Hospitals Targeted by Cyber Attack During Covid Crisis

Cyber-criminals and pariah nation-states are taking advantage of the disruption caused by the pandemic to run amok. 

Few things elicit the question of ethics than a lawyer chasing an ambulance leaving a road traffic accident or a hacker targeting a hospital during a global crisis, but the latter is precisely what has been happening since February.

The public and government officials alike, are outraged that cyber criminals would target health systems during a time of global pandemic crisis.

Increase in Cyber Attacks Against Healthcare

As our brave doctors and nurses fight each day to save lives those infected with the coronavirus, hackers and pariah nation-states fight each day to break into our health systems and research centers working on a vaccine or a cure. Ironically, both the virus and many of those engaged in the theft of research into a vaccine appear to come from the same country.

Photo: H.Shaw

 
Between the months of February and May of this year, there have been 132 reported breaches of healthcare covered entities, according to the HHS. This is an almost 50% increase in reported breaches during the same time last year. Perpetrators appear to be taking advantage of a distracted often remote workforce easily susceptible to phishing and other scams, or gaining access to hospital networks through insecure medical devices and other healthcare IoT systems. "These systems are notoriously difficult to secure and are an acknowledged cybersecurity risk," claimed Tim Ozekcin, CEO of biomedical security company, Cylera.

In a letter this week signed by international political and business leaders, the International Committee of the Red Cross called for governments to take “immediate and decisive action” to punish cyber attackers.

“There are more and more cyberattacks...on the healthcare sector and unless there are really strong measures taken, they will continue,” said Cordula Droege, chief legal officer at the ICRC. “What we’re seeing at the moment are still indications of how devastating it could be.”

Also this week, NATO, issued a statement condemning the "destabilising and malicious cyber activities directed against those whose work is critical to the response against the pandemic, including healthcare services, hospitals and research institutes. These deplorable activities and attacks endanger the lives of our citizens at a time when these critical sectors are needed most, and jeopardise our ability to overcome the pandemic as quickly as possible."

Invoking its founding principle of Collective Defense and its’s more recent Cyber Defence Pledge, NATO confirmed that it is ready to take action against the perpetrators of these cyber attacks.

"Reaffirming NATO's defensive mandate, we are determined to employ the full range of capabilities, including cyber, to deter, defend against and counter the full spectrum of cyber threats," NATO said.

The World Health Organization has reported a 500% increase in cyberattacks on its systems during the spread of the Coronavirus pandemic through April compared with the same period last year, and has been dealing with a major email security breach at the same time while trying to deal with the largest pandemic to hit the world on over a century.

So far this year, the U.S. Department of Health and Human Services has investigated 177 data-breach incidents at medical organizations, nearly double the 91 under investigation in the same period in 2019.

Photo: Lianhao Qu

Opportunistic Rise in Cyber-Crime

Cyber-crime appears on the rise everywhere while most of us are out of our comfort zone working from home or otherwise disrupted. According to the FBI, the number of reported cybercrimes has quadrupled for the period of December - April compared to the same period last year. The FBI’s Internet Crime Complaint Center, known as the IC3, has been swamped with 3 to 4 times the usual number of calls each day as COVID-19 spread across the United States.

According to Tonya Ugoretz, Deputy Assistant Director of the FBI Cyber Division, "there was this brief shining moment when we hoped that, you know, 'gosh cyber criminals are human beings too,' and maybe they would think that targeting or taking advantage of this pandemic for personal profit might be beyond the pale. Sadly, that has not been the case," she reported.

The US FTC has reported that approximately $12 million has been lost due to Corona-virus-related scams since January. But it’s not just the US that has been targeted either. One man in Singapore tried to abscond with €6.64 million from a European pharmaceutical company after taking an order for surgical masks and hand sanitizer that he had no intention of delivering. Thanks to the quick actions of Interpol and Singapore authorities the money was returned and the man arrested.

“We’re very concerned now that we have these very sophisticated actors - nation-states, particularly China and Russia - targeting Covid-19 research, treatment protocols and vaccine development,” said John Riggi, Strategic Advisor for Cybersecurity and Risk at the American Hospital Association.

The message to watch out for potential theft of intellectual property has gone out right across the industry, especially by sophisticated nation-state actors according to officials at a number of leading academic medical centers. "Its like we're fighting two battles at the same time - the Covid-19 pandemic and defending against an escalation in cyber attacks against healthcare, " claimed Chad Wilson, CISO of Stanford Childrens' Hospital.

Hundreds of fake domains have been registered by criminals with names to entice the unsuspecting to click a link to a coronavirus news site, health and well-being site, to a charity site supporting everything from animal shelters for abandoned pets to food banks for the suddenly unemployed. At least one has even attempted to purport to be part of the Centers for Disease Control in Georgia otherwise known as the CDC. And there have been a whole range of scam sites setup to supply N95 masks, rubber gloves and other personal protective equipment (PPE) where users place an order never to see any goods – only fraudulent transactions on their credit cards. Many hospitals have also been defrauded in similar ways, receiving sub-par equipment from mainly Chinese manufacturers or none at all.

Intellectual property theft especially at hospitals and research institutes working on investigation of the virus or potential vaccines for COVID-19 has also been rife, especially from so-called international partners, some of whom may have been already compromised. Nation-state-actors are focused on gathering information about the response of US states to the ongoing pandemic and the progress of the research on vaccines with more than one nation-state appearing to be involved.

Photo: CDC

Healthcare & Medical Research Targeted

Most alarmingly though, is a spate of targeted ransomware attacks against hospitals. Last month a number of Czech hospitals and medical research centers were attacked, by as yet unknown perpetrators in what is thought to be a combined infiltration-theft and ransomware attack. The attack breached one of the major Czech COVID-19 testing laboratories at Brno University Hospital in the city of Brno in Moravia. According to Reuters,“The country’s NUKIB cybersecurity watchdog said the attacks, designed to damage or destroy victims’ computers by wiping the boot sector of hard drives.” The similarity with Russian FSB and GRU attacks against Ukrainian and other targets last year would tend to indicate nation-state involvement as would the boot sector wiping first attributed to the Russian GRU's 'Not Petya' attacks.

