Perimeter

4/5/2018
05:01 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Supply Chain Attacks Could Pose Biggest Threat to Healthcare

Healthcare organizations often overlook the supply chain, which researchers say is their most vulnerable facet.

Healthcare organizations often overlook the part of their operations where they are most vulnerable. Supply chain attacks pose a greater threat than exposed medical devices, report researchers who have analyzed the industry's risk since WannaCry hit in May 2017.

WannaCry may not have been built to target healthcare but the massive ransomware operation still left its mark on the industry, blocking National Health Service (NHS) trust hospitals from accessing patient records and forcing doctors to reschedule appointments and surgeries.

The profound effect on the healthcare industry prompted researchers at Trend Micro and the Healthcare Information Trust Alliance (HITRUST) to investigate healthcare network risks flying under the radar. They specifically looked into how supply chain cyberthreats, and exposed connected medical systems and devices, affected organizations' security posture.

Connected medical devices demand scrutiny as cybercriminals can take advantage of their exposure to break into organizations, run botnets, take data, or launch ransomware attacks.

"There's definitely more devices now, and wider exposure brings a greater landscape, greater aperture for attack," says Greg Young, vice president of cybersecurity at Trend Micro. Confidentiality, integrity, and availability are always considered in device security but with healthcare devices, safety must be considered as well, he adds. It's not a stretch to recognize an IoT attack on medical devices could cause physical harm to patients.

Diagnosing Supply Chain Threats

Industries like telecom, financial services, and consumer technology know all too well the risk of supply chain attacks. As healthcare relies more heavily on supply chain vendors, third-party service providers, and cloud-based systems, its organizations are also recognizing the risk.

Attackers can abuse third-party goods and services to steal confidential information, change data, install malicious software, introduce an unapproved function or design, or bring counterfeit devices into the organization. The risk of supply chain attacks in healthcare has grown along with the number of devices as attackers see an opportunity to manipulate them.

Researchers highlight several entry points an attacker can use to compromise a hospital's supply chain. A key one is the device manufacturer; a hospital has no control over whether a device is tampered with during the manufacturing process. They also lack insight into the security of distribution centers, suppliers, software developers, and shipping companies.

"Globally, supply chain and counterfeit devices are an increased risk," says Young. Older, harder-to-patch devices, many of which aren't subject to protective inspections like a regular operating system, are a "stepping stone" into the rest of the IT environment.

The industry has started to buckle down on device security to prevent certain types of supply chain attacks. For example, the FDA now mandates Unique Device Identification codes for all medical devices. This code indicates a device's version, model, manufacturing date and batch number, expiration date, and serial number. All this data is entered in a global, publicly accessible database so patients can check if a device is counterfeit.

Ransomware Down, Targeting Up

Researchers found cybercriminals are narrowing their focus on the healthcare space, opting for more focused attacks as opposed to broader campaigns.

Young points out how ransomware attacks on healthcare organizations steadily declined between October and December 2017. High-risk indicators of compromise (IoCs) dropped from 4,330 to 2,354 between November and December, and total IoC have also declined from October through December. The shift is a sign that attackers are changing tactics.

"The broad splashing of random kinds of attacks is down, but how much they're targeted is definitely up," he explains. The number of ransomware families has been growing since 2012, with a major spike from 29 families in 2015 to 247 families in 2016, and 327 in 2017.

Massive campaigns waste resources and are more likely to be tracked, says Young. Cybercriminals are using specific attacks to maximize their impact on each organization. For example, if they know an organization has a Windows 10 environment, they'll use a Windows 10-based attack.

"My own belief is the level of targeted attack is increasing more rapidly than the granularity of defenses," he notes.

Healing Healthcare Security

Young warns not to get too distracted by healthcare-specific needs. Patching, response capabilities, and monitoring are essential: "Those are the basics and the things almost everybody gets wrong today, but those are the high-impact areas," he says.

It's also important to pay attention to non-medical IoT devices entering the hospital, which could also prove a risk. Smart televisions in patients' rooms, smartboards, or smart devices in labs that aren't part of normal testing could all be a jumping-off point for attack.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17182
PUBLISHED: 2018-09-19
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations...
CVE-2018-17144
PUBLISHED: 2018-09-19
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...