency, as other panels at the CHIMSS event discussed. The concern is when AI algorithmic / training data is poisoned by mis-labeled or deliberately inaccurate data. “We need to be on the lookout for adversarial machine learning and data poisoning,” agreed both Staynings and Bohm.

The recent supply chain attack against GitHub Action and other third parties is a growing concern and in healthcare we use hundreds, if not thousands of third-party vendors, suppliers, and outsourcers. Knowing that your vendors and their systems are secure and meet or exceed your security standards is now absolutely critical for an industry like healthcare.

Read More

North Korea pulls off largest-ever theft in digital asset history

The 21 February heist of Bybit, a Dubai-based cryptocurrency exchange removed a staggering $1.46 billion in cryptoassets according to initial reports. In fact, this incident is likely the biggest known financial theft of all time. Bybit is the world’s second-largest cryptocurrency exchange by trading volume, with over 50 million registered users worldwide as per a September 2024 report.

Bybit disclosed that over 400,000 Ethereum and staked Ethereum coins were stolen during the heist. These were initially stored in a "Multisig Cold Wallet," however the funds were somehow transferred to a hot wallet and then siphoned into wallets controlled by the attackers.

"The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic," Bybit explained.

Investigation

According to crypto fraud investigator ZachXBT, the exploiter has already split 10,000 ETH out of the roughly 401,346 ETH stolen in the attack to 48 addresses.

An independent investigation has revealed connections to the infamous Lazarus group. A day after the attack was disclosed by ByBit, Blockchain investigator ZachXBT shared findings connecting the hack to the DPRK-backed hacking group. ZachXBT submitted a detailed analysis of test transactions and connected wallets used just before the exploit, along with multiple graphs and timing analysis, which were added in its X post.

DPRK Crime State

The United States, South Korea, and Japan said in January that North Korean state-backed hacking groups stole over $659 million worth of cryptocurrency last year. Indeed, crypto and other financial theft is the primary avenue through which the heavily sanctioned Hermit Kingdom is able to obtain hard currencies for trade in illicit goods for its nuclear weapons and rocket programs. 

However, one month earlier, blockchain analysis company Chainalysis painted a more dire picture, saying North Korean hackers stole $1.34 billion in cryptocurrency in 47 cyberattacks throughout 2024, breaking their previous record of $1.1 billion from 2022.

Read More

2025 Proposed HIPAA Security Rule Changes

Much Needed Update to HIPAA coming in 2025.

A long overdue update the HIPAA Security Rule, last updated in 2013, is currently being drafted. Many things have changed in digital healthcare since the rules’ last update and today, the healthcare industry is near wholly reliant upon technology for the delivery of services to patients. This includes a rapid expansion of medical devices and other IoT systems, the widespread use of AI and in particular Machine Learning (ML) to mine vast data lakes of medical information now being generated by the industry. The updated rules also take account of widespread use of cloud and virtual technologies and includes provision for even newer technologies including virtual reality, and quantum computing.

The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996, at a time when few hospitals or health insurance groups had made the transition to digital records and most users considered a 28.8kbps internet connection to be fast. WiFi, mobile devices, and 5G cellular were still distant dreams as was the meaningful exchange of information in digital format between all those involved in treating patients. The HIPAA Security Rule in particular, was considered out of date the moment it was published, although the act’s Privacy Rule has faired better. In 2009 the HITECH act updated the security requirements of HIPAA Covered Entities (CEs) and Business Associates (BAs) to take account of changes in technology and some major ambiguities in the language of the original rule. A further Omnibus update took place in 2013 for similar reasons.

What is Happening?

On December 27th, HHS OCR announced a Notice of Proposed Rulemaking (NPRM) to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule to strengthen cybersecurity protections for electronic protected health information (ePHI). The rule “seeks to strengthen cybersecurity by updating the Security Rule’s standards to better address ever-increasing cybersecurity threats to the health care sector.

What is Changing?

The NPRM proposes to strengthen the Security Rule’s standards and implementation specifications with new proposals and clarifications, including:

• Remove the distinction between “required” and “addressable” implementation specifications and make all implementation specifications required with specific, limited exceptions.
  
