Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
1/25/2018
09:00 AM
Raymond Pompon
Raymond Pompon
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Avoiding the Epidemic of Hospital Hacks

Lessons learned about cyber hygiene from inside one of America's highest ranked medical institutions.

On January 9, 2005, the Donttrip malware infection hit Northwest Hospital, a large medical facility in Seattle that served thousands of people. The malware clogged up the hospital’s network systems with surges of exploit network scanning. Medical operations ground to a halt as laboratory diagnostic systems couldn’t transfer data. Intensive Care Unit terminals went offline, internal pagers were silenced, and even the automatic operating room doors were locked down.

The IT team bailed valiantly against the sinking ship, but as soon as they cleaned a machine and put it back on the network, it got re-infected. Staff moved to implement disaster recovery processes, using manual or backup systems to bypass the affected systems. The quality of patient care was diminished, but no lives were seriously endangered, and the hospital weathered the storm. The FBI swooped in, eventually arresting the guilty parties, and the word went out: hospitals can be affected by cyber incidents.

That was over 12 years ago. Have things improved?

In April 2017, a 1,000-bed hospital in Buffalo, New York was virtually shut down by a ransomware attack. Then on May 12, the WannaCry ransomware pounded through Europe like a tsunami, leading to substantial IT outages. WannaCry was particularly devastating to UK’s National Health Service, disrupting over a third of health-serving organizations at 603 primary care facilities. With the proliferation of complex IT in healthcare on highly critical but widely open networks, it is no surprise that their systems are at such high risk. Ransomware had proven itself as an existential threat to medical service delivery in modern hospitals.

I recently had a chance to observe the procedures from inside one of the highest ranked hospitals in America. As I was under their care, I couldn’t help but carefully watch and ask questions about their IT security procedures. I followed this up with some research into their security policies and incident histories. I found their cyber hygiene was of an equally high standard. There are also some good IT security lessons worth sharing.

I've written before about the insecurity of the Internet of Things, and during my hospital stay I had concerns about all the medical gear like scanners and monitoring devices hospital staff wheeled around and used on patients. It turned out that much of that equipment was air-gapped away from the main network. Most of this equipment was manually controlled, requiring a live operator to enter commands. Old fashioned, yes, but no malware was going to infect an IV feed and overdose a patient. To retrieve data, nurses used a very regimented manual process to capture and record readings from these systems. The amount of data captured was also very small, usually a short series of numbers, which reduced mistakes in the handoff. Over the course of weeks, I observed dozens of different medical professionals executing the same manual process in the same exact way.

In order to enter this data, the nursing staff needed access to wired data terminals. All the corridors and hospital rooms had a computer for data entry and retrieval. All these terminals required a login to access, and I didn’t see one that was left unlocked when unattended. Again, the staff was obviously well trained in locking their systems when leaving. When not logged in, each terminal displayed screen savers showing security awareness and anti-phishing warnings.

It’s no surprise that medical personnel could be well trained and disciplined in following detailed instructions involving complex systems and tools. It was refreshing to see that this hospital put as much emphasis into their secure IT procedures as they did into their patient care processes. My review of their training materials also showed me that they made direct connections between security and patient care quality—a great way to link security processes to the organizational goals.

Nevertheless, being a security professional, I am always thinking about what can go wrong. So, I asked about the plan if the IT systems went down. A nurse told me that the hospital overstaffs with redundant personnel on every shift so they can backfill for emergencies. I could see the value in this. Not only is this insurance against IT disasters but also any kind of medical emergencies when additional personnel may be needed. It may cost extra in the daily operational budget, but it’s worth it to fulfill the mission of the organization (that is, save lives).

In addition to the processes I was directly exposed to, I was given an opportunity to review a lot of the hospital’s security policies and training materials. I was pleased with what I found. There was a method for securely leveraging BYOD smartphones and tablets, as well as two-factor remote access. Both disk and network encryption were placed throughout the entire infrastructure. And there was an appropriate emphasis on asset management and vulnerability testing. They were doing everything they were supposed to be doing.

The most significant thing that struck me was the emphasis on disciplined process that covered the entire staff. I’ve always felt that strong process around key controls was a game changer in maintaining a secure organization. As they say: it’s always the simple things, but the simple things are hard.

Get the latest application threat intelligence from F5 Labs.

 

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.