Live from HIMSS17: Cybersecurity Leaders Dive Into New and Emerging Threats | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Live from HIMSS17: Cybersecurity Leaders Dive Into New and Emerging Threats

February 20, 2017
by Rajiv Leventhal
| Reprints
Medical device security was a noteworthy point of interest during HIMSS17's opening day
At the HIMSS17 conference at the Orange County Convention Center in Orlando, experts in the cybersecurity space dove into the latest emerging trends regarding healthcare information security and protection, with newfound emphasis on medical device security. 
 
Not likely to be a surprise to anyone, Mac McMillan, CEO of the CynergisTek consulting firm, as he has done many times in the past, noted that the greater sophistication of the level of attacks that he is seeing today continues to be one of the biggest trends related to healthcare cybersecurity. McMillan said that artificial intelligence (AI) is starting to "creep into attacks," and that hackers are now using the same technologies that the "good guys are using for benefit." He said, "Now [criminals] are teaching malware to do amazing things that it couldn't do before, thus making it harder for the good guys' systems to block, protect, or stop it." 
 
McMillan added that the volume of attacks has also not slowed down at all, as evident by recent research. "Extortion has taken on totally new approaches, so it's not just encrypting data and holding it ransom, but attackers are wiping it out and making copies, and telling the organization that they to pay to get their data back. Extortion has taken on a whole new realm," he said. McMillan then touched on another noteworthy trend: attacks that are purposed to take advantage of just the devices connected to the network, either wirelessly or otherwise. "I worry about inadvertent health or safety issues with patients in the hospital who are relying on these devices that are connected," he said. Indeed, he continued, the disruptive nature of such attacks are incredibly disturbing as they affect business, revenue, service, and confidence—"all the important things for a hospital." 
 
Further discussing the emerging attacks on medical devices, McMillan noted that at the recent security-based RSA conference, several medical device manufacturers made comments that they were not the problem in respect to the non-secure medical devices, but rather that it's the providers who are the problem since they are continuing to use devices past their end of life. "So the [manufacturers] are saying that the providers are not renewing the devices fast enough, which is another way of saying 'buy more of my devices'. However, it doesn't matter if I buy more devices if the devices I am buying still are not secure," McMillan said, referring to the conversation at the RSA conference as "a crazy experience." He added, "Here at [HIMSS], folks have come up to me who were at RSA asking if I could believe what the manufacturers said there. And I said absolutely I could, if they could make the case that it's your problem and that you need to replace your devices, think about that as a sales opportunity."
 
To this end, during an education session on the evolving state of medical device cybersecurity, Seth Carmody, Ph.D., cybersecurity program manager, FDA, noted that medical devices in the clinical environment, in the health and public health clinical infrastructure sector, "represents a major large attack surface for national security today." Carmody added, "We don't want people to check boxes; we need to make sure that medical devices are more secure, not more compliant." 
 
Carmody said that FDA guidance in medical devices serves as a policy framework to enable patching and reconfiguration, if appropriate, as they have historically been designed without secure development techniques. "The FDA's mission is for safe and effective devices," he said. "Where are we as a center? We are maturing; we just got started in 2013. Some other sectors have had a 25-year head start on us. Now, it's about raising awareness, and there are both early adopters and deniers. We want to promote safety and security by design through establishing clear regulatory expectations," he said, adding that a "whole community approach"—inclusive of all of federal regulatory bodies, such as ONC, OCR, DHS, ICS-CERT, and the private sector of device manufacturers—is necessary to coordinate, collaborate, and share information. Carmody said that manufacturers have come to the FDA and have had transparent conversations. "That's when you start to get things done," he said. 
 
Meanwhile, during the same session on medical device cybersecurity, Margie Zuk, senior principal cybersecurity engineer at The MITRE Corporation, identified several gap areas identified after the organization's research, including: the need to share best practices for securing legacy devices; the need to adopt threat-based defense for the sharing of threat intelligence; the need for coordinated disclosure of vulnerabilities and the transparency of vulnerabilities in third-party software; the need for solutions for small and large organizations; the need for a common risk framework for security and safety; the need for cybersecurity baselines for medical devices; and the need testing and certification of medical devices.
 
