Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2015
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Healthcare Organizations Twice As Likely To Experience Data Theft

Bad guys very willing to invest in attacking medical data, but healthcare not very willing to invest in defending it.

Healthcare institutions are twice as likely to experience data theft than other sectors, and already see 3.4 times more security incidents, according to a study released today by Raytheon and Websense.

Why is healthcare so popular with attackers? Perhaps because the balance sheet tips in their favor. Medical records are very desirable on the black market, because medical records, themselves, may be a treasure trove of PII, financial information, and insurance numbers.

The exact figures vary, but while basic PII may run for just $1 on the black market these days, Jim Trainor of the FBI Cybersecurity Division told CBS News in February that "PHI records can go from 20 say up to -- we've even seen $60 or $70." A new report released by BitSight today references a recent report by NPR's "All Things Considered" which found a "value pack" of just 10 Medicare numbers that sold for about $4,700.

Yet, security measures that ensure those records stay confidential can inhibit patient care -- or at least that's how it seems to some medical professionals. Nurses and physicians fully understand the importance of data availability, but when patients' lives are on the line, data confidentiality takes a back seat.

According to the Raytheon Websense report, healthcare professionals "have an increased tendency to try and get around IT security policy in order to better serve their patients" and "up to 75 percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being." 

"Outside of stock trading, I can't think of another industry where you have to err on the side of openness," says Bob Slocum, senior product marketing manager of data and endpoint security for Websense. Further, there is no other industry, he says, where an employee (like a doctor) can routinely trump a security policy.

The end result is that attackers are far more willing to invest in stealing medical records than healthcare institutions are willing to invest in protecting them from being stolen.

As the Raytheon Websense report references, the average healthcare organization only spends about 3 percent of its IT budget on security, even though HIMSS recommends they spend at least 10 percent. Bitsight reports that while healthcare has done a good job closing up those Heartbleed vulnerabilities (only 4.4 percent), it's still wide open to FREAK (43.4 %) and POODLE (73.5 %).

Conversely, attackers will bring their best tools to bear. According to Raytheon and Websense, healthcare organizations are four times as likely to be hit with advanced malware -- particularly the CryptoWall ransomware (450% likelier), Dyre Trojan (300% likelier), and stealthy Dropper (376% likelier), which opens backdoors and drops other assorted payloads.

Healthcare is also 14 times as likely to be hit by the Andromeda botnet -- which has a particularly stealthy loader with anti-VM and anti-debug capabilities that can stay silent for months before it communicates with its command and control server, according to Raytheon and Websense.

Slocum says that he expected the numbers to be bad, and but not quite as "astronomically bad" as they were.

Plus, while outside attackers barrage them with malware, medical institutions also have malicious insiders to worry about. According to a report released yesterday by Trend Micro, healthcare has a larger insider leak problem than any other sector, attributing 17.5% of its breaches over the past 10 years to it. Insider leaks were the primary source of identity theft cases (44.2%) and healthcare was hit harder by identity theft than any other sector, accounting for 29.8% of cases.

The Bitsight report has declared healthcare the second-worst industry performer in data security, ahead of only education. According to Trend Micro, more than one-quarter (26.9%) of the data breaches reported in the past 10 years were in the healthcare sector.

And it isn't only an American problem; as the Raytheon Websense report cites, the U.K.'s National Health Services has been fined £1 million for its data security transgressions.

Complexity contributes to the problem. Multiple hospitals, labs, imaging centers, and pharmacies in multiple locations share data and computing resources.

The complexity just increases as the early-adopting industry hooks more medical devices into the Internet of Things. As guests of today's Dark Reading Radio episode on "Fixing IoT Security" remarked, one of the challenges of the IoT is installing software security updates -- something that is infinitely more complicated when the device needing the update resides within a patient's body.

Slocum says he takes the issue to heart, being a diabetic himself, but that medical device manufacturers he's spoken to have been very proactive about security -- not only by inviting ethical hackers to try to break into their devices, but by securing their other systems extra carefully, knowing that any sort of breach would damage their brand reputation and thus people's trust in their devices.

Slocum says there's some reason for optimism. He says that IT leaders in healthcare oganizations have been "beating the drum" and asking their CEOs for cybersecurity funding for years, to no avail; but since the Anthem breach, the conversation has changed.

"I believe they're going to get more [money] and executive support," he says. He recommends that they direct some of these funds to more unified solutions that can manage complex environments and to better end user awareness training.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
UlfM645
50%
50%
UlfM645,
User Rank: Apprentice
9/25/2015 | 12:30:51 PM
Healthcare is unique
I agree that Medical records are very desirable on the black market, because medical records, themselves, may be a treasure trove of PII, financial information, and insurance numbers."

I think that healthcare is unique in that there are a greater number of people who come in contact with sensitive information during the course of normal business operations than in other industries.

So, when you combine the number of people involved with handling multiple forms of PHI records, along with the immaturity of the data security systems and practices that are in place, there are so many opportunities for mistakes or

intentional breaches to take place.

The attraction of PHI is that its value does not degrade as rapidly as credit card data, which can be changed or updated quickly.

I recently read a study from Aberdeen Group that revealed "a steady increase in enterprise use of tokenization as an alternative to encryption for protecting sensitive data" and that half of the organizations are using data tokenization

for PII and PHI data. The name of the study is "Tokenization Gets Traction".