 

Colorado Medical Center Hit

But ransomware attacks against hospitals have hit closer to home. At least one US hospital has been hit in the past week by ransomware that encrypted its entire EMR system and its local backups. This was not a random broadcast attack but one carefully crafted against a known Pueblo, Colorado hospital with a un-patched perimeter. The hospital and many of its IT systems are still off-line at the time of writing this post and patient care is still being impacted by the attack. Its website came back up as we were about to go to press with the following message to the community.

 

This represents a daring escalation by cyber extortionists and risks a very real response by the United States. A mere two days before Parkview was hit, Mike Pompeo, US Secretary of State warned that there would be "zero tolerance" for such attacks.

"As the world battles the COVID-19 pandemic, malicious cyber activity that impairs the ability of hospitals and healthcare systems to deliver critical services could have deadly results," Pompeo said. "Anyone that engages in such an action should expect consequences," he added.


Drawing a Line in the Sand

Whether the pandemic cyber-attacks are just highly opportunistic criminals with no moral compass, or are a deliberate escalation of the hybrid warfare executed by a few pariah nation-states that have been pushing the boundaries of acceptability over the past few years, the perpetrators are treading on very dangerous ground.

Attacks against national critical infrastructure risk a very different kind of response from governments the world over. Just over a year ago, the Israeli Defense Forces dealt a very firm blow to nefarious cyber actors planning an attack on Israel with an air strike that wiped out HamasCyberHQ flattening the building and all inside.

HAMAS CyberHQ. Photo: Forbes

The US has also taken out a number of cybersecurity adversaries with drone launched hellfire missile attacks in Syria over the past few years. In fact, the US has reserved the right to retaliate against cyber-attacks with military force since 2011. The prospects therefore, for those cybercriminal elements that deliberately target US hospitals and medical research facilities obviously don't look too good.

Whether, and how, the US and other countries decide to respond to attacks against life-sustaining critical infrastructure like hospitals and healthcare research is a topic of hot debate. One issue is the problem of attribution. It's difficult to positively attribute an attack to an individual or a group, especially when more sophisticated attackers are good at covering their tracks or leaving breadcrumbs that point to others. Its also time-consuming, meaning that many years can go by before the culprit of an attack can be finally identified and dealt with.

Once identified, however, there are a wide range of options open to governments, extradition being only one of them. The international rule of law is opaque at best and needs to meet different standards and evidentiary bars in each country and its respective legal system. Even then, some people are considered beyond the law due to their connections. Some countries, notably Russia and other former communist block states, lack extradition treaties with the rest of the world. Going after perpetrators via legal means in the Peoples Republic of China or North Korea is also senseless as they usually operate at the behest of the state, unlike Russia which employs freelance proxies in order to claim plausible deniability. Therefore, governments sometimes need to employ other methods, as Bobby Chesney the co-founder of the Lawfare blog and a highly respected figure in US national security circles, explained during a recent podcast. (Chesney is the Charles I. Francis Professor in Law at The University of Texas School of Law, where he serves as the Associate Dean for Academic Affairs and teaches courses relating to U.S. national security and constitutional law.)

According to Chesney, there are many perfectly legal avenues for US government agencies to pursue in the apprehension of cybercriminals that attack critical US Infrastructure, especially at a time of declared national emergency. "There is an unpublished line in the sand that if crossed could mean significant consequences for those that do" he claims.

That includes a wide range of punitive measures including black ops, as Roman Seleznev the son of a close Putin ally who was widely regarded as being beyond the law in Russia found out in 2017. Renditioned to the USA, tried and convicted of cybercrimes in at least two different states, Seleznev has the next 27 years to look forward to as a guest of the US prison service.

Photo: NIST Cybersecurity Framework (CSF)

A Change of Focus

Recognizing that not all cyber attacks can be prevented, many CISOs are focusing more of their attention on the Detect, Response and Recover segments of the NIST CSF. Their focus is on limiting damage and restoring functionality as quickly as possible to minimize impact. "Every minute a critical hospital system is down could mean patient lives, so speedy restoration is critical," claimed Esmond Kane, CISO of Steward Health. "The fact that a breach occurred or a perpetrator was able to gain access to the network and HIT systems, is of secondary concern once systems are back up and running. We have to deal with that later" he adds.


Recovery from Attack

In order to turn the lights back on and restore systems following a cyberattack, a hospital must first eradicate all traces of the ransomware and other malware, then carefully restore data from off-site backup tapes or cloud storage. First, however, the malicious exploit and ransomware code must be identified, forensically preserved by law enforcement for later prosecution of perpetrators, and systems cleaned up and formatted. This can be very time consuming, taking many days and of course, will impact patient care and safety.

Perpetrators also know that thanks to better backup procedures following WannaCry, victims have comprehensive and disconnected backups of their data to avoid paying ransoms which would be illegal in many jurisdictions. Hence they are now executing combined infiltration-theft-extortion attacks, as was recently seen in the Czech Republic. Non-Public data is exfiltrated as part of the attack and when the ransomware clock runs out without a payment being made, a perpetrator will release some protected data to the public internet with a second extortion payment demand threatening to release more regulated PII and PHI data. This is similar to a recent REvil Attack against a Los Angeles celebrity law firm that claimed to have masses of dirty laundry on Donald Trump as well as contracts and other documents for celebrity clients.

Cisco's ZeroTrust Micro Segmentation

Containment and Risk Mitigation

While adoption of a Zero-Trust security framework and the implementation of network segmentation will severely limit the lateral spread of malware across a hospital network, one of the greatest recovery problems is the identification of sleeper malware or extraneous communications by that malware to command and control known as C2 severs. That's where Cylera’s MedCommand software comes into its element by quickly identifying suspicious network traffic, and tracing that traffic back to infected code that can then be eradicated from the network so that restoration of Health IT systems can commence.