What's more, when asked about where the biggest gaps lie in regards to defense and protection, McMillan said, "Still amazingly enough, the most important thing that organizations can do is the basics." He gave specifics, such as: better hygiene in how they manage the environment; making sure they are using systems that are up-to-date; and taking an overall approach of hardening and patching up things. "And whether they like it or not, they will have to invest in smarter technology," he said. "Technology of the  past won't protect us against threats of today or tomorrow. You will need smarter systems will have to rely on heuristic capabilities with behavioral analytic-type capabilities and machine learning capabilities. If the bad guys are going to use machine learning, we also have to if we want any chance of keeping up with them."
 
To this end, he said that a core problem is still that organizations are following point problems. So for instance, when ransomware happens, folks are thinking about the solution to that as being getting an advanced malware solution. While McMillan admitted that this is part of the solution, he noted, "If you haven't fixed the access control issues and the hygiene issues, that malware solution will only be so effective. We are not necessarily doing a better job of managing security overall, despite spending money."  He added that there are simple things organizations can do that can lower their threat profiles, that are not associated with deploying a lot of technology, such as: truly segmenting a network and making it harder for the threat to move freely inside your environment once it finds a way in; locking down access control; getting rid of passwords and going to a vaulting solution so that those elevated privileges don't exist on the network all the time; and using two-factor authentication which makes it exponentially harder for a hacker. "These are solutions are not terribly expensive," he said. "Vaulting solutions are somewhere between $80,000 to $120,000 yet look what it does in terms of eliminating that threat. These things can make a tremendous impact on our environment. We might spend millions of identity management and advanced malware, and we still have all of these holes." 
 
For those that have suffered a breach to their systems, and a ransom demand, McMillan said each situation is different, and that the first question he asks the victims is if their data is backed up with confidence. The organization's answer to that question will determine the next steps, he said. As far as paying the ransom or not, McMillan noted, "I would love for you not to [pay], because we don't want to perpetuate that behavior, even though we know more than 40 percent of organizations are paying those ransoms for business reasons. If you are sitting there with downtime that is costing you hundreds of thousands of dollars per minute, and you have a ransom demand of $20,000 to $40,000, you might not like paying it, but it's the lesser of two evils. I don't fault anyone who pays it, but it's not something we want. Anytime you pay that ransom, bad guys see it as a justification to keep going."
 
Seemingly, in recent years, as every HIMSS conference passes, the fear of cybersecurity grows. But as show attendees continue to share challenges and best practices, McMillan believes that people are now over the shock and awe of the situation. "They realize that it's the new reality. They are smart enough now to recognize that in order to meet the issue, they will have to employ more resources." But, he added, they're  worried about where that will come from with [uncertainty] regarding the new administration leading to new financial challenges for hospitals. He said, "The bigger issue now is, 'can we find the resources' rather than 'can we spend it in the right places?' But the latter is the place we need to be."

The Health IT Summits gather 250+ healthcare leaders in cities across the U.S. to present important new insights, collaborate on ideas, and to have a little fun - Find a Summit Near You!


/article/cybersecurity/live-himss17-cybersecurity-leaders-dive-new-and-emerging-threats
/blogs/mark-hagland/cybersecurity/assessing-new-cybersecurity-practices-publication-why-small-and

Assessing the New Cybersecurity Practices Publication: Why Small and Medium-Sized Care Organizations Have Reason to Rejoice

| Reprints
A new set of voluntary cybersecurity practices just released by HHS offers practical advice and conceptual supports that fill information gaps
Click To View Gallery

How helpful will the new set of voluntary cybersecurity practices that the Department of Health and Human Services (HHS) released in late December, be, to the leaders of patient care organizations? Only time will tell, as part of the value of the release will only be made manifest as the leaders of patient care organizations move forward to implement some of those practices, and the potential success of such implementations is in some way measured and benchmarked.

But the release is a first start, at least. As Healthcare Informatics Associate Editor Heather Landi reported on January 2, HHS released the set of practices in the form of a publication “that marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.”

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement published with the release of the new publication.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP), the primary publication of the Cybersecurity Act of 2015, Section 405(d) Task Group, aims to raise awareness, provide vetted cybersecurity practices, and move organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector,” HHS officials stated. “It seeks to aid healthcare and public health organizations to develop meaningful cybersecurity objectives and outcomes. The publication includes a main document, two technical volumes, and resources and templates.”

The overall publication consists of several sections, the first being the HICP, which “examines cybersecurity threats and vulnerabilities that affect the healthcare industry. It explores five current threats and presents 10 practices to mitigate those threats; “Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations,” which offers cybersecurity practices for small healthcare organizations; “Technical Volume 2: Cybersecurity Practices for Medium and Large Health Care Organizations”; the “Resources and Templates” portion, which “includes a variety of cybersecurity resources and templates for end users to reference”; and a Cybersecurity Practices Assessments Toolkit, which “helps organizations prioritize their cyber threats and develop their own action plans using the assessment methodology outlined in the Resources and Templates volume”—that last section being still under development as of Jan. 2.

As Landi reported, “The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.”

What’s more, she wrote, “The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.”

Among the salient statistics reported in the HICP:

  • Fifty-eight percent of malware attack victims are small businesses.
  • In 2017, cyber-attacks cost small and medium-sized businesses an average of $2.2 million.
  • Sixty of small businesses go out of business within six months of an attack.
  • And, 90 percent of small businesses do not use any data protection at all for company and customer information.

How does that translate into impacts on smaller healthcare organizations? Among other incidents, the HICP notes that:

  • A popular orthopedic practice announced that its computer system was hacked via breach of a software vendor’s log-in credentials. This breach put just under a half-million people at risk of identity theft. Of those, 500 patient profiles appeared for sale on the dark web. The information for sale included names, addresses, social security numbers, and other personally identifiable information (PII). Although not posted for sale, pertinent PHI such as X-ray results and medical diagnoses were also stolen.

 

  • A rural hospital had to replace its entire computer network after a ransomware cyber-attack froze the hospital’s electronic health record (EHR) system. Doctors were unable to review their patients’ medical histories or transmit laboratory and pharmacy orders. Officials were unable to restore essential services and could not pay the ransom for the return of their system. After consultations with the Federal Bureau of Investigation and cybersecurity experts, hospital officials made the difficult decision to replace the entire system.
  •  

Of particular practicality is some of the very basic advice given to the leaders of smaller healthcare organizations. To wit: “Doctors and nurses know that hand sanitizing is critical to prevent the spread of germs. That does not mean health care workers wash up as often as they should. Similarly, we know that cybersecurity practices reduce the risk of cyber-attacks and data breaches. Just as we are able to protect our patients from infection, we should all work towards protecting patient data to allow physicians and caregivers to trust the data and systems that enable quality health care. Just as health care professionals must wash their hands before caring for patients, health care organizations must practice good ‘cyber hygiene’ in today’s digital world, including it as a part of daily universal precautions,” the HICP notes. “Like the simple act of hand-washing, a culture of cyber-awareness does not have to be complicated or expensive for a small organization. It must simply be effective at enabling organization members to protect information that is critical to the organization’s patients and operations. Your organization’s vigilance against cyber-attacks will increase concurrently with your and your workforce’s knowledge of cybersecurity. This knowledge will enable you to advance to the next series of cybersecurity Practices, expanding your organization’s awareness of and ability to thwart cyber threats.”

Meanwhile, both smaller and larger patient care organizations will benefit from the technical supports, including a Security Risk Assessment Tool, a set of recommendations on medical devices and cybersecurity, and an incident response risk management handbook.

