Six Lessons From Boston Children’s ‘Hacktivist’ Attack | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Six Lessons From Boston Children’s ‘Hacktivist’ Attack

October 17, 2018
by David Raths, Contributing Editor
| Reprints
CIO Daniel Nigrin, M.D., says hospitals must prepare for DDoS and ransomware

Most health system CIOs have heard about the 2014 attack on Boston Children’s Hospital by a member or members of the activist hacker group Anonymous. The hospital was forced to deal with a distributed denial of service (DDoS) attack as well as a spear phishing campaign. Yesterday, as part of the Harvard Medical School Clinical Informatics Lecture Series, the hospital’s senior vice president and CIO Daniel Nigrin, M.D., discussed six lessons learned from the attack.

Although the cyber-attack took place four years ago, there have been some recent developments. The attack was undertaken to protest the treatment of a teenager, Justina Pelletier, in a dispute over her diagnosis and custody between her parents and the hospital. In August 2018 Martin Gottesfeld, 32, was convicted of one count of conspiracy to damage protected computers and one count of damaging protected computers. U.S. District Court Judge Nathaniel Gorton scheduled sentencing for Nov. 14, 2018. Gottesfeld was charged in February 2016. 

 According the U.S. Department of Justice, Gottesfeld launched a massive DDOS attack against the computer network of the Boston Children’s Hospital. He customized malicious software that he installed on 40,000 network routers that he was then able to control from his home computer. After spending more than a week preparing his methods, on April 19, 2014, he unleashed a DDOS attack that directed so much hostile traffic at the Children’s Hospital computer network that he temporarily knocked Boston Children’s Hospital off the Internet. 

 In his Oct. 17 talk, Nigrin said cyber criminals still see healthcare as a soft target compared to other industries. “The bottom line is that in healthcare, we have not paid attention to cybersecurity,” he said. “In the years since this attack, we have seen ransomware attacks that have brought hospital systems to their knees. We have to pay more attention and invest more in terms of dollars and technical people, but it really does extend to entire organizations — educating people about what a phishing attack is, what a social engineering attack is. These need to be made a priority.”

He offered six lessons learned from Boston Children’s experience:  

Webinar

Components of Strong Cybersecurity Program - A Closer Look at Endpoint Security Best Practices

Endpoint protection remains a core security challenge for many healthcare organizations and it is more important than ever for healthcare organizations to actively manage their full range of...

1. DDoS countermeasures are critical. No longer can healthcare organizations assume that a DDoS attacks are things that only occur against corporate entities, he said. “Prior to this event, I had never thought about the need to protect our organization against a DDoS attack,” he said. “I will submit that the vast majority of my CIO colleagues were in the same boat. And that was wrong. I think now we have gotten this understanding.”

2.  Know what depends on the internet. Having a really detailed understanding of what systems and processes in your organization depend on internet access is critical, Nigrin stressed. You also mush have good mitigation strategies in place to know what to do if you lose internet access — whether it is because you have a network outage due to a technical issue or a malicious issue. “As healthcare has become more automated and dependent on technology, these things are crippling events. You have got to know how you are going to deal with it ahead of time. Figuring it out on the fly is not going to work.”

3. Recognize the importance of email. Email may be seen as old-school, Nigrin noted, but it is still the primary method to communicate, so you have to think about how you can communicate and get the word out in scenarios where you don’t have email or lose voice communication. “In our case, we were super-lucky because we had just deployed a secure texting platform, so we could do HIPAA-compliant texting, and when our email was down, that was how we communicated, and it was very effective,” he explained.