This is a short list of effective measures that I suggest organizations should take:

1. Fine-grained de-identification of both PII (Personally Identifiable Information) and PHI.
2. Fine-grained tokenization of PHI, to alleviate the need for plain-text data and exposure in-memory across the entire data flow.
3. Strong credentials, including password improvement and rotation, plus separation of duties to prevent privileged users, such as database administrators or system administrators, from accessing sensitive data.
   
Secure the data to the point that it is useless to a potential thief. Modern solutions such as tokenization provide better security than encryption, while retaining usability for analytics and monetization.

Ulf Mattsson, CTO Protegrity
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
9/27/2015 | 11:11:46 PM
Re: Healthcare is unique
Indeed, two years ago, Dell SecureWorks reported that full PHI records netted about $20 per on the black market -- much more valuable than simple credit cards (except high-balance cards and the like).
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:39:27 PM
Re: Healthcare is unique
One solution to this problem it to identify players in the black market, if I am guessing I will goes that we may find big insurance companies behind it.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
9/30/2015 | 9:13:28 PM
Re: Healthcare is unique
> One solution to this problem it to identify players in the black market,

Indeed, that seems to be the perennial goal...

> if I am guessing I will goes that we may find big insurance companies behind it.

...although I don't carry quite the same conspiracy theory.  :)
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:36:47 PM
Re: Healthcare is unique
Agree. It is actually sad that there is a black market on health data. If it was just a public record there would have been much less prpblem.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:42:40 PM
Re: Healthcare is unique
One more thing, one way to make it uses for the hackers is to encrypt it at rest, they may get the data but not be able to decrypt and utilize it.  Unless you are NSA of course :--))).
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
9/30/2015 | 9:15:39 PM
Re: Healthcare is unique
Worth pointing out that encryption at rest, while useful, is hardly a complete solution -- as security pundits pointed out in the wake of the Anthem brouhaha.  After all, if access and keys are compromised, so too is the encryption, and -- with it -- the data.
lynnbr2
50%
50%
lynnbr2,
User Rank: Strategist
10/1/2015 | 9:57:09 AM
Re: Healthcare is unique
Well, if you want to believe that healthcare is unique, go right ahead if that makes you feel better. But next time you go to the doctor's office or hospital, don't look too closely at that stack of six or nine papers they make you sign before you get to go past that locked door in the waiting room and actually see the doc.

Spoiler alert! Big Data is all about your healthcare records, already. Best that you don't look into MIB, Optum, Milliman, and their ilk, and their associated "members". This means there is already online, daily, trending to near real time, inter-company trading of your healthcare "data."

I like how MIB has a rebuttal statement pre-prepared at their website - cause they're just waiting for you to check them out - "...relying on unverifiable statements that may or may not have been made in the 1970's, 80's and 90's...we ask that you "take them with a grain of salt."" While Millimam's US home page even shows up with a website https certificate error.

Welcome to the 21st century of healthcare.

 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:33:39 PM
Healthcare privacy
 

Healthcare data is target simply because it is kept private, if it was a public record it would not be  a target.

 

 
Enrico Fontan
50%
50%
Enrico Fontan,
User Rank: Strategist
10/1/2015 | 12:03:02 PM
A cost effective approach
I think the article perfectly focused the point:

"The end result is that attackers are far more willing to invest in stealing medical records than healthcare institutions are willing to invest in protecting them from being stolen."

Attackers are always looking for a cost effective approach. Healthcare institutions have to focus on system security and staff training (secure the human) if they plan to minimize such attacks.
lynnbr2
50%
50%
lynnbr2,
User Rank: Strategist
10/1/2015 | 1:22:21 PM
Re: A cost effective approach
I agree the article "perfectly focused the point," and it was in the very first sentence where Sara said that "healthcare not very willing to invest in defending it."

Look, if I'm the CIO or CISO and I go the CEO and say "the state of our security is an unknown-unknown" (to channel Don Rumsfeld), I'll likely be replaced in the next quarter after the CEO's executive search committee comes back with some candidates. Ok, suppose the CEO is a good guy, and allows the CISO to continue. (I'll defer the discussion of just how many CEOs are good guys to Matthew 19:24?) So next the CISO has to tell the CEO just how large a honeypot of $ he needs to secure things, and over what time period. Then the CEO has to get buy-in from the rest of the C-suite and the board. But time flies, and that money is spent and gone now, and regardless of whether the CISO squashed 15 vulns, 150 vulns, or 500 vulns, the state of security is still an unknown-unknown? Well, for sure the executive search committee is getting back in session. The CEO isn't ready yet to add this new, never ending, ever expanding cost into the companies' 10-K statements, when legal is telling him they're covered. One persons cost effective approach is another persons business tax.

 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/11/2015 | 8:16:13 PM
Re: A cost effective approach
"Attackers are always looking for a cost effective approach."

Indeed, security research indicates that attackers -- like "defenders" -- are lazy, and constantly recycle code.  One security research company in Israel focuses on using predictive analytics to predict -- and defend against -- new attacks based upon old attacks and old malware and old software.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5230
PUBLISHED: 2019-11-13
P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than NEO-AL00D NEO-AL00 9.1.0.321(C786E320R1P1T8) have an improper validation vulnerability. The system does not perform...
CVE-2019-5231
PUBLISHED: 2019-11-13
P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package.
CVE-2019-5233
PUBLISHED: 2019-11-13
Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components.
CVE-2019-5246
PUBLISHED: 2019-11-13
Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain par...
CVE-2010-4177
PUBLISHED: 2019-11-12
mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.