Its just one more use of the Cylera MedCommand system. MedCommand identifies healthcare IoT (HIoT) connected assets, while profiling and risk assessing them for security group tag allocation and for network micro-segmentation under Zero Trust. A recent new feature also allows those who are responsible for managing medical devices and other HIoT assets to observe device utilization for better allocation of patients to available devices - something that has become critical when medical devices are short on supply and stretched to capacity under a global pandemic.

Covid patient in hospital isolation room

 

Read More

Covid-19 kills off 'Suprise' or 'Balance Billing'

Surprise Billing is a major cause of bankruptcy each year

The despised practice by healthcare providers of ‘surprising billing’ where the gap between what your health insurance regards as a fair and equitable charge for services and what your medical provider actually charges for that service, has been essentially outlawed during the Coronavirus epidemic.

The Department of Health and Human Services which is providing emergency funding to providers during the crisis, has tied millions of dollars in payments to its terms. Those state: "For all care for a possible or actual case of COVID-19, the provider will not charge patients any more in out-of-pocket costs than they would have if the provider were in-network, or contracted with the patient's insurance company to provide care.”

The agreement is posted on the HHS.gov page.

"HHS broadly views every patient as a possible case of COVID-19," the guidance states. "The intent of the terms and conditions was to bar balance billing for actual or presumptive COVID-19," an HHS spokesperson said late Friday. "We are clarifying this in the terms and conditions."

Many states have for a long time outlawed the practice of balance billing but some states have failed to legislate this.

HHS might have done with fine print what Congress and the White House could not do — despite bipartisan support and public outrage at the practice.

Photo: Vladimir Solomyani

Surprise Billing

Surprise billing often occurs when a patient goes to an in-network hospital for a procedure, but an out of network physicians or anesthetist is involved in the operation attempts to bill the insurance a rate much higher than the agreed upon in-network rate for his or her services. Insurance declines anything over the agreed upon rate and the patient is left footing the bill. This places the patient who was unaware of and wasn’t asked to approve any out of network services, up the proverbial creek without a paddle.

Balance billing which can sometimes amount to hundreds of thousands of dollars, is financially devastating for patients and a major cause of bankruptcy in the United States. The practice is outlawed in many states but has yet to be outlawed nationally despite bi-partisan support in Congress, thanks in part to the immense corrupting power of the healthcare lobby.

According to patient advocacy groups, certain lobbying groups later revealed to be connected to physician staffing firms owned by profit-driven private equity companies, spent millions last summer to buy political ads that targeted members of Congress who were working on legislation to end surprise billing.

Whether the fault of balance billing lies with insurance companies paying too little to cover procedures, or with some healthcare providers charging more than what insurance calls ‘market rates’ for their services, has been the subject of intense debate for years. Law suits and several media expose’s have embarrassed greedy providers and stingy insurance companies into rectifying their wrongs, but most of the media’s ire has been directed at for-profit health systems that attempt to shift costs from a growing number of Medicare and Medicaid patients where reimbursements are fixed (take it or leave it) to those with insurance who are not protected by the government from predatory billing practices.

Given the trillions of dollars currently being spent by the government on healthcare through the current epidemic, and the need to invest heavily for future pandemics, federal public health spend is at an all-time high and probably will be for the future. Not since the Second World War has the federal government surpassed insurers and individuals in the funding of critical health services to the American people. Given the rising grey tide of retirees claiming Medicare, and popular support for a universal safety net of public health services among Millennials and others, COVID-19 may have brought about some fundamental changes in health coverage and national health policy.

Read More

Business Continuity and Securing a Remote Workforce during a Pandemic Crisis

How to survive the transition from two office locations to 25,000 and still remain secure.

The COVID-19 pandemic has critically changed the traditional concept of work for a major part of the workforce, possibly forever, as office staff work from home, and traveling salesmen work opportunities by video conference with customers. But what are the implications of this change for corporate cybersecurity and how can CIOs and CISOs adapt their technology infrastructure and cybersecurity controls to this new reality? These are just some of the questions that my panel was asked to address in a recent virtual cybersecurity conference on the challenges of working through an epidemic.

With ‘Stay at Home’ orders in effect across most of the world, this of course means that many customer-facing businesses are suffering. It’s certainly not a good time to be in the airline, hotel, or restaurant business as nearly everyone stays at home. Similarly, companies that have not completed their migration to the cloud and cloud-based services may be experiencing additional difficulties necessitating that remote staff VPN into the corporate network in order to access legacy client-server systems and applications.

And of course, the COVID-19 Pandemic since its humble beginnings in Wuhan China and subsequent spread around the globe, has reaped massive emotional and economic distress, as well as the deaths of thousands, and the making of millions more sick. Whether the recent relaxation of lockdowns in China and elsewhere is a permanent condition or results in a second wave of infections remains to be seen, but the global pandemic will have lasting effects on globalization and supply chains for critical medical and other supplies. It may also permanently change the way many of us work.

Photo: William Manuel Son

The King is dead. Long live the king!

Is there really a need for companies to continue to rent expensive downtown city offices? Is it really necessary for your employees to sit in their cars each day for two hours commuting to their cube through noxious traffic pollution, or be confined to a cramped subway or train car with potentially lots of disease-carrying passengers? It took Spanish Flu 18 months to work itself out, so Trumpian notions of a full return to what was ‘normal’ in a few weeks, is unlikely even by the greatest optimists. The bigger question is do we really want to return to the way things were just for the sake of it? I would suggest not.

Now that the cat is out of the bag, and bosses have seen that their staff work just as well from home, if not more productively than from their office cubes, the argument to keep things the way they are today, suddenly has a lot more weight.

Photo: Mike Von

What Questions Should You Ask?