4. Push through security initiatives – no excuses anymore.  Because he is a doctor himself, Nigrin feels OK picking on doctors about security. Historically they have always pushed back on security measures such as dual-factor authentication. He paraphrases them saying “Come on, Dan, that is an extra 10 seconds; I have to carry a secure ID, or you have to send me a text message on my phone. It is a pain. I don’t want to do it. I am the highest-paid employee in your organization and that is time better spend on something else.” But Nigrin argues that we can’t afford to think like that anymore. He used the Anonymous attack as an opportunity to push through four or five security initiatives within the next two to three months when he had everyone’s attention. “The platform was burning, and the board of trustees was willing to expend the money to pay for it all. They all of a sudden recognized the risk.”

5. Securing audio- and teleconference meetings. Nigrin said this topic wouldn’t have occurred to Boston Children’s until they were warned by the FBI. “The FBI told us about an attack that affected them when they were dealing with Anonymous. When Anonymous was attacking the FBI, the FBI convened internal conference calls on how to deal with it. Anonymous had already breached their messaging platform and intercepted the calendar invites that invited everyone to dial in. Anonymous basically was called into the meeting. Within 30 minutes of one of those meetings, the entire audio transcript of the conference call was posted to YouTube. “So we took heed of that and made sure that when we had conference calls, we sent out PINs over our secure texting platform,” he said.

6. Separating signal from noise. During the attack, Boston Children’s set up a command center and told employees: if you see something, say something. “We didn’t know what attack was coming next. We were flying blind,” Nigrin said. “We started to get lots of calls into our command center with reports of things that seemed somewhat suspicious,” he remembers. People got calls on their cell phone with a recorded message saying your bank account has been compromised. Press 1 to talk to someone to deal with it. “Today we would recognize this as some type of phishing scam and hang up,” he said, “but at the time it was sort of new. People started calling us and we didn’t know if this was Anonymous trying to get into the bank accounts of our senior clinicians. Was it part of the attack? It was tough for us to detect signal from noise.”

In the Q&A after his presentation, listeners were curious about how much the incident cost the hospital. Nigrin said there two big costs incurred: One was the technology it had to deploy in an emergent way to do DDOS protection and penetration testing. The other was revenue lost from philanthropic donations. Together they were close to $1 million.

Another person asked if the hospital had cyber insurance. Nigrin said they did, but when they read the fine print it said they were covered only if they were breached and technically they were never breached, so the insurance company was reluctant to pay. Although they eventually got compensated for a good share of it, the hospital also made sure to update its policy.

Still another attendee asked Nigrin if ransomware attacks were still targeting hospitals. He said they definitely were. “Think about community hospitals just squeaking by on their budgets,” he said. “They don’t have millions to spend, yet their data is valuable on the black market. Attackers recognize we are dead in the water as entities if we don't have these systems. We have important data and will do anything to get our systems back up and running.”

Nigrin said even large health systems can be vulnerable because some technology they deploy is run by third-party vendors who haven’t upgraded their systems. An example, he said, might be technology to record videos in the operating room setting. Some vendors, he said, are not accustomed to thinking about security. They are unable to update their software so it works on more modern operating systems. That leaves CIOs with a tough choice. “We can shut off the functionality or take the risk of continuing to use outdated and unpatched operating systems. Those vendors now have woken up and realize they have to pay more attention.”

 

 


The Health IT Summits gather 250+ healthcare leaders in cities across the U.S. to present important new insights, collaborate on ideas, and to have a little fun - Find a Summit Near You!


/article/cybersecurity/six-lessons-boston-children-s-hacktivist-attack
/blogs/mark-hagland/cybersecurity/assessing-new-cybersecurity-practices-publication-why-small-and

Assessing the New Cybersecurity Practices Publication: Why Small and Medium-Sized Care Organizations Have Reason to Rejoice

| Reprints
A new set of voluntary cybersecurity practices just released by HHS offers practical advice and conceptual supports that fill information gaps
Click To View Gallery

How helpful will the new set of voluntary cybersecurity practices that the Department of Health and Human Services (HHS) released in late December, be, to the leaders of patient care organizations? Only time will tell, as part of the value of the release will only be made manifest as the leaders of patient care organizations move forward to implement some of those practices, and the potential success of such implementations is in some way measured and benchmarked.

