Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/28/2014
12:23 PM
John B. Dickson
John B. Dickson
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

What Scares Me About Healthcare & Electric Power Security

Both industries share many of the same issues as enterprises. But they also have a risk profile that makes them singularly unprepared for sophisticated threats

In social settings when people find out I’m a security guy, they frequently ask me similar questions. The first, for example, is about my online paranoia: “Do you leave money in a bank?” My response is well honed, including thoughts on online banking protections, account monitoring, and how using more than a simple username and password is a good idea.

One question, though, gets me on my soapbox real quick -- and that question is, “As a security guy, what industries scare you most?” I get that question more frequently than you might imagine and my answer is always the same -- the healthcare and electrical power industries. Here’s why:

In healthcare, the stakes are high -- the well-being of my family -- which is critically important to me. If a credit card company loses my data, I get a new card with free credit monitoring. If a healthcare provider loses my electronic patient information, I can’t get new information. That’s my stuff!

Stakes are also high for the electrical power industry, but for a different reason. If an attacker can shut down a grid during a sweltering August in the Southwest or during a freezing Chicago winter, the results would be widespread and potentially devastating. Many experts point to this as the doomsday scenario -- attackers globally shutting down our grid.

The reason the security of our healthcare and electrical power industries scares me is not just the impact, but how consistently ill-prepared both industries are to defend against sophisticated attacks. I say this as a 20-year security consultant who has worked in four different companies and delivered hundreds of security assessments, penetration tests, and other projects.

Nor am I alone in my views. The new Director of NSA, Admiral Michael S. Rogers, lists “power” as one of 16 areas of critical infrastructure that concerns him most, too. And, in muted tones, many security veterans believe that sooner or later Eastern European organized-crime hacker consortia or nation states will direct their attention to healthcare and electrical power targets.

But what scares me the most are four significant mismatches between the sophisticated attackers and defenders in both industries:

#1 Closed systems
Both industries have huge initiatives that will transform their respective industries and change their risk profiles. Smart meters are being adopted to optimize electrical distribution and manage peak demand. This means they are taking a previously closed electrical distribution system and connecting it to the Internet. Unfortunately, there’s a culture clash between the Internet and electrical distribution worlds.

In healthcare, there are efforts to push patient information into Health Information Exchanges. These are meta-databases in the cloud to provide better and more responsive healthcare. Patients who need care away from home will have access to their private health information remotely. Regrettably, availability is trumping security on many rollouts. Healthcare.gov is more the standard and not the exception.

#2 A false sense of security
These industries view many cyber security threats in the abstract. There are no Targets or Home Depots in either industry, and arguably (at least as far as we know), sophisticated attackers are not attacking them. They’ve not had any near-death experiences, and because of the abstract nature of cyber security threats, leadership does not worry about attacks, and security budgets suffer. No daily threat of stolen money equals a false sense of security.

#3 Unfamiliar adversaries
Governmental organizations are used to getting attacked by nation states. Financial services companies are battling organized crime hacking syndicates who are both savvy and sophisticated. In the electrical and healthcare sectors, the likely adversaries will be nation states as part of a larger international crisis, or Eastern European hackers, when they find out how to monetize either target.

#4 Too much vendor trust
Both industries have a common denominator: highly trusted relationships with large systems and product vendors. But because they have worked so closely for a long time, they rarely question whether these partners conducted adequate security testing of their products or networks beyond simple vendor checklists. In the IT world, security leaders ALWAYS question vendor claims. In contrast, certain medical and electrical distribution products provide vendor lock-in and a client mismatch of power. Witness the many medical devices still running on Windows XP.

The healthcare and electrical industries share many of the same security issues as enterprises. But they also have a unique risk profile which makes them singularly less prepared to defend against sophisticated threats. Given the stakes, let’s hope this status quo changes soon.

 

John Dickson is an internationally recognized security leader, entrepreneur, and Principal at Denim Group Ltd. He has nearly 20 years of hands-on experience in intrusion detection, network security, and application security in the commercial, public, and military sectors. As ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
<<   <   Page 2 / 2
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/29/2014 | 1:17:17 PM
Re: Accounting standard or security standard?
@Ed Telders: Agreed, and that is precisely why I have asked for either the SAS 70 or SSAE 16. I wanted to know how religiously they followed their controls and to judge their "level of maturity" as you had put it.
rzw122
50%
50%
rzw122,
User Rank: Apprentice
10/29/2014 | 5:50:46 PM
Healthcare
OMG! I let out a yelp of agreement as I sprang from my seat and began clapping after reading this commentary. This is an affirmation that I've long needed in my seemingly-solo quest to help medical practitioners understand the importance and value of securing their networks. Conversations with this those in this industry- even about minor perimeter security measures- are often met with shrugs or blank stares, but even more maddening are the reactions of whatever tech staff that physicians have managed to loosely piece together. These individuals are an enigma, for it is they who are the ones that we might expect to hold a more profound understanding of the consequences of lax security, or, in some cases, no security at all. Thank you for this piece.
Gary Scott
50%
50%
Gary Scott,
User Rank: Strategist
10/31/2014 | 4:31:27 PM
Stop signs are installed AFTER a traffic accident occurs.
Action follows demand.  Until a majority of patients are negativley affected by a security issue nothing will be done.
jdickson782
50%
50%
jdickson782,
User Rank: Author
10/31/2014 | 5:25:15 PM
Re: Stop signs are installed AFTER a traffic accident occurs.
Sadly, I think you are correct here.  Absent of more high-profile losses, many in the healthcare industry will view the threat as remote.  My thoughts in the article were really based on ~20 years reviewing healthcare organizations and their high-level posture.
jdickson782
50%
50%
jdickson782,
User Rank: Author
10/31/2014 | 5:26:29 PM
Re: Healthcare
See my comments to Gary's post - unfortunately, there will have to be more high-profile losses before healthcare providers rate security up there with other risk management issues.
jdickson782
50%
50%
jdickson782,
User Rank: Author
10/31/2014 | 5:29:24 PM
Re: Accounting standard or security standard?
My overarching thought here is that every organization should have a general controls/ISO-27002 security assessment, but that this is only a starting point. More sophisticated organizations have multiple layers of security defense and do much more focused security testing to validate what's been implemented.
<<   <   Page 2 / 2
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5226
PUBLISHED: 2020-01-24
Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapp...
CVE-2019-1517
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE-2019-1518
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE-2019-1519
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE-2019-1520
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.