What this set of resources does is to fill a gap between theory and technical practice in a key area. Will it shift the entire landscape of cybersecurity for patient care organizations? No, that would be a far-too-ambitious goal. But the healthcare IT leaders of smaller and medium-sized patient care organizations in particular, will welcome practice advice and supports, as they move forward in their journeys around cybersecurity. Any such journey is inherently challenging, and federal publications and resources like these will be of real value in moving patient care organization HIT leaders forward.

 

 

More From Healthcare Informatics

/news-item/cybersecurity/hhs-releases-voluntary-healthcare-cybersecurity-practices

HHS Releases Voluntary Healthcare Cybersecurity Practices

January 2, 2019
by Heather Landi, Associate Editor
| Reprints

In late December, the Department of Health and Human Services (HHS) released voluntary cybersecurity practices to the healthcare industry with the aim of providing practice guidelines to cost-effectively reduce cybersecurity risks.

The “Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients” publication aims to provide guidance to healthcare organizations of all types and sizes, ranging from local clinics to large hospital systems.

The industry-led effort was in response to a mandate set forth by the Cybersecurity Act of 2015 Section 405(d), to develop practical cybersecurity guidelines to cost-effectively reduce cybersecurity risks for the healthcare industry.

According to HHS, the publication marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement.

While technologies are vital to the healthcare industry and help provide life-saving treatments and improve patient care, these same technologies are vulnerable to myriad attacks from adversaries, ranging from criminals and hacktivists to nation-states, according to HHS. These technologies can be exploited to gain access to personal patient data or render entire hospital systems inoperable. Recent cyber-attacks against the nation’s healthcare industry continue to highlight the importance of ensuring these technologies are safe and secure.

“The healthcare industry is truly a varied digital ecosystem. We heard loud and clear through this process that providers need actionable and practical advice, tailored to their needs, to manage modern cyber threats. That is exactly what this resource delivers; recommendations stratified by the size of the organization, written for both the clinician as well as the IT subject matter expert,” Erik Decker, industry co-lead and Chief Information Security and Privacy Officer for the University of Chicago Medicine, said in a statement.

The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.

The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.

 

Related Insights For: Cybersecurity

/news-item/cybersecurity/cynergistek-protenus-partner-privacy-monitoring-programs

CynergisTek, Protenus Partner on Privacy Monitoring Programs

December 26, 2018
by Heather Landi, Associate Editor
| Reprints

CynergisTek, Inc., an Austin, Texas-based healthcare cybersecurity firm, is partnering with Protenus, a healthcare compliance analytics company, to combine the companies’ technology tools and services with a focus on patient privacy monitoring programs.

The partnership will grant health systems access to Protenus’ analytics platform that leverages artificial intelligence to gather data related to potential patient privacy risks, along with CynergisTek’s patient privacy monitoring services.

According to the Protenus research, insider incidents accounted for 23 percent of all breaches that occurred at health systems in Q3 2018. This figure will only continue increasing, indicating that now more than ever, health systems need a cost-effective solution to meet the daily challenges of managing patient privacy.

To address this need, CynergisTek and Protenus formed a preferred partnership to combine CynergisTek’s healthcare consulting experience and privacy programs with Protenus’ healthcare analytics technology to offer health systems both the people, processes, and technology components of a strong patient privacy monitoring program, according to the companies.

“As health systems face mounting challenges in creating and maintaining robust patient privacy monitoring programs, we identified a need to partner with a company offering complementary services so that health systems can act on the insights uncovered by our analytics,” Nick Culbertson, CEO and co-founder of Protenus, said in a statement.

 “Data privacy is evolving as a dominate theme in conversations, both in healthcare and other industries, and health systems need to take an end-to-end approach to patient privacy to truly address this complex and mission-critical challenge,” Mac McMillan, CEO and president of CynergisTek, said in a statement.

 

See more on Cybersecurity

agario agario---betebet sohbet hattı betebet bahis siteleringsbahis