But the release is a first start, at least. As Healthcare Informatics Associate Editor Heather Landi reported on January 2, HHS released the set of practices in the form of a publication “that marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.”

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement published with the release of the new publication.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP), the primary publication of the Cybersecurity Act of 2015, Section 405(d) Task Group, aims to raise awareness, provide vetted cybersecurity practices, and move organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector,” HHS officials stated. “It seeks to aid healthcare and public health organizations to develop meaningful cybersecurity objectives and outcomes. The publication includes a main document, two technical volumes, and resources and templates.”

The overall publication consists of several sections, the first being the HICP, which “examines cybersecurity threats and vulnerabilities that affect the healthcare industry. It explores five current threats and presents 10 practices to mitigate those threats; “Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations,” which offers cybersecurity practices for small healthcare organizations; “Technical Volume 2: Cybersecurity Practices for Medium and Large Health Care Organizations”; the “Resources and Templates” portion, which “includes a variety of cybersecurity resources and templates for end users to reference”; and a Cybersecurity Practices Assessments Toolkit, which “helps organizations prioritize their cyber threats and develop their own action plans using the assessment methodology outlined in the Resources and Templates volume”—that last section being still under development as of Jan. 2.

As Landi reported, “The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.”

What’s more, she wrote, “The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.”

Among the salient statistics reported in the HICP:

  • Fifty-eight percent of malware attack victims are small businesses.
  • In 2017, cyber-attacks cost small and medium-sized businesses an average of $2.2 million.
  • Sixty of small businesses go out of business within six months of an attack.
  • And, 90 percent of small businesses do not use any data protection at all for company and customer information.

How does that translate into impacts on smaller healthcare organizations? Among other incidents, the HICP notes that:

  • A popular orthopedic practice announced that its computer system was hacked via breach of a software vendor’s log-in credentials. This breach put just under a half-million people at risk of identity theft. Of those, 500 patient profiles appeared for sale on the dark web. The information for sale included names, addresses, social security numbers, and other personally identifiable information (PII). Although not posted for sale, pertinent PHI such as X-ray results and medical diagnoses were also stolen.

 

  • A rural hospital had to replace its entire computer network after a ransomware cyber-attack froze the hospital’s electronic health record (EHR) system. Doctors were unable to review their patients’ medical histories or transmit laboratory and pharmacy orders. Officials were unable to restore essential services and could not pay the ransom for the return of their system. After consultations with the Federal Bureau of Investigation and cybersecurity experts, hospital officials made the difficult decision to replace the entire system.
  •  

Of particular practicality is some of the very basic advice given to the leaders of smaller healthcare organizations. To wit: “Doctors and nurses know that hand sanitizing is critical to prevent the spread of germs. That does not mean health care workers wash up as often as they should. Similarly, we know that cybersecurity practices reduce the risk of cyber-attacks and data breaches. Just as we are able to protect our patients from infection, we should all work towards protecting patient data to allow physicians and caregivers to trust the data and systems that enable quality health care. Just as health care professionals must wash their hands before caring for patients, health care organizations must practice good ‘cyber hygiene’ in today’s digital world, including it as a part of daily universal precautions,” the HICP notes. “Like the simple act of hand-washing, a culture of cyber-awareness does not have to be complicated or expensive for a small organization. It must simply be effective at enabling organization members to protect information that is critical to the organization’s patients and operations. Your organization’s vigilance against cyber-attacks will increase concurrently with your and your workforce’s knowledge of cybersecurity. This knowledge will enable you to advance to the next series of cybersecurity Practices, expanding your organization’s awareness of and ability to thwart cyber threats.”

Meanwhile, both smaller and larger patient care organizations will benefit from the technical supports, including a Security Risk Assessment Tool, a set of recommendations on medical devices and cybersecurity, and an incident response risk management handbook.

