IoT Report: Imaging Systems Present Biggest Security Risk in Healthcare | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

IoT Report: Imaging Systems Present Biggest Security Risk in Healthcare

March 1, 2018
by Heather Landi
| Reprints
Click To View Gallery

The healthcare ecosystem has become more connected with the increasing use of Internet of Things (IoT) devices, and these medical devices introduce vulnerabilities into healthcare organizations. While infusion pumps are the most widely deployed connected medical devices, a recent study found that these devices are not the leading cause of security issues. In fact, imaging systems, the source of 51 percent of all security issues, rank as the top security risk, the study found.

Researchers at ZingBox, a Mountain View, Calif.-based Internet of Things (IoT) security software company, detected, identified and analyzed the behavior of medical devices deployed in more than 50 hospitals, clinics, and other healthcare locations. The researchers looked at a wide range of medical devices, from infusion pumps and patient monitors to imaging systems and medical device gateways, highlighting vulnerabilities in hospital networks and shedding light on the causes of common security events.

According to the report, over the course of 2017, the researchers analyzed tens of thousands of devices resulting in security issues covering vulnerabilities from user issues to outdated software. The study aimed to examine the makeup of a connected healthcare ecosystem and the common vulnerabilities introduced by IoT medical devices. The study findings also shed light on the environment of the medical devices including the network topology and segmentation, identifies the most common security issues plaguing the connected medical devices and recommends strategies to address these vulnerabilities.

Xu Zou, ZingBox CEO and co-founder, said the study results help to pinpoint not just where the vulnerabilities are, but what types of issues are triggering security issues.

“The report's findings closely mirror what we have been hearing from our customers about incidents, risks, and related challenges. Many organizations don't have a clear picture of the vulnerabilities on their networks — or even what devices are connected on those networks,” Zou said.

According to the report, the most common types of security risks were found to originate from user practice issues, such as using embedded browsers on medical workstations to surf the web, conduct online chat or download content, which accounted for 41 percent of all security issues.  Use of unauthorized applications (22 percent) and browsers (18 percent) make up the bulk of user practice issues and are the leading security issues for connected medical devices

This was followed by outdated OS or software such as the use of legacy Windows OS, obsolete applications and unpatched firmware, accounting for one-third (33 percent) all security risks found on connected medical devices.

The study found that close to half (46 percent) of all connected medical devices are infusion pumps, which represent potentially the largest attack surface for cyber threats. The study notes that the industry practice of device segmentation, if not configured correctly, can have a disastrous effect on such large numbers of devices. Lack of segmentation can have an unfortunate side effect of accelerating attacks and infections should a single device in the network be compromised. Despite the large attack surface, only two percent of security issues were due to infusion pumps.

“It is interesting to point out that while infusion pumps make up nearly 50 percent of connected devices in hospitals, they don't represent the largest cyberattack surface,” Zou said. “Security issues relating to infusion pumps were only at two percent. However, attention to protecting these devices should still be a priority since a successful attack on a single infusion pump could result in disabling the bulk of all infusion pumps through lateral movement and infection.”

Imaging systems are the second most common medical device deployed in healthcare organizations, according to the study, at 19 percent. Patient monitors are the third most commmon medical device, as 17 percent of organizations deploy these devices. In the study, the category of imaging systems not only includes X-ray, ultrasound, and magnetic resonance imaging (MRI) machines, it also includes image viewers, digital imaging and communications (DICOM) workstations, and picture archiving and communications (PACS) servers. Many of these devices are based on Windows OS and include apps such as web browsers, making them vulnerable to threats exploiting OS and application vulnerabilities, the study notes.

As noted above, imaging systems were found to have the most security issues, accounting for about half of all security issues across tens of thousands of devices included in the study.

Thet study notes that several characteristics of imaging systems attribute to it being the most risky device in an organization’s inventory. “Imaging systems are often designed on commercial-off-the-shelf (COTS) OS, they are expected to have long lifespan (15-20 years), very expensive to replace, and often outlive the service agreement from the vendors as well as the COTS provider,” the study authors wrote. “The distributed nature of imaging systems with devices, servers and various nodes interconnected, also contributes to many security issues.”

Imaging systems also have the most number of network applications of all connected medical devices included in this study with an average of seven network applications per device.

Micro-Segmentation is considered a standard practice of limiting lateral infection or movement and at the same time, enable efficient device management. By placing devices in Virtual LANs (VLANs), organizations can isolate like devices from other device types, the study states. The benefit of micro-segmentation can only be realized however, if organizations follow a sound practice of implementing and maintaining them on a regular basis.

The majority of hospitals (88 percent) have less than 20 VLANs containing medical devices. According to the researchers, this is far too few VLANs to successfully implement a micro-segmentation strategy for practically any size healthcare organization.