How should you go about securing tens of thousands of staff now working from their patios, dining room tables, or home offices, connecting to your applications and infrastructure via an over-taxed VPN back to the nearest corporate office?

How can you ensure that your staff’s home wireless internet connection is not being snooped upon if they are not encapsulating and sending everything over the VPN? Do you insist that your staff's home network is running WPA2?

Do you even know if split tunneling is enabled in your VPN and what happens when that employee needs to print something to their home printer and has to disconnect from the VPN?

Have you put in place policies for remote access such that staff are expected to update firmware on their $50 cable modem or DSL router and are they even required to change the default password on these devices?

Do you provide your staff with Integrated Services Routers (ISRs) to connection back to corporate and for VOIP calling?

Do you provide staff with a laptop running a locked-down application stack with your security tools installed? Taking home the office workstation may not be an option and trying to purchase laptops in times of mass demand is becoming almost impossible.

Do you allow your staff to use their own (BYOD) computers to access your applications and data, and if so, what do you require in the way of AV, patching and acceptable use on these machines?

These and other questions were put to my team of security subject matter experts who joined me on virtual stage for a special CTG Intelligence conference on remote business working during Covid-19. Their answers and shared insights may help you to prepare for the new ‘normal’ for as long as it lasts.

https://youtu.be/0ukVUYc4g4M

The panel includes:

Richard Staynings, Chief Security Strategist at Cylera, out of Boulder, CO, USA
Page Jeffrey, Cyber Security Consultant at Trace3, out of Colorado Springs, CO, USA.
Luke McOmie, CxO Advisor Offensive Security at Coalfire out of Westminster, CO, USA.
Steve Harrington, Managing Director at Masergy out of London, UK.
Tanya Walters, Independent Cyber Operations Advisor out of Phoenix, AZ, USA.
Anthony Dezilva, Dir. CxO Services out of Scottsdale, AZ, USA.

Read More

The growing need for Artificial Intelligence in healthcare

Healthcare needs AI and ML.

The author and other experts, discuss the growing need for Artificial Intelligence in healthcare for everything from clinical decision support to administration / revenue cycle and cybersecurity. 

Machine learning algorithms are already transforming healthcare and security tools like Cylera MedCommand, but there’s an arms race with cyber-criminals where having the right tools to identify and block an attack is becoming critical.



See the full HIMSS AsiaPac Interview


See also The Impact of AI and HIoT Related Threats from the HIMSS Show Daily

See also AI Will Radically Change Healthcare Security my keynote from HIMSS AsiaPac19

Read More

HHS in Targeted Cyber Attack

A recent attack against U.S. Health and Human Services is a lesson to us all to better manage cyber risk in a healthcare environment

The U.S. Health and Human Services Department suffered a cyber-attack on Sunday night according to Bloomberg that appears to have been purposely intended to disrupt its computer systems, and thus an attempt to undermine HHS’s response to the coronavirus pandemic gripping the country. The attack which occurred just before midnight involved overloading HHS servers with millions of hits over several hours and may have been an attempted distributed denial of service attack (DDOS). Initial investigations appear to suggest that the attack may have been the work of a foreign actor. A number of news outlets are pointing the finger towards Russia, however it may take weeks or months for a full forensic investigation before the cyber attack can be accurately attributed.

The fact is that during a healthcare crisis and a huge influx of sick patients, the resiliency of hospital and clinic IT systems becomes even more important to ensure patient survivability. Recognizing this, and with an expected escalation of threats during a national crisis, HHS had recently implemented an expanded risk-based approach to cybersecurity assessment of threats, vulnerabilities and controls.

“HHS has an IT infrastructure with risk-based security controls continuously monitored in order to detect and address cybersecurity threats and vulnerabilities," said Caitlin Oakley, a spokeswoman for HHS.

While this ‘risk-based’ approach to cybersecurity worked in HHS’s favor to protect it from cyber attack and to keep critical services up and running, most health systems are not so lucky. Many are still following a ‘controls-based’ approach to security, ignorant of the actual cyber-risks in their hospitals and clinics from devices they may think are safe from attack, but which have never been tested or even profiled, let alone risk-assessed.

According to an investigation conducted by Cylera last year, more than 90% of US hospitals and clinics do not have a current and accurate inventory of all IT and IoT assets that connect to their networks. This includes not only workstations and servers, but also BYOD devices like personal phones and tablets, network connected building management systems that control elevators and air conditioning, and a rapidly growing number of medical devices, many of which are managed by third-party vendors and have never been patched.

"When your patients are relying upon you to provide medical services and to possibly keep them alive through a pandemic, five, six, or seven nines availability* is an absolute must." said Richard Staynings, Chief Security Strategist with Cylera and HIMSS and AEHIS Cybersecurity Expert. "The last thing you want is for one of your un-assessed healthcare IoT devices to take down an entire hospital building or even a floor of your clinic. The availability of health IT and IoT systems is critical to the way we treat patients in today’s digital healthcare service no matter where you live or where you go to seek treatment or to get help with breathing." he added.

Automated tools like Cylera MedCommand, make extensive use of AI and ML to thoroughly risk-assess medical and other devices so you can understand risks and implement compensating security controls before something bad happens.

MedCommand' provides clinical engineering and information security teams with a unified solution to manage and protect the entire connected HIoT environment including medical devices, enterprise IoT, and operational technology.

Cylera has partnered with leading healthcare providers, experts, and peers to develop one the most comprehensive and integrated HIoT security solutions available for healthcare.

Learn more about the company's innovative AI based approach to medical device and other HIoT endpoint management at https://www/cylera.com

* Five nines availability indicates the expected uptime of a system i.e. 99.999% availability, (roughly 5 minutes per year). Similarly, seven nines would be 99.99999% uptime equating to 3.16 seconds downtime per year.

Read More

Medical Wearables and HIoT

Patient Safety in the era of medical wearables and Healthcare IoT: Is new technology helping us to stay healthy or introducing risks?