  
• Require written documentation of all Security Rule policies, procedures, plans, and analyses.
  
  
• Update definitions and revise implementation specifications to reflect changes in technology and terminology.
  
  
• Add specific compliance time periods for many existing requirements.
  
  
• Require the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, but at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI.
  
  
• Require greater specificity for conducting a risk analysis. New express requirements would include a written assessment that contains, among other things: A review of the technology asset inventory and network map.
  
  
• Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI.
  
  
• Identification of potential vulnerabilities and predisposing conditions to the regulated entity’s relevant electronic information systems.
  
  
• An assessment of the risk level for each identified threat and vulnerability, based on the likelihood that each identified threat will exploit the identified vulnerabilities.
  
  
• Require notification of certain regulated entities within 24 hours when a workforce member’s access to ePHI or certain electronic information systems is changed or terminated.
  
  
• Strengthen requirements for planning for contingencies and responding to security incidents. Specifically, regulated entities would be required to, for example: Establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours.
  
  
• Perform an analysis of the relative criticality of their relevant electronic information systems and technology assets to determine the priority for restoration.
  
  
• Establish written security incident response plans and procedures documenting how workforce members are to report suspected or known security incidents and how the regulated entity will respond to suspected or known security incidents.
  
  
• Implement written procedures for testing and revising written security incident response plans.
  
  
• Require regulated entities to conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements.
  
  
• Require that business associates verify at least once every 12 months for covered entities (and that business associate contractors verify at least once every 12 months for business associates) that they have deployed technical safeguards required by the Security Rule to protect ePHI through a written analysis of the business associate’s relevant electronic information systems by a subject matter expert and a written certification that the analysis has been performed and is accurate.
  
  
• Require encryption of ePHI at rest and in transit, with limited exceptions.
  
  
• Require regulated entities to establish and deploy technical controls for configuring relevant electronic information systems, including workstations, in a consistent manner. New express requirements would include: Deploying anti-malware protection.
  
  
• Removing extraneous software from relevant electronic information systems.
  
  
• Disabling network ports in accordance with the regulated entity’s risk analysis.
  
  
• Require the use of multi-factor authentication, with limited exceptions.
  
  
• Require vulnerability scanning at least every six months and penetration testing at least once every 12 months.
  
  
• Require network segmentation.
  
  
• Require separate technical controls for backup and recovery of ePHI and relevant electronic information systems.
  
  
• Require regulated entities to review and test the effectiveness of certain security measures at least once every 12 months, in place of the current general requirement to maintain security measures.
  
  
• Require business associates to notify covered entities (and subcontractors to notify business associates) upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.
  
  
• Require group health plans to include in their plan documents requirements for their group health plan sponsors to: comply with the administrative, physical, and technical safeguards of the Security Rule; ensure that any agent to whom they provide ePHI agrees to implement the administrative, physical, and technical safeguards of the Security Rule; and notify their group health plans upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.

HHS OCR has requested feedback on the proposed rule changes be received from REs by March 7, 2025, after which the new rule will be drafted, and a final rule enacted approximately 6 months after that.

Most of these proposed requirements are already being followed by larger and better funded HIPAA CEs, though not all BAs it seems. The proposed rules spell out in a more granular format, each of the ‘required’ and ‘addressable’ rules that CEs and BAs should already be following. What was considered ‘addressable’ is now however, a ‘requirement’ under the proposed rule changes.

Of Specific Interest:

• Language of the proposed rule change removes the distinction between ‘Covered Entity’ (CE) and ‘Business Associate’ (BA) and instead employs the term ‘Regulated Entity’ (RE).
  
  
• Removal of distinction between ‘required’ and ‘addressable’. All are now requirements and must be implemented. Time limits are added to meet requirements and to become compliant.
  
  
• Changes various terms in the HIPAA Security Rule such as ‘electronic media’ to take account of the wider use of VOIP technologies, telehealth, digital messaging, cloud, and AI.
  