The study findings indicate that organizations are either not implementing enough micro-segmentations (as illustrated by the low number of VLANs, with 43 percent of organizations having 10 VLANs and 45 percent with 20 VLANs) or have gone to the other extreme of over segmenting the network, as noted by 100+ VLANs (two percent of organizations). The researchers expect more organizations to fill in the area in between as they implement tools and processes to gain additional visibility into the device context and use it for onboarding.

The study also found that medical devices are not the predominant devices found in medical VLANs. In fact, medical devices make up less than a quarter (23 percent) of all devices. PCs make up the largest device type in a typical medical VLAN at 43 percent. Aside from PCs, other non-medical devices such as printers, IP Phone, and surveillance cameras can also be found.

The study authors also contend that most connected medical devices cannot be protected via traditional IT means. With the advancements in AI and the focus on solutions specific to IoT devices, healthcare providers now have the tools to gain the visibility necessary to better protect and manage their devices and networks. Healthcare providers also can now get real-time insights into the medical devices deployed, network configuration and topology, security risk for each device, and their operational efficiency.

The report offered a number of recommendations:

  • Base security strategy on an accurate inventory of devices and network configurations.
  • Control rogue application and communications. Applying contextual enforcement policies based on the individual device types can greatly reduce the exposure to rogue applications and lateral movement of infection due to inappropriate use.
  • Develop strategies for top vulnerabilities and risks

 

 

The Health IT Summits gather 250+ healthcare leaders in cities across the U.S. to present important new insights, collaborate on ideas, and to have a little fun - Find a Summit Near You!


/news-item/cybersecurity/iot-report-imaging-systems-present-biggest-security-risk-healthcare
/news-item/cybersecurity/fda-released-draft-premarket-cybersecurity-guidance-medical-device

FDA Releases Draft Premarket Cybersecurity Guidance for Medical Device Manufacturers

October 19, 2018
by Heather Landi, Associate Editor
| Reprints

The Food and Drug Administration (FDA) has released draft guidance to the healthcare industry that updates cybersecurity recommendations for medical device manufacturers with the aim of addressing vulnerabilities and evolving cybersecurity threats.

The draft premarket cybersecurity guidance, Content of Premarket Submissions for Management of Cybersecurity in Medical Devices, identifies issues related to cybersecurity that manufacturers should address in the design and development of medical devices to ensure better protection of devices against cybersecurity threats that could interrupt clinical operations and delay patient care.

The new guidance is intended to provide recommendations to the medical device industry regarding cybersecurity device design, labeling and that FDA recommended documentation be included in pre-market submissions for devices vulnerable to cybersecurity threats. The recommendations build on the framework that the FDA created in its 2014 guidance for manufacturers.

According to the FDA, these updated recommendations also will facilitate an efficient premarket review process and help ensure that medical devices are designed to sufficiently address cybersecurity threats before the devices are on the market.

“Cybersecurity threats and vulnerabilities in today’s modern medical devices are evolving to become more apparent and more sophisticated, posing new potential risks to patients and clinical operations,” FDA Commissioner Scott Gottlieb, M.D., said in a statement. “The FDA has been working to stay a step ahead of these changing cybersecurity vulnerabilities, including engaging with external stakeholders. In this way, we can help ensure the health care sector is well positioned to proactively respond when cyber vulnerabilities are identified in products that we regulate.”

“Today’s draft premarket cybersecurity guidance provides updated recommendations for device manufacturers on how they can better protect their products against different types of cybersecurity risks, from ransomware to a catastrophic attack on a health system,” Gottlieb said in his statement, noting that the rapidly evolving nature of cyber threats necessitated an updated approach “to make sure [the guidance] reflects the current threat landscape so that manufacturers can be in the best position to proactively address cybersecurity concerns when they are designing and developing their devices.”

“This is part of the total product lifecycle approach to device safety, in which manufacturers must adequately address device cybersecurity from the design phase through the device’s time on the market to help ensure patients are protected from cybersecurity threats,” Gottlieb said.

As part of its focus on strengthening medical device cybersecurity, the FDA also announced this week an agreement with the Department of Homeland Security to increase collaboration on medical device security. The agreement, between the FDA’s Center for Devices and Radiological Health and DHS’ Office of Cybersecurity and Communications, is meant to encourage even greater coordination and information sharing about potential or confirmed medical device cybersecurity vulnerabilities and threats. Such collaboration can lead to more timely and better responses to potential threats to patient safety, the agencies said.

“Our strengthened partnership with DHS will help our two agencies share information and better collaborate to stay a step ahead of constantly evolving medical device cybersecurity vulnerabilities and assist the health care sector in being well positioned to proactively respond when cyber vