Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
1/25/2018
09:00 AM
Raymond Pompon
Raymond Pompon
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Avoiding the Epidemic of Hospital Hacks

Lessons learned about cyber hygiene from inside one of America's highest ranked medical institutions.

On January 9, 2005, the Donttrip malware infection hit Northwest Hospital, a large medical facility in Seattle that served thousands of people. The malware clogged up the hospital’s network systems with surges of exploit network scanning. Medical operations ground to a halt as laboratory diagnostic systems couldn’t transfer data. Intensive Care Unit terminals went offline, internal pagers were silenced, and even the automatic operating room doors were locked down.

The IT team bailed valiantly against the sinking ship, but as soon as they cleaned a machine and put it back on the network, it got re-infected. Staff moved to implement disaster recovery processes, using manual or backup systems to bypass the affected systems. The quality of patient care was diminished, but no lives were seriously endangered, and the hospital weathered the storm. The FBI swooped in, eventually arresting the guilty parties, and the word went out: hospitals can be affected by cyber incidents.

That was over 12 years ago. Have things improved?

In April 2017, a 1,000-bed hospital in Buffalo, New York was virtually shut down by a ransomware attack. Then on May 12, the WannaCry ransomware pounded through Europe like a tsunami, leading to substantial IT outages. WannaCry was particularly devastating to UK’s National Health Service, disrupting over a third of health-serving organizations at 603 primary care facilities. With the proliferation of complex IT in healthcare on highly critical but widely open networks, it is no surprise that their systems are at such high risk. Ransomware had proven itself as an existential threat to medical service delivery in modern hospitals.

I recently had a chance to observe the procedures from inside one of the highest ranked hospitals in America. As I was under their care, I couldn’t help but carefully watch and ask questions about their IT security procedures. I followed this up with some research into their security policies and incident histories. I found their cyber hygiene was of an equally high standard. There are also some good IT security lessons worth sharing.

I've written before about the insecurity of the Internet of Things, and during my hospital stay I had concerns about all the medical gear like scanners and monitoring devices hospital staff wheeled around and used on patients. It turned out that much of that equipment was air-gapped away from the main network. Most of this equipment was manually controlled, requiring a live operator to enter commands. Old fashioned, yes, but no malware was going to infect an IV feed and overdose a patient. To retrieve data, nurses used a very regimented manual process to capture and record readings from these systems. The amount of data captured was also very small, usually a short series of numbers, which reduced mistakes in the handoff. Over the course of weeks, I observed dozens of different medical professionals executing the same manual process in the same exact way.

In order to enter this data, the nursing staff needed access to wired data terminals. All the corridors and hospital rooms had a computer for data entry and retrieval. All these terminals required a login to access, and I didn’t see one that was left unlocked when unattended. Again, the staff was obviously well trained in locking their systems when leaving. When not logged in, each terminal displayed screen savers showing security awareness and anti-phishing warnings.

It’s no surprise that medical personnel could be well trained and disciplined in following detailed instructions involving complex systems and tools. It was refreshing to see that this hospital put as much emphasis into their secure IT procedures as they did into their patient care processes. My review of their training materials also showed me that they made direct connections between security and patient care quality—a great way to link security processes to the organizational goals.

Nevertheless, being a security professional, I am always thinking about what can go wrong. So, I asked about the plan if the IT systems went down. A nurse told me that the hospital overstaffs with redundant personnel on every shift so they can backfill for emergencies. I could see the value in this. Not only is this insurance against IT disasters but also any kind of medical emergencies when additional personnel may be needed. It may cost extra in the daily operational budget, but it’s worth it to fulfill the mission of the organization (that is, save lives).

In addition to the processes I was directly exposed to, I was given an opportunity to review a lot of the hospital’s security policies and training materials. I was pleased with what I found. There was a method for securely leveraging BYOD smartphones and tablets, as well as two-factor remote access. Both disk and network encryption were placed throughout the entire infrastructure. And there was an appropriate emphasis on asset management and vulnerability testing. They were doing everything they were supposed to be doing.

The most significant thing that struck me was the emphasis on disciplined process that covered the entire staff. I’ve always felt that strong process around key controls was a game changer in maintaining a secure organization. As they say: it’s always the simple things, but the simple things are hard.

Get the latest application threat intelligence from F5 Labs.

 

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19037
PUBLISHED: 2019-11-21
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.
CVE-2019-19036
PUBLISHED: 2019-11-21
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
CVE-2019-19039
PUBLISHED: 2019-11-21
__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program.
CVE-2019-6852
PUBLISHED: 2019-11-20
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP har...
CVE-2019-6853
PUBLISHED: 2019-11-20
A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server.