What this set of resources does is to fill a gap between theory and technical practice in a key area. Will it shift the entire landscape of cybersecurity for patient care organizations? No, that would be a far-too-ambitious goal. But the healthcare IT leaders of smaller and medium-sized patient care organizations in particular, will welcome practice advice and supports, as they move forward in their journeys around cybersecurity. Any such journey is inherently challenging, and federal publications and resources like these will be of real value in moving patient care organization HIT leaders forward.

 

 

More From Healthcare Informatics

/news-item/cybersecurity/hhs-releases-voluntary-healthcare-cybersecurity-practices

HHS Releases Voluntary Healthcare Cybersecurity Practices

January 2, 2019
by Heather Landi, Associate Editor
| Reprints

In late December, the Department of Health and Human Services (HHS) released voluntary cybersecurity practices to the healthcare industry with the aim of providing practice guidelines to cost-effectively reduce cybersecurity risks.

The “Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients” publication aims to provide guidance to healthcare organizations of all types and sizes, ranging from local clinics to large hospital systems.

The industry-led effort was in response to a mandate set forth by the Cybersecurity Act of 2015 Section 405(d), to develop practical cybersecurity guidelines to cost-effectively reduce cybersecurity risks for the healthcare industry.

According to HHS, the publication marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement.

While technologies are vital to the healthcare industry and help provide life-saving treatments and improve patient care, these same technologies are vulnerable to myriad attacks from adversaries, ranging from criminals and hacktivists to nation-states, according to HHS. These technologies can be exploited to gain access to personal patient data or render entire hospital systems inoperable. Recent cyber-attacks against the nation’s healthcare industry continue to highlight the importance of ensuring these technologies are safe and secure.

“The healthcare industry is truly a varied digital ecosystem. We heard loud and clear through this process that providers need actionable and practical advice, tailored to their needs, to manage modern cyber threats. That is exactly what this resource delivers; recommendations stratified by the size of the organization, written for both the clinician as well as the IT subject matter expert,” Erik Decker, industry co-lead and Chief Information Security and Privacy Officer for the University of Chicago Medicine, said in a statement.

The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.

The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.

 

Related Insights For: Cybersecurity

/news-item/cybersecurity/cynergistek-protenus-partner-privacy-monitoring-programs

CynergisTek, Protenus Partner on Privacy Monitoring Programs

December 26, 2018
by Heather Landi, Associate Editor
| Reprints

CynergisTek, Inc., an Austin, Texas-based healthcare cybersecurity firm, is partnering with Protenus, a healthcare compliance analytics company, to combine the companies’ technology tools and services with a focus on patient privacy monitoring programs.

The partnership will grant health systems access to Protenus’ analytics platform that leverages artificial intelligence to gather data related to potential patient privacy risks, along with CynergisTek’s patient privacy monitoring services.

According to the Protenus research, insider incidents accounted for 23 percent of all breaches that occurred at health systems in Q3 2018. This figure will only continue increasing, indicating that now more than ever, health systems need a cost-effective solution to meet the daily challenges of managing patient privacy.

To address this need, CynergisTek and Protenus formed a preferred partnership to combine CynergisTek’s healthcare consulting experience and privacy programs with Protenus’ healthcare analytics technology to offer health systems both the people, processes, and technology components of a strong patient privacy monitoring program, according to the companies.

“As health systems face mounting challenges in creating and maintaining robust patient privacy monitoring programs, we identified a need to partner with a company offering complementary services so that health systems can act on the insights uncovered by our analytics,” Nick Culbertson, CEO and co-founder of Protenus, said in a statement.

 “Data privacy is evolving as a dominate theme in conversations, both in healthcare and other industries, and health systems need to take an end-to-end approach to patient privacy to truly address this complex and mission-critical challenge,” Mac McMillan, CEO and president of CynergisTek, said in a statement.

 

See more on Cybersecurity

agario agario---betebet sohbet hattı betebet bahis siteleringsbahis