Medical Wearables.

Most of us now wear some form of fitness tracker and many hospitals and insurers are utilizing this 'personal health data' to supplement 'provider data' in our overall healthcare management. The volumes of healthcare data on each of us is staggering and is critical for our health management and overall well-being as patients. But what happens when that data is compromised, changed or deleted?

Like it or not healthcare delivery is more reliant upon technology today than ever before to diagnose, treat, observe, manage and monitor patients. A basic systems outage is enough to bring an entire hospital or clinic to its knees. Just look at what happened in the UK when Ransomware took down much of the NHS.

But our technology reliance is not just focused on IT systems any longer, there are a multitude of different Healthcare Internet of Things (HIoT) devices that we use to improve patient outcomes. All kinds of medical devices, from IMDs, to network connected pumps and scanners, to patient and nurse call systems, all of which are critical in direct patient care. And let’s not forget, that we cannot do without HVAC systems, elevators, power, water and other hospital building management systems, nearly all of which are now ‘smart’ and ‘connected’, often managed by business partners from thousands of kilometers away via the Internet.

What happens when these simple devices are attacked by extortionists and cyber-criminals? Does anyone even know how many HIoT devices are connected at each location, let alone when they were last patched and what security risks they pose to patients and to hospital IT systems? Just because they may be connected to an isolated network or VLAN doesn’t mean they are enclaved or segmented as far as security is concerned.

How can we gain greater visibility into what’s happening in our hospitals and become better prepared to defend ourselves from the next inevitable attack?

This was the subject of a recent presentation by the author to the HIMSS Australia Digital Health Summit in Sydney, NSW attended by many of the top thought leaders from across Australia, New Zealand and much of Asia.

The Author addresses the HIMSS Australia Digital Health Summit in Sydney. Photo: HIMSS

Medical wearables could prove to be a valuable asset in the fight to prevent on the onset of disease. Diseases that by and large, are very expensive to treat. Primary care physicians have been urging us all for years for better preventative care, yet in many countries there is still a financial disincentive to go see the doctor or a specialist. In the United States where High Deductible Health Insurance pushes patients away from seeing their care team till they have met their often massive deductible before receiving any benefits, and in the developing world where the choice is sometimes to see the doctor or feed the family for a week. A trip to the doctor is also considered as being inconvenient and time consuming by many - even when there is no charge. What better then, than to automate the monitoring and well-being of patients using simple ubiquitous tools like an Apple Watch, or a Fitbit, something that avoids having to go see the doctor and actively engages patients in their own well-being.

An Apple A Day Keeps the Doctor Away

An old adage claims “an apple a day keeps the doctor away”. It may originate from the days of scurvy and a general lack of fruits and vegetables in people's diet, but maybe there is some truth to the saying in today's hi-tech healthcare world.

Can an Apple on your wrist keep the doctor away?

A recent HIMSS survey claimed that 64% of surveyed patients might be more willing to wear an Apple Watch or a medical wearable if it means fewer trips to see the doctor.

A similar survey of hospital executives from HIMSS and AT&T found 47% of hospitals are providing wearables to patients with chronic diseases and are also conducting remote monitoring via in-home medical devices and smartphone apps.

Is this the future of regular health observation and maintenance? My Apple Watch already reminds me to get up and walk about several times a day when I have been busy sat typing or in meetings. Will future versions also tell me to cut down on my carbohydrate intake and to look for a less stressful job based upon my diet, activity levels, and heart rate?

The big question is, to what extent can consumer healthcare data be trusted as being accurate and not fudged to reduce health insurance premiums, and what should our health systems do to integrate that data into our medical record?

Australia's My Health Record.

In Australia the existing My Health Record (MHR) initiative will see the roll-out of new functionality in 2020 for apps to connect into the MHR. Australians already have the ability to view their complete medical record (unlike most other countries) so the hope is that this should be the primary place where Aussies go to check their healthcare activity and well-being. Its precisely this type of public-private partnership that will lead to improved patient outcomes and reduced spending on chronic diseases, or so its authors claim with some justification.

Consumer wearables like Apple Watches and Fitbits are just some of a huge wave of Healthcare Internet of Things (HIoT) devices that are being used to monitor, manage, diagnose and treat patients. In all but the smallest critical access hospitals, HIoT devices already well-outnumber traditional IT computers and other systems. The challenge for the industry is how to manage and secure such a broad range of fairly dumb devices at a time when the healthcare industry is under an increasing number of cyber attacks.



How should Healthcare Executives go about securing their HIoT?

Managing traditional HIT assets like servers, laptops and workstations is a touch job in a healthcare environment because of a lack of standardization and the need to run so many different versions of operating systems and legacy applications. Trying to manage hundreds of thousands of discrete HIoT devices is near impossible without the right tools. The first problem is that most healthcare providers have no idea how many devices they own, rent, or have connected to their networks, nor the risks that each of them poses to patient safety or other network assets like the EMR, so this is where we need to start.

The following workflow may be useful as a guide:

• Identify Assets – Most hospitals don’t know what they have!

• Risk Assess those HIoT Assets to NIST 800-30 or similar standards for compliance

•      Identify CVEs and Zero-Days, any known patches and apply

•      Beat up vendors for patches – some are better than others. Some are outright negligent. 

•      With hundreds of thousands of devices you will never be able to regularly patch them all!

• Identify and Map Legitimate Traffic Patterns – Ports, Protocols, IPs, etc.

• Construct a 'Zero Trust' white list of usual traffic patterns so that anomalous activities can be flagged and investigated or blocked

• Implement Micro-Segmentation as a compensating security control to protect patients and networks against devices that cannot be secured. Employ the Zero Trust white list to construct your NAC's Security Group Tags (SGTs) to automate protection.

What tools should you consider?

