Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
1/25/2018
09:00 AM
Raymond Pompon
Raymond Pompon
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Avoiding the Epidemic of Hospital Hacks

Lessons learned about cyber hygiene from inside one of America's highest ranked medical institutions.

On January 9, 2005, the Donttrip malware infection hit Northwest Hospital, a large medical facility in Seattle that served thousands of people. The malware clogged up the hospital’s network systems with surges of exploit network scanning. Medical operations ground to a halt as laboratory diagnostic systems couldn’t transfer data. Intensive Care Unit terminals went offline, internal pagers were silenced, and even the automatic operating room doors were locked down.

The IT team bailed valiantly against the sinking ship, but as soon as they cleaned a machine and put it back on the network, it got re-infected. Staff moved to implement disaster recovery processes, using manual or backup systems to bypass the affected systems. The quality of patient care was diminished, but no lives were seriously endangered, and the hospital weathered the storm. The FBI swooped in, eventually arresting the guilty parties, and the word went out: hospitals can be affected by cyber incidents.

That was over 12 years ago. Have things improved?

In April 2017, a 1,000-bed hospital in Buffalo, New York was virtually shut down by a ransomware attack. Then on May 12, the WannaCry ransomware pounded through Europe like a tsunami, leading to substantial IT outages. WannaCry was particularly devastating to UK’s National Health Service, disrupting over a third of health-serving organizations at 603 primary care facilities. With the proliferation of complex IT in healthcare on highly critical but widely open networks, it is no surprise that their systems are at such high risk. Ransomware had proven itself as an existential threat to medical service delivery in modern hospitals.

I recently had a chance to observe the procedures from inside one of the highest ranked hospitals in America. As I was under their care, I couldn’t help but carefully watch and ask questions about their IT security procedures. I followed this up with some research into their security policies and incident histories. I found their cyber hygiene was of an equally high standard. There are also some good IT security lessons worth sharing.

I've written before about the insecurity of the Internet of Things, and during my hospital stay I had concerns about all the medical gear like scanners and monitoring devices hospital staff wheeled around and used on patients. It turned out that much of that equipment was air-gapped away from the main network. Most of this equipment was manually controlled, requiring a live operator to enter commands. Old fashioned, yes, but no malware was going to infect an IV feed and overdose a patient. To retrieve data, nurses used a very regimented manual process to capture and record readings from these systems. The amount of data captured was also very small, usually a short series of numbers, which reduced mistakes in the handoff. Over the course of weeks, I observed dozens of different medical professionals executing the same manual process in the same exact way.

In order to enter this data, the nursing staff needed access to wired data terminals. All the corridors and hospital rooms had a computer for data entry and retrieval. All these terminals required a login to access, and I didn’t see one that was left unlocked when unattended. Again, the staff was obviously well trained in locking their systems when leaving. When not logged in, each terminal displayed screen savers showing security awareness and anti-phishing warnings.

It’s no surprise that medical personnel could be well trained and disciplined in following detailed instructions involving complex systems and tools. It was refreshing to see that this hospital put as much emphasis into their secure IT procedures as they did into their patient care processes. My review of their training materials also showed me that they made direct connections between security and patient care quality—a great way to link security processes to the organizational goals.

Nevertheless, being a security professional, I am always thinking about what can go wrong. So, I asked about the plan if the IT systems went down. A nurse told me that the hospital overstaffs with redundant personnel on every shift so they can backfill for emergencies. I could see the value in this. Not only is this insurance against IT disasters but also any kind of medical emergencies when additional personnel may be needed. It may cost extra in the daily operational budget, but it’s worth it to fulfill the mission of the organization (that is, save lives).

In addition to the processes I was directly exposed to, I was given an opportunity to review a lot of the hospital’s security policies and training materials. I was pleased with what I found. There was a method for securely leveraging BYOD smartphones and tablets, as well as two-factor remote access. Both disk and network encryption were placed throughout the entire infrastructure. And there was an appropriate emphasis on asset management and vulnerability testing. They were doing everything they were supposed to be doing.

The most significant thing that struck me was the emphasis on disciplined process that covered the entire staff. I’ve always felt that strong process around key controls was a game changer in maintaining a secure organization. As they say: it’s always the simple things, but the simple things are hard.

Get the latest application threat intelligence from F5 Labs.

 

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...