  
• A complete asset inventory of all network-connected assets is now required along with a network map that illustrates the movement of ePHI throughout the RE network. This needs to be updated at least every 12 months or when new assets are joined to the network.
  
  
• Each RE needs to know where all of its PHI resides on its network and in which systems, whether owned and operated by the RE or some other entity.
  
  
• Makes it a requirement for network segmentation between operational and IT networks.
  
  
• Requires improved regular testing and security risk analysis that includes:
• technology asset inventory and network map.
• improved identification of threats, vulnerabilities, and risks to the CIA of PHI
  
  
• Requires improved audit of access to PHI by users.
  
  
• Requires improved business continuity, contingency planning, and security incident response capabilities.
  
  
• Requires the use of multi-factor authentication.
  
  
• Sets minimum 24-hour notification time. This applies for BAs to notify CEs, and for subcontractors to notify BAs.

What is Impacted?

If a Regulated Entity (RE) is fully compliant with the HIPAA Security Rule (as updated by HITECH and Omnibus) then very little changes. However, this is unlikely. The updated Security Rule proposal itself states that while conducting an audit of regulated entities against the current Security Rule, OCR found that “94 percent failed to implement appropriate risk management activities sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.”

This means that most REs have some work to do in order to catch up with existing Security Rule requirements, let alone the additional effort that will be required to come up to speed with the updated requirements. It also means that more effective risk assessment and analysis is required moving forward.

The intent of this proposed rule change is to remove inconsistent application of the Security Rule across REs. In so doing, it removes the option for ‘reasonableness and appropriateness’ in connection with the costs of security controls, along with often misinterpreted ‘addressable’ implementation specifications to mean they are ‘optional’. These are now ‘required’ and are mandatory.

Furthermore, the rule changes introduce the need to evaluate the ‘effectiveness’ of security controls in supporting the resiliency of the regulated entity. ‘Resiliency’ refers to the entity’s ability to withstand and recover from adverse events. In this regard the changes appear to recognize the vulnerability of REs to denial of service (DOS) and ransomware attacks, and the need to protect against these ‘availability’ attacks through increased resiliency.

This implies the need for much improved business continuity, disaster recovery, and security incident response capabilities so that REs can be back up and running quickly following an incident or attack. It also implies the need for more resiliency in technology architectures using n+2 architectures where a second or third copy of an application can be used in times of need and switched into production quickly. The protracted healthcare downtimes that have impacted the industry recently have been largely caused by single points of failure, an encrypted EMR or other core system with no hot or warm standby, or the ransoming of a critical third party like Change Healthcare as examples.

In Conclusion.

This long-awaited update to healthcare industry security requirements will help to address the chronic imbalance between a growing number of attackers and a largely weak and ill prepared cyber defense across payers and providers. It is intended to lead to massive improvements in security risk assessment and analysis, and the speedy remediation of identified security vulnerabilities. As such, the new rules should reduce the number of successful cyber-attacks, and thus will help to ensure that hospitals and other delivery partners are available in times of medical need by patients and the communities that they serve. Furthermore, these changes will help to reduce growing patient safety concerns, including increased morbidity and mortality when hospitals are under attack.

The need to identify and keep track of connected assets, to know where data resides and moves across medical networks, and to segment operational and IT networks under the proposed rules will be a real deal changer for security. This is well known as the weakest link and is often referred to as the ‘open back door to healthcare security.’ Medical networks and IT / IoT have changed greatly over recent years, as has our reliance upon technologies to diagnose, monitor, treat, and manage patients in our largely digital healthcare system. It's therefore vital that our security controls keep pace with these and other changes.

Read More

2025 Healthcare Cybersecurity Predictions

Twenty Twenty-Five

As someone who has been evangelizing the need for improved healthcare cybersecurity for decades, every year I am hopeful that the new year will be better for healthcare security - that there will be fewer breaches, less supply chain attacks, fewer denial-of-service attempts, and less ransomware attacks. However, statistics don’t lie, nor do trends, so it’s unlikely that I will get my wish in 2025.