The good news is that this exercise is no longer a daunting labor-intensive manual process. There are first and second generation tools now available that can do this for you with varying levels of automation. Second generation tools like Cylera MedCommand, make extensive use of AI and ML to more thoroughly risk assess devices and seamlessly integrate to your existing asset management, GRC, SIEM and NAC technologies. Through a combination of passive and active security controls you can safely monitor and log traffic till you feel confident to turn your NAC to '
'active' or 'blocking' mode without having to worry that you may inadvertently isolate a device.

Cylera MedCommand.

'MedCommand' provides clinical engineering and information security teams with a unified solution to manage and protect the entire connected HIoT environment including medical devices, enterprise IoT, and operational technology.

The solution is built on Cylera’s 'CyberClinical' technology platform, which incorporates machine learning, behavioral analytics, data analysis, and virtualization techniques. Cylera has partnered with leading healthcare providers, experts, and peers to develop one the most comprehensive and integrated HIoT security solutions available for healthcare.

Learn more about Cylera's innovative AI based approach to medical device and other HIoT endpoint management at https://www.cylera.com.

Read More

A Healthcare Security Mismatch

Healthcare has undergone a radical transformation to digitalization and interoperability but has yet to secure or staff its new delivery model.

Richard Staynings, Chief Security Strategist with Cylera kicks off the Southwest Executive Security Round-Table in Houston with a morning keynote on ‘Patient Safety in the Era of Healthcare IoT’. Photo: Stephen McCollum.

The evolution of healthcare over the past 100 years from providing palliative care for the sick and the dying to today’s technology-intensive preventative model of health interventions has vastly improved the human condition, enabling us to beat diseases that used to ravage families and communities and to live longer and better than ever before. But digitalization has come at a cost as electronic health records (PHI), PII, and medical research IP, is easily stolen by perpetrators from around the world.

Healthcare is under attack, principally from well-funded and highly motivated outlaw nation states and organized criminal gangs who outnumber cyber defenders 5 to 1. "Its a big change from the script kiddies and hacktivists that we used to have to defend against ten or fifteen years ago," claimed Richard Staynings, who opened the day's events in Houston. "These are extremely well funded and equipped adversaries with military precision, intent on the theft of everything from western cancer research and clinical trials of new pharmaceuticals and medical procedures, to the PII and medical records of key individuals like VIPs, Presidents, and Prime Ministers."

Dr. Leanne Field from The University of Texas at Austin who also presented at the event, went on to describe how there is now a major mismatch between supply and demand for healthcare cybersecurity staff. Most hospitals and other health delivery systems are scrambling to attract and retain top cybersecurity talent. The trouble is, that healthcare cannot afford to pay the sort of salaries, stock, and bonuses that other industries like financial services can, and so is at a competitive disadvantage. Protecting healthcare also requires a different skill set from other industries because it is highly regulated and because of the life-threatening patient safety implications of poor cybersecurity in hospitals.

Highlighting the 2019 HIMSS Cybersecurity Survey Dr. Field outlined the top barriers faced by hospitals to mitigate and remediate security incidents. These include too many emerging and new threats, a lack of personnel with the appropriate cybersecurity knowledge and expertise, and lack of financial resources. In fact, until very recently, cybersecurity was not a priority for healthcare delivery organizations and so there is huge gap between current capabilities and where the industry should be, with a lot of catch-up and investment needed to bring security up to par.

However, according to the the Frost and Sullivan and (ISC)2 2017 Global Information Security Workforce Study by 2022 there will be approximately 1.8m unfilled cybersecurity positions globally. This looks particularly challenging for healthcare which badly needs to boost its cybersecurity ranks. In fact, the US Senate Cybersecurity Caucus led by Sen. Mark Warner (D. VA) recently expressed deep concern over healthcare cybersecurity workforce resource and sills shortages in a letter to all US health leaders, according to Dr. Field.

Emerging education programs at The University of Texas at Austin that focus specifically on healthcare cybersecurity may eventually help to address the skills imbalance, but with a steady escalation of attacks against the industry, the current gap between defenders and attackers is getting wider each year.

Healthcare is at a crossroads. Photo: Vladislav Babienko

"We are at a crossroads today in healthcare," said Staynings, "between old and new models of care but have yet to adjust to the reality of our new digital-integrated health model and what that means for patient safety and cybersecurity." The pieces are slowly conning together but delays and difficulties in protecting our patients and healthcare institutions introduce massive levels of risk. Risks that the industry cannot afford to take.

More information can be found here on graduate level healthcare cybersecurity programs at The University of Texas at Austin, or Dr. Leanne Field can be contacted via LinkedIn for questions https://www.linkedin.com/in/dr-leanne-field-87783023 or via The University of Texas at Austin at https://www.utexas.edu/

Read More

Cyber Risk Insurance Won't Save Your Reputation

A myopic focus on healthcare compliance has resulted in checkbox mentality, rather than a holistic risk-based approach to cybersecurity.

The financial and reputational costs associated with a security breach can be expensive and reputationally damaging. But in critical industries like healthcare, a cybersecurity attack could expose patients to some major safety risks that no amount of cyber breach insurance will likely fix.

Healthcare has historically had a myopic focus on privacy and protecting the confidentiality of patient information–largely caused by HIPAA, Caldicott, APA, PDPA, GDPR, and state breach rules. These have resulted in a skewed compliance-based approach to security by senior management and a 'checkbox mentality' of ‘have we done the minimum necessary’, rather than a holistic, risk-based approach to identify, protect, detect, respond, and recover from threats and vulnerabilities.

Risks change, and in healthcare those risks are changing quickly (as are legal liabilities and exposure to inadequate cybersecurity protection). CISOs, CROs, and GC/CLOs (General Council or Chief Legal Officers) are beginning to understand these changes and how cybersecurity posture and preparation are critical to protecting patient safety. Many of their bosses in the CEO seat are slowly beginning to understand not just their patient safety exposure in the age of digital inter-connectivity and cyber attacks, but also the potential impact on reputation.

