Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


12:23 PM
John B. Dickson
John B. Dickson
Connect Directly
E-Mail vvv

What Scares Me About Healthcare & Electric Power Security

Both industries share many of the same issues as enterprises. But they also have a risk profile that makes them singularly unprepared for sophisticated threats

In social settings when people find out I’m a security guy, they frequently ask me similar questions. The first, for example, is about my online paranoia: “Do you leave money in a bank?” My response is well honed, including thoughts on online banking protections, account monitoring, and how using more than a simple username and password is a good idea.

One question, though, gets me on my soapbox real quick -- and that question is, “As a security guy, what industries scare you most?” I get that question more frequently than you might imagine and my answer is always the same -- the healthcare and electrical power industries. Here’s why:

In healthcare, the stakes are high -- the well-being of my family -- which is critically important to me. If a credit card company loses my data, I get a new card with free credit monitoring. If a healthcare provider loses my electronic patient information, I can’t get new information. That’s my stuff!

Stakes are also high for the electrical power industry, but for a different reason. If an attacker can shut down a grid during a sweltering August in the Southwest or during a freezing Chicago winter, the results would be widespread and potentially devastating. Many experts point to this as the doomsday scenario -- attackers globally shutting down our grid.

The reason the security of our healthcare and electrical power industries scares me is not just the impact, but how consistently ill-prepared both industries are to defend against sophisticated attacks. I say this as a 20-year security consultant who has worked in four different companies and delivered hundreds of security assessments, penetration tests, and other projects.

Nor am I alone in my views. The new Director of NSA, Admiral Michael S. Rogers, lists “power” as one of 16 areas of critical infrastructure that concerns him most, too. And, in muted tones, many security veterans believe that sooner or later Eastern European organized-crime hacker consortia or nation states will direct their attention to healthcare and electrical power targets.

But what scares me the most are four significant mismatches between the sophisticated attackers and defenders in both industries:

#1 Closed systems
Both industries have huge initiatives that will transform their respective industries and change their risk profiles. Smart meters are being adopted to optimize electrical distribution and manage peak demand. This means they are taking a previously closed electrical distribution system and connecting it to the Internet. Unfortunately, there’s a culture clash between the Internet and electrical distribution worlds.

In healthcare, there are efforts to push patient information into Health Information Exchanges. These are meta-databases in the cloud to provide better and more responsive healthcare. Patients who need care away from home will have access to their private health information remotely. Regrettably, availability is trumping security on many rollouts. Healthcare.gov is more the standard and not the exception.

#2 A false sense of security
These industries view many cyber security threats in the abstract. There are no Targets or Home Depots in either industry, and arguably (at least as far as we know), sophisticated attackers are not attacking them. They’ve not had any near-death experiences, and because of the abstract nature of cyber security threats, leadership does not worry about attacks, and security budgets suffer. No daily threat of stolen money equals a false sense of security.

#3 Unfamiliar adversaries
Governmental organizations are used to getting attacked by nation states. Financial services companies are battling organized crime hacking syndicates who are both savvy and sophisticated. In the electrical and healthcare sectors, the likely adversaries will be nation states as part of a larger international crisis, or Eastern European hackers, when they find out how to monetize either target.

#4 Too much vendor trust
Both industries have a common denominator: highly trusted relationships with large systems and product vendors. But because they have worked so closely for a long time, they rarely question whether these partners conducted adequate security testing of their products or networks beyond simple vendor checklists. In the IT world, security leaders ALWAYS question vendor claims. In contrast, certain medical and electrical distribution products provide vendor lock-in and a client mismatch of power. Witness the many medical devices still running on Windows XP.

The healthcare and electrical industries share many of the same security issues as enterprises. But they also have a unique risk profile which makes them singularly less prepared to defend against sophisticated threats. Given the stakes, let’s hope this status quo changes soon.


John Dickson is an internationally recognized security leader, entrepreneur, and Principal at Denim Group Ltd. He has nearly 20 years of hands-on experience in intrusion detection, network security, and application security in the commercial, public, and military sectors. As ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
Thomas Claburn
Thomas Claburn,
User Rank: Ninja
10/28/2014 | 7:08:33 PM
Re: public safety
>now it's time for the public to be better informed on this.

If only the public cared. And for those who do, the healthcare market is so screwed up that it's unlikely consumers will be able to vote with their feet -- they'll have to wait until open enrollment periods to switch providers and then they're likely to face few real choices. And if you're electricity provider is lax in its security, you probably have nowhere else to go.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
10/28/2014 | 3:40:41 PM
public safety
What worries me is that the world outside of our security bubble won't truly take security seriously until there's a tangible attack that affects public safety, etc. The increasingly networked consumer space is bringing this issue to the fore--now it's time for the public to be better informed on this.
User Rank: Ninja
10/28/2014 | 3:34:30 PM
Re: Validation
Agree completely. During security reviews of potential vendors, I've asked for SAS 70 or SSAE 16 audit results if they have a current one, or a review of their security policies. Surprisingly, one potential vendor we looked into had none of those. Can you believe that? Not even security policies! So of course we expressed a lack of interest, and the next day, they miraculously came up with rudimentary security policies specific to our request. They indicated that they simply adopted the policies of one of their business partners who gave them permission to do so. One little problem – the policies reflected the name of their business partner, and not their own company. I couldn't believe how sloppy they were and naturally, my recommendation was "NO!!!"
User Rank: Ninja
10/28/2014 | 1:18:15 PM
Re: Validation
Vendors need to receive the same scrutiny that you would provide to your own enteprise. They are handling your data. If they store your data or are connected via VPN, your corporation is taking a risk which needs to be acknowledged. Their compromise and is your compromise. You need to ensure that they follow stringent standards that you hold your own enterprise, to safeguard the data. Cryptology methods need to safeguard data in transit and at rest. Firewalls and DMZ's positioned to secure different severities of data. Active scanning to determine that no outside malicious influence has already circumvented your perimeter. There are many others, but a good template is to follow best security practices for data handling.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 12:54:20 PM
Re: Validation
Interesting, ryan. What are some of the "measures" you are asking vendors about?
User Rank: Ninja
10/28/2014 | 12:41:37 PM
Working for a healthcare enterprise I can vouch for many of these significant mismatches. Especailly "Too much vendor trust". However, at my organization we are starting to crack down on ensuring Business Associate Agreements are signed that mandate certain measures be performed by vendors that want to do business with us. This along with legal documentation need to be present ensure that vendors are providing due diligence for data security. Vendors are concerned mainly with functionality and due to this, security tends to fall by the wayside. I feel that if vendors are held to higher standards and industry starts cracking down on the stringence of their protocols that the security initiative will be represented much better.
<<   <   Page 2 / 2
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-18
Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
PUBLISHED: 2020-02-18
Huawei HEGE-560 version; OSCA-550 and OSCA-550A version; and OSCA-550AX and OSCA-550X version have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Succe...
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.