The Global Cybersecurity Landscape

Each year, more and more healthcare payers, providers, and life sciences organizations are hit with devastating and costly cyber-attacks. Increasingly these cyber-attacks can impact entire communities. We saw this in West Texas in September and October of 2024 when both UMC and Texas Tech University Health Sciences Center were hit with separate ransomware attacks. This essentially denied Level 1 trauma care to multiple communities impacting an area greater than 250 miles in diameter. It’s likely that we could see more of these high impact overlapping attacks in 2025, for various reasons, as I shall explain shortly.

Healthcare is in the cross hairs and is both an easy and soft target for a growing number of opportunistic perpetrators. It has a large and sprawling supply chain, which when attacked can have sweeping implications for industry players themselves. On top of that, as a critical national infrastructure industry, and in times of geopolitical conflict and cyber warfare, the industry is also a strategic political target. It is being hit from all sides - from organized crime syndicates to state actors, with a rising body of evidence to suggest collaboration and coordination between the two groups.

As a critical national infrastructure industry, healthcare will I believe, be the recipient of increasing levels of government direct and indirect cyber assistance in 2025. Expecting small, independent, or even state-run healthcare providers to defend themselves against the might of the highly organized Russian Mafia crime syndicate or the offensive instruments of a pariah state’s military and intelligence organizations, makes absolutely no sense. Thus, government will need to step in. We are seeing this already in the UK, EU, and Australia with much higher levels of direct involvement and intelligence sharing by government agencies. The US is expected to follow suit in 2025. However, very few governments are ready and prepared to directly protect their healthcare systems at present.

2025 will likely see even more ransomware attacks against healthcare providers. This will no doubt continue until such times that ransom payments and other forms of cyber extortion demand are finally and fully made illegal. Ransomware is a very lucrative industry, whose growth is being fueled by larger and larger payments from victims. Lack of resiliency across the healthcare industry combined with the critical need for operational availability, makes healthcare a prime target for such attacks. As such, expect many more.

Supply chain attacks against the thousands of third-party vendors, suppliers, and services providers will continue to be the open back door to a secure healthcare industry. Software supply chain attacks and strikes against critical single points of failure across the array of healthcare infrastructure will likely continue for as long as the war with Russia does. This means that payers, providers, and life sciences organizations need to develop much stronger risk management processes around their multitude of third-party vendors. This should include full inventory and risk analysis of all organizations who have direct or indirect access to medical networks including third party applications and devices. Cyber-attacks against Synnovis, Change Healthcare, Microsoft, SolarWinds, and others have wreaked havoc across hundreds of organizations with the attack of a single third-party. The return on investment for perpetrators is therefore huge. Expect many more in 2025.

2025 will also see the rise of nation-state attacks. The recent Salt Typhoon attack against critical infrastructure telecommunications providers by the Peoples Republic of China, and a dozen other Chinese Typhoon attacks, are an indication of growing geopolitical tensions as China, Russia, Iran, and the DPRK face off against the western world in what is being termed the ‘Axis of Resistance’. With Russia and Iran already engaged in hybrid and proxy wars, cyber is being viewed increasingly as a convenient weapon of choice that inflicts damage and retribution without crossing a line that will result in a kinetic response from the attacked nation. All critical national infrastructure industries could be the target for increased attention by Axis powers and will need to prepare accordingly. Nation-state cyber-attacks will be 2025’s biggest single threat.

Regulatory Changes

2025 will likely see major changes to US healthcare regulation with the passage (sometime during the year) of the Health Infrastructure Security and Accountability Act (HISAA). This is the long-awaited update or replacement of the ailing and out-of-date 1996 HIPAA security rule which has governed the US healthcare industry for over two decades now. HISAA aims to transform healthcare cybersecurity by setting minimum standards and throwing much-needed financial support to healthcare providers. HISSA is still in the drafting stage at present, but will likely impose stricter cybersecurity standards, require audits, and stress tests, implement serious consequences for non-compliance while providing financial support to healthcare organizations that need help to enhance and improve their cybersecurity capabilities.