“Cybersecurity is no longer a question of simple compliance,” said one hospital CEO at a recent US healthcare conference, “it’s about protecting the hospital’s reputation and ensuring patient safety while our systems are under attack and misbehaving."

"We purchased cyber risk insurance to cover all the un-budgeted costs associated with an attack. We keep our fingers crossed that we won’t need it.” he added.

But many insurers are now claiming that cyber attacks are an 'Act of War' and are therefore exempt from coverage under the terms of their policies, a fact that is currently being disputed in court by drug maker Merck and its insurers. So maybe the insurance, a company is counting on won't be there when really needed.

An OCR fine and the institution’s name being posted to the OCR 'Wall of Shame' is one thing, but patients being turned away or even held to ransom by cyber-attacks compromising medical devices are an entirely different order of magnitude!

Given our reliance today on HIT / HIoT systems to treat patients, there's a real risk that someone could die on us because critical systems are not available to diagnose and treat them following a cyber-attack. So too is the reputation hit when a hospital is forced to go on Full Divert following a cyber-attack as part of the British NHS had to when attacked by WannaCry in 2017. More recently, Campbell County Health in Wyoming, USA was forced to go on Full Divert following a similar cyber-attack.

“I would find it much more preferable to have HHS OCR camped out in my office examining all my papers following a breach, than the FBI walking the halls investigating a series of patient deaths at my hospital caused by a cyber-attack.” said a prominent San Francisco area CISO who preferred not to be named without clearing his statement with his employer. “One set of risks threatens executive jail time for wanton negligence, the other pretty much guarantees it,” he added.

“One set of risks threatens executive jail time for wanton negligence, the other pretty much guarantees it!”

Some years ago I did a walk-through of a hospital in Tasmania as part of its parent company’s risk assessment. The top floor was dedicated to a large and sprawling maternity department. Patient rooms with open doors and sleeping new moms and their infants lined either side of a wide corridor so nurses could come and go to check on both. Mothers and infants had similar plastic straps around their wrists with their name, D.O.B., and patient identifier. Neither were RFID-tagged. It would be very easy for someone to walk into a room, remove the sleeping child, and walk down the corridor to the elevator and take that straight to the underground parking complex. There was no physical security to stop them–only a few nurses moving in and out of rooms.

In our debrief, I asked the Obstetrician running the department what would happen if someone were to abduct a newborn. She protested at first to say that no one ever would, nor had anyone in the past – this was Tasmania - where there was a surplus of babies. But she did acknowledge that maybe this might be a problem in Sydney or Melbourne. After thinking about it for a minute, she announced, “In a small-knit community like ours, we would close! It would ruin our reputation and no one would come here to give birth again!”

The message here is that no amount of liability insurance is going to protect your reputation fully. It can cover costs for forensic investigation, breach notification, loss of business while down or recovering, and even for extortion payments if you are unable to recover critical data wiped out during a ransomware attack–but it can never cover what your customers think of you! Cyber risk insurance is valuable, but it’s no replacement for a well-functioning cybersecurity program.

Some of us continue to shop at Target following its massive breach of customer data some years ago, but most of us would never apply for a Target Card, nor would we ever consider using an email service provided by Yahoo for similar reasons!

“Once damaged, reputation is a big problem to fix” said the US hospital CEO. “It’s something that is becoming an increasing concern for all of us in healthcare. But how do you do that without spending a fortune on cybersecurity?”

Read More

The Evolution of Healthcare

The author presents to the HIMSS19 Eurasia Health IT Conference and Exhibition in Istanbul, Turkey

Healthcare has been transformed over the past century from a largely palliative care delivery model for the sick and dying to an advanced technology-infused and increasingly digitized integrated healthcare delivery model. Technology has fueled massive improvements in patient outcomes. It has enabled us to improve the human condition, to beat diseases that used to ravage families and communities, and to live longer and better than ever before. This was the subject of my presentation today at the HIMSS19 Eurasia Conference held in Istanbul, Turkey.

Increasing use of artificial intelligence and personalized genomic medicines will continue to push the boundaries of care forward in a highly positive way. But digitization comes at a cost, and that cost is in the form of new cybersecurity risks to the confidentiality, integrity, and availability of personal health data and the IT systems that are relied upon to provide care to patients. In fact, in today’s healthcare delivery model, clinicians would find it extremely difficult to maintain the current levels of patient care if health IT systems—and increasingly healthcare IoT—are not available to diagnose, treat, manage, and monitor patients.

The author between the Turkish Minister for Communications and the Deputy Minister for Healthcare
L->R: Ömer Fatih Sayan, Richard Staynings, Ömer Abdullah Karagözoğlu, Mette Harbo, Dr. Mehmet Bedii Kaya.

The number of connected IoT systems surpassed the global human population sometime around 2007-2008. Today, there are in excess of 20 billion IoT devices connected to the Internet, and most have little to no security designed into them at all! Estimates suggest that by 2050 there will be in excess of 1 trillion connected devices—many of them employed in healthcare.

With so many endpoints in our hospitals and clinics, how do we even go about tackling this expanded threat landscape? A good start is adopting a risk-based approach to healthcare security.

You can’t assess what you don’t know about, and with such a large number of medical devices and other HIoT systems used across healthcare, identifying even a basic inventory of IoT assets is an almost impossible manual task given the ever-changing number of connected devices.


That’s where tools like Cylera's MedCommand™ platform come in.

Cylera's MedCommand™ platform will identify HIoT assets, perform a full risk analysis of each device and device type, profile the legitimate traffic patterns of each device type for zero-trust security controls, alert on any anomalous traffic detected outside of legitimate traffic patterns, and even automatically remediate discovered risks with compensating security controls via a hospital’s existing network access control and/or firewall technology.

