In my previous blog post, Why Healthcare Organizations are Easy Targets for Cybercrime, I discussed various reasons that hospitals and healthcare organizations make desirable and lucrative targets for hackers. In this second installment, I’ll go over how criminals are attacking these organizations, the methods they use, and also what needs to be done to begin to address this dangerous threat.
Medical Device Compromise
As I mentioned in my first blog on this topic, there is a wide array of connected medical devices in a hospital environment. These devices can be classified into 5 broad categories:
- Consumer wearables, such as sleep pattern monitors, fitness trackers, etc.
- Patient monitoring devices, including insulin pumps, ECG, heart rate monitors etc.
- IVD, blood analyzers, etc.
- Embedded devices, such as pacemakers and implants
- In-house equipment, like medicine dispensing systems, MRI, CT, and X-ray machines, etc.
Devices like these can he hacked in an alarming number of ways. In addition to attacks that could endanger patients’ lives, such as remotely tampering with pacemakers or insulin pumps, these devices may be exploited to enable data theft or to gain access to other hospital infrastructure or systems. In one example from 2017, penetration tester Saurabh Harit managed to compromise a digital pen used for writing prescriptions, which gave him access to a patient database and scans of each prescription.
Learn how can endpoint protection help you secure your business.
Data Breaches
Medical data is a valuable commodity that is openly traded on the dark web. Although hackers and automated malware are often to blame, old-fashioned user error can play a major role in these types of compromises. Phishing remains a preferred method for stealing data and infiltrating networks.
Some examples of stolen medical data include:
- Patient data. Identity and insurance fraud are relatively easy when you have access to the kinds of data medical organizations store about their patients. Additionally, this information can be used to charge expensive medical procedures, claim prescription drugs, or be exploited to breach other organizations outside of the healthcare industry. It can even be used for personal extortion and a host of other crimes.
- Administrative paperwork. Criminals may target medical licenses to forge prescriptions and commit other types of fraud or extortion.
- Prescription information. Criminals may forge prescriptions or drug labels and use them for purposes like fraud and even drug smuggling.
- Biometric data. As biometrics are increasingly used in security measures and law enforcement practices, records of fingerprints, ocular scans, and even heartbeats could be stolen and used for nefarious purposes.
Ransomware
Because the services that medical facilities provide are essential and often cannot be disrupted without serious risk to patients, ransomware is a weapon of choice. Many organizations have no choice but to pay the ransom, and some health facilities have had to shut down permanently due to these attacks.
Medical facilities worldwide have turned patients away, curtailed or suspended services, and even closed as a result of ransomware attacks. The groups that carry out these attacks have typically done recon on their targets to discover exactly how to breach them and which systems to encrypt to cause maximum disruption.
Of course, when we talk about ransomware affecting healthcare organizations, one attack stands out above them all: WannaCry. This nasty threat spread like wildfire across the world in 2017 and crippled many organizations through a combination of lateral wormlike propagation and machine-wrecking encryption. One of the largest and most publicized victims was the U.K.’s National Health Service. The attack “disrupted services across one-third of hospital trusts and around 8% of GP practices,” according to a report published by the NHS a year later. On top of that, ambulance services were affected and over 19,000 appointments were cancelled.
Despite the financial gains to be had when attacking healthcare organizations, WannaCry was actually an example of a cyber-weapon spreading far beyond its intended targets; the attack was not specifically aimed at the NHS or other health orgs affected.
Ultimately, WannaCry really highlighted the poor security practices prevalent in so many healthcare organizations. The NHS fell under a lot of scrutiny in the aftermath of the attack, particularly as Microsoft had issued a Windows® update that would have fixed the exploited vulnerability months before. Since then, the health service has undertaken a number of changes to shore up defenses.
The Stats
According to a survey of industry Chief Information Security Officers (CISOs) by Carbon Black, the state of cybersecurity in healthcare is somewhat bleak, if unsurprising.
- 83% of surveyed healthcare organizations said they’ve seen an increase in cyberattacks over the past year.
- Two-thirds (66%) of surveyed healthcare organizations said cyberattacks have become more sophisticated over the past year.
- With increased adoption of medical and IoT devices, the surface area for healthcare attacks is becoming even larger.
- Limited cybersecurity staffing and stagnant cybersecurity budgets in the industry further compound the issues.
Other reports by security companies Thales and Fortinet paint a similar picture. A recent report in the HIPAA Journal puts data breaches at record levels in 2019.
What Needs to Happen
Healthcare’s poor track record when it comes to updates, patching and obsolete operating systems needs to be addressed—no question. Below are some of the other things that need to happen to improve security all around at hospitals and other healthcare practices.
- All staff members should be trained on security risks and best practices to avoid them.
- Medical device designers need to adopt security as a design principle ASAP.
- Hospitals and other facilities need to better audit and patch their devices, operating systems, applications, firmware, etc. to help eliminate vulnerabilities.
- Government initiatives and coordination are essential, not just for the public facilities they run but also for private practices.
- All healthcare practices should have antivirus and other cybersecurity solutions and should have access to security teams who can investigate any breaches to identify and address vulnerabilities.
- Access to devices, middleware, and APIs should be restricted where possible and secured.
And, finally, the “blame game” culture that pervades healthcare needs to be seen for what it really is: an obstacle to progress. Cybersecurity is a group effort that we should all share. From governing bodies to businesses to individual users, each of us has a role to play in creating a more secure connected world.