HISSA will no doubt help to move the cybersecurity needle, just as NIS2 in Europe and CAF in the UK are already beginning to do. But ‘compliant’ does not mean ‘secure’ and most regulations are out of date the day they are enacted. Its therefore important for healthcare entities to adopt a risk-based approach to security rather than a compliance-based one in its place. That means understanding what, and who, connect to hospital networks, assessing people, processes, and technologies, and conducting a full risk analysis to identify, track and remediate security vulnerabilities on an ongoing basis. This will become ever more important as new innovative technology is added to medical networks.

New Technology

The healthcare industry creates more data than any other industry. To say that there are now healthcare data lakes would be an understatement. Each patient that is seen, diagnosed, and treated, creates vast amounts of useful medical data. This data can then be mined by healthcare data scientists and used to train artificial intelligence (AI) algorithms for machine-learning-based applications used for clinical decision support, and many other areas of medicine.

2025 will see these data lakes become even larger and combined with improvements in AI training to enhance the tools available to clinicians. But just like all data repositories, this highly valuable data needs to encrypted and protected. The RSNA Conference in November highlighted once again, the need for better encryption while revealing new advancements to radiological and medical imaging, thanks in part, to improvements in AI. This is leading to earlier diagnosis and opportunity to medically intervene in patient care, thus driving outcomes while reducing cost. 2025 will see a continuous growth in the capabilities of medical AI, including advances in precision medicine which one day, will totally change the entire paradigm of medical care and treatment of patients.

But often AI is a new technology that introduces new risks. Its data, its algorithms, and its applications all need to be secured from new types of cyberattack, including data poisoning and adversarial machine learning. AI is also being used to weaponize existing malware strains and employed to attack victims by making that malware stealthy, almost impossible to detect, and deadly when its payloads are deployed on unsuspecting networks. 2025 will likely see the continued development of offensive AI attack tools by hackers. At the same time security software companies will be engaged in an arms race to quickly develop defensive AI capabilities in their NDR, XDR and other security applications. Cylera, as an example, and as a next generation IoT security platform, has invested heavily in AI since the company’s founding. It continues to build and deploy new and enhanced AI capabilities that help to automate the orchestration of improved cybersecurity for customers. We will see a lot more AI in 2025 along with better automated security tools and platforms with much faster-than-human response times and the need for less intervention.

Cybersecurity Resource Shortage

 

The shortage of security professions reached 4.8 million in 2024, a growth of 19% over 2023. There simply aren’t enough soldiers to defend the fort against a rising number of attacks. In fact, according to the World Economic Forum, the global talent shortage, could reach 85 million workers by 2030. While universities and training academies have stepped up their education offerings in cybersecurity, it will take many years before this shortage is addressed – if ever, given rising needs.

Burn-out and retention of cybersecurity professionals is a growing problem as the job of defending an organization, sometimes against truly overwhelming odds, becomes even tougher. The ‘Buck’ really does stop at the CISOs desk, yet CISOs remain relatively unempowered to make decisions around enterprise security risk. Many security leaders still lack direct access to the board to properly relay cyber-risk, despite years of industry groups telling CEOs they need to do so. That is slowly changing, and 2025 will likely see an evolution in the partnership between CISOs and their boards.

While job satisfaction and not feeling ignored remain critical for retention, so too does work-life balance for security teams and their leaders. ‘Return to the Office’ for many, has done little to off-set the practice of working around the clock, something that started during the COVID pandemic, covering for sick collogues and dealing with a huge uptick in security needs. It’s important that security teams and their leaders feel needed and respected yet empowered by senior management not to feel the need to work every weekend. Achieving better work-life balance will be a major objective for many security leaders in 2025.

In Conclusion

2025 will be an evolution of what we saw in 2024 rather than any sort of revolutionary change in January. Domestic and international politics may have a significant role to play in both attack and defense, as both sides re-arrange their players and adjust their cyber strategies. The healthcare security threat surface will continue to expand as more and more devices and applications connect to medical networks and interoperability between healthcare systems continues to advance. Diligence will be critical, as will visibility and understanding of risk. Automation of security tools will become ever more important, as the shortage of people to watch screens becomes critical, and various forms of AI will likely play an increasing role in both healthcare applications and security.

This blog was first posted at the following location.

Read More