Cylera's Richard Staynings and Timur Ozekcin

Cylera is proud to be a sponsor of the HIMSS Eurasia 19 Conference

Read More

Presenting Cybersecurity to the Board

Don’t speak "geek" to the Board or you will receive a cool reception

At some point in our careers, many of us will be called upon to present to the board of directors. This could be to report the findings of an audit, compliance, or risk assessment. It could be to provide an annual or quarterly update on ‘the state of the union.’ It could be to report a recent incident. Or it could be to request support for a new initiative.

Whatever the case, presenting to the board is no straight-forward task—and newbies would be well advised to thoroughly prepare for this kind of appearance, which differs greatly from meetings with the C-Suite, peers, auditors, consultants, and technology professionals.

Board members are elected or appointed by a corporation’s shareholders to represent shareholder interests and to ensure that the company's management acts on their behalf. A board's mandate is to establish policies for corporate management and oversight, making decisions on major company issues. Every public company must have a board of directors, and in healthcare—regardless of whether that health system is "for-profit" or "not-for-profit"—boards almost always govern and provide oversight to the C-Suite.

Hospital board members are drawn from shareholders, investors, independent industry, and cross-industry experts, and often include academics and notable physicians. Overall, they are business people and know how to run a business. Most don’t understand or speak technology—they are from business/finance/physician backgrounds after all. And almost none will speak or comprehend "cybersecurity". In fact, some might even have a difficult time spelling it! They do, however, understand business enterprise risk, profit and loss, and cost of risk acceptance, transfer, and remediation.

When addressing the board, CISOs need to speak in the terms and language that board members understand, rather than the language used to report to the CIO or other members of the C-Suite. Failure to do so will result in the message being lost or largely unheard.

Most board members picked up what little they know of cybersecurity from articles they read in the Wall Street Journal and other periodicals. They lack the technology backgrounds and domain expertise to go deep to understand the technicalities of cybersecurity. So how do you establish a common language and communicate understandable metrics to the board? By translating cybersecurity risks and strategies into business risks and strategies in order to make it relevant to board members. You likely won’t get money for tools to tackle APTs, but you might get money to ensure the business stays up and running following an attack.

Richard Staynings presents to the VA HIMSS Annual Conference this week

This was the subject of a presentation I gave this week to the Virginia HIMSS Annual Conference in Williamsburg, VA, where 300 or so healthcare leaders from across the region gathered to learn and share best practices on healthcare management, technologies, security, risk, and compliance. And of course to raise money in a day of charity golfing at the beautiful Kingsmill Resort.


So what were some of the takeaways?


Make Cybersecurity Part of Broader Enterprise Risk Management:
Use similar language being used to describe other business risks for how you talk about cybersecurity. Senior executives and boards are very familiar with assessing the probability and negative impact of risks, establishing a risk tolerance level, and developing risk management plans. If you use the same approach and terminology, it will help them to understand the big picture and make more informed decisions about the actions you suggest.


Talk about Program Maturity:
Maturity models are embraced by senior management and the board because they are familiar with them from many other programs, like quality management. Use the same tactics and language to discuss cybersecurity.


People, Process, & Technology:
Help senior management understand that cybersecurity requires the orchestration of people, processes, and technology—and that they have a critical role in it. Security practitioners usually fail by myopically focusing on just technologies and tools.


Establish a Culture of Cybersecurity:
Get everyone on-board with the mission to secure the organization; from the Board and CEO all the way to Interns. Buy-in from department leaders is especially important in order to establish cross-functional support for security initiatives.


Standards and Frameworks:
Aligning the security program with a widely used security standard or framework allows you to benchmark the program against other companies and that standard. Inevitably, senior management is going to ask you, “how are we doing against other companies?” If your program can reference the NIST Cybersecurity Framework, ISO27001, or CIS CSC, you will be able to compare the maturity of your program with a broad, diverse group of companies.


Addressing the Board

• First impressions count, so dress and act appropriately. That means business formal— better to be over-dressed than under-dressed.
• Research every board member on LinkedIn or in the press.
• Get coaching from a board member or the CEO to understand what the board is looking for from you.

Define your Purpose

• What are you there for? Own it!
• Be succinct, honest, and direct—Corporate Chieftains don’t suffer fools gladly.
• Coach members on the basics but don’t treat them as fools—they don’t come from your world but they need to be educated on the basics in order to make informed decisions.
• Avoid the weeds—focus on the big picture and on business benefits, not security details.

Be Prepared

• If you are lucky you will get 5 to 8 minutes to make your case—plan and use the time wisely.
• Talk to the CEO or other executives beforehand to ask for tips and advice.
• Understand the CEOs broader agenda so you don't accidentally scuttle the big boss and do yourself out of a job at the same time.
  
• Prepare a well written brief and have the CEO’s admin print and bind copies ready for the meeting.
• Use maturity models and frameworks. This is what board members want to see. This is how they think!
• Understand how the company compares to others. Saying that something is simply a "best practice" won’t win you support.
• Anticipate questions—you’ll get lots. Be prepared with smoothly delivered confident answers.
• Be prepared for politics! Boards have their feuds and sub-agendas - try and see through the fog of war.
  

Be Strategic

• Boards are strategic, not tactical—so stay out of the details. That’s for the C-Suite to understand.
• Find metrics that tie into your mission for compliance, patient safety, up-time/availability, etc.
• Talk about reputation—it’s the board’s responsibility to protect it.

Avoid Surprises

• Boards hate surprises, so provide a pre-brief before the meeting to help them adjust to new information—especially if its bad information.
• If you do need to report a breach, focus your time on what you are doing and will do to mitigate or clean up from the attack.
  
• Keep things high-level and strategic—and above all business-focused.
• Avoid talking about specific technology, types of attacks, and especially acronyms which board member won't remember or understand.

End Result
At the end of the day, the board needs to feel confident that you as the CISO know what you are doing, and that the organization is in good hands. Presenting to the board is as much about you building your reputation with them, as it is about your program gaining the active support and sponsorship it needs in order to be successful in protecting the company.

 

Read More