Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

4/5/2018
05:01 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Supply Chain Attacks Could Pose Biggest Threat to Healthcare

Healthcare organizations often overlook the supply chain, which researchers say is their most vulnerable facet.

Healthcare organizations often overlook the part of their operations where they are most vulnerable. Supply chain attacks pose a greater threat than exposed medical devices, report researchers who have analyzed the industry's risk since WannaCry hit in May 2017.

WannaCry may not have been built to target healthcare but the massive ransomware operation still left its mark on the industry, blocking National Health Service (NHS) trust hospitals from accessing patient records and forcing doctors to reschedule appointments and surgeries.

The profound effect on the healthcare industry prompted researchers at Trend Micro and the Healthcare Information Trust Alliance (HITRUST) to investigate healthcare network risks flying under the radar. They specifically looked into how supply chain cyberthreats, and exposed connected medical systems and devices, affected organizations' security posture.

Connected medical devices demand scrutiny as cybercriminals can take advantage of their exposure to break into organizations, run botnets, take data, or launch ransomware attacks.

"There's definitely more devices now, and wider exposure brings a greater landscape, greater aperture for attack," says Greg Young, vice president of cybersecurity at Trend Micro. Confidentiality, integrity, and availability are always considered in device security but with healthcare devices, safety must be considered as well, he adds. It's not a stretch to recognize an IoT attack on medical devices could cause physical harm to patients.

Diagnosing Supply Chain Threats

Industries like telecom, financial services, and consumer technology know all too well the risk of supply chain attacks. As healthcare relies more heavily on supply chain vendors, third-party service providers, and cloud-based systems, its organizations are also recognizing the risk.

Attackers can abuse third-party goods and services to steal confidential information, change data, install malicious software, introduce an unapproved function or design, or bring counterfeit devices into the organization. The risk of supply chain attacks in healthcare has grown along with the number of devices as attackers see an opportunity to manipulate them.

Researchers highlight several entry points an attacker can use to compromise a hospital's supply chain. A key one is the device manufacturer; a hospital has no control over whether a device is tampered with during the manufacturing process. They also lack insight into the security of distribution centers, suppliers, software developers, and shipping companies.

"Globally, supply chain and counterfeit devices are an increased risk," says Young. Older, harder-to-patch devices, many of which aren't subject to protective inspections like a regular operating system, are a "stepping stone" into the rest of the IT environment.

The industry has started to buckle down on device security to prevent certain types of supply chain attacks. For example, the FDA now mandates Unique Device Identification codes for all medical devices. This code indicates a device's version, model, manufacturing date and batch number, expiration date, and serial number. All this data is entered in a global, publicly accessible database so patients can check if a device is counterfeit.

Ransomware Down, Targeting Up

Researchers found cybercriminals are narrowing their focus on the healthcare space, opting for more focused attacks as opposed to broader campaigns.

Young points out how ransomware attacks on healthcare organizations steadily declined between October and December 2017. High-risk indicators of compromise (IoCs) dropped from 4,330 to 2,354 between November and December, and total IoC have also declined from October through December. The shift is a sign that attackers are changing tactics.

"The broad splashing of random kinds of attacks is down, but how much they're targeted is definitely up," he explains. The number of ransomware families has been growing since 2012, with a major spike from 29 families in 2015 to 247 families in 2016, and 327 in 2017.

Massive campaigns waste resources and are more likely to be tracked, says Young. Cybercriminals are using specific attacks to maximize their impact on each organization. For example, if they know an organization has a Windows 10 environment, they'll use a Windows 10-based attack.

"My own belief is the level of targeted attack is increasing more rapidly than the granularity of defenses," he notes.

Healing Healthcare Security

Young warns not to get too distracted by healthcare-specific needs. Patching, response capabilities, and monitoring are essential: "Those are the basics and the things almost everybody gets wrong today, but those are the high-impact areas," he says.

It's also important to pay attention to non-medical IoT devices entering the hospital, which could also prove a risk. Smart televisions in patients' rooms, smartboards, or smart devices in labs that aren't part of normal testing could all be a jumping-off point for attack.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18954
PUBLISHED: 2019-11-14
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious at...
CVE-2019-3640
PUBLISHED: 2019-11-14
Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity.
CVE-2019-3661
PUBLISHED: 2019-11-14
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads.
CVE-2019-3662
PUBLISHED: 2019-11-14
Path Traversal: '/absolute/pathname/here' vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to gain unintended access to files on the system via carefully constructed HTTP requests.
CVE-2019-3663
PUBLISHED: 2019-11-14
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system.