Perimeter

4/5/2018
05:01 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Supply Chain Attacks Could Pose Biggest Threat to Healthcare

Healthcare organizations often overlook the supply chain, which researchers say is their most vulnerable facet.

Healthcare organizations often overlook the part of their operations where they are most vulnerable. Supply chain attacks pose a greater threat than exposed medical devices, report researchers who have analyzed the industry's risk since WannaCry hit in May 2017.

WannaCry may not have been built to target healthcare but the massive ransomware operation still left its mark on the industry, blocking National Health Service (NHS) trust hospitals from accessing patient records and forcing doctors to reschedule appointments and surgeries.

The profound effect on the healthcare industry prompted researchers at Trend Micro and the Healthcare Information Trust Alliance (HITRUST) to investigate healthcare network risks flying under the radar. They specifically looked into how supply chain cyberthreats, and exposed connected medical systems and devices, affected organizations' security posture.

Connected medical devices demand scrutiny as cybercriminals can take advantage of their exposure to break into organizations, run botnets, take data, or launch ransomware attacks.

"There's definitely more devices now, and wider exposure brings a greater landscape, greater aperture for attack," says Greg Young, vice president of cybersecurity at Trend Micro. Confidentiality, integrity, and availability are always considered in device security but with healthcare devices, safety must be considered as well, he adds. It's not a stretch to recognize an IoT attack on medical devices could cause physical harm to patients.

Diagnosing Supply Chain Threats

Industries like telecom, financial services, and consumer technology know all too well the risk of supply chain attacks. As healthcare relies more heavily on supply chain vendors, third-party service providers, and cloud-based systems, its organizations are also recognizing the risk.

Attackers can abuse third-party goods and services to steal confidential information, change data, install malicious software, introduce an unapproved function or design, or bring counterfeit devices into the organization. The risk of supply chain attacks in healthcare has grown along with the number of devices as attackers see an opportunity to manipulate them.

Researchers highlight several entry points an attacker can use to compromise a hospital's supply chain. A key one is the device manufacturer; a hospital has no control over whether a device is tampered with during the manufacturing process. They also lack insight into the security of distribution centers, suppliers, software developers, and shipping companies.

"Globally, supply chain and counterfeit devices are an increased risk," says Young. Older, harder-to-patch devices, many of which aren't subject to protective inspections like a regular operating system, are a "stepping stone" into the rest of the IT environment.

The industry has started to buckle down on device security to prevent certain types of supply chain attacks. For example, the FDA now mandates Unique Device Identification codes for all medical devices. This code indicates a device's version, model, manufacturing date and batch number, expiration date, and serial number. All this data is entered in a global, publicly accessible database so patients can check if a device is counterfeit.

Ransomware Down, Targeting Up

Researchers found cybercriminals are narrowing their focus on the healthcare space, opting for more focused attacks as opposed to broader campaigns.

Young points out how ransomware attacks on healthcare organizations steadily declined between October and December 2017. High-risk indicators of compromise (IoCs) dropped from 4,330 to 2,354 between November and December, and total IoC have also declined from October through December. The shift is a sign that attackers are changing tactics.

"The broad splashing of random kinds of attacks is down, but how much they're targeted is definitely up," he explains. The number of ransomware families has been growing since 2012, with a major spike from 29 families in 2015 to 247 families in 2016, and 327 in 2017.

Massive campaigns waste resources and are more likely to be tracked, says Young. Cybercriminals are using specific attacks to maximize their impact on each organization. For example, if they know an organization has a Windows 10 environment, they'll use a Windows 10-based attack.

"My own belief is the level of targeted attack is increasing more rapidly than the granularity of defenses," he notes.

Healing Healthcare Security

Young warns not to get too distracted by healthcare-specific needs. Patching, response capabilities, and monitoring are essential: "Those are the basics and the things almost everybody gets wrong today, but those are the high-impact areas," he says.

It's also important to pay attention to non-medical IoT devices entering the hospital, which could also prove a risk. Smart televisions in patients' rooms, smartboards, or smart devices in labs that aren't part of normal testing could all be a jumping-off point for attack.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Number of Retailers Impacted by Breaches Doubles
Ericka Chickowski, Contributing Writer, Dark Reading,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14500
PUBLISHED: 2018-07-22
joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter.
CVE-2018-14501
PUBLISHED: 2018-07-22
manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "m_id=1 AND SLEEP(5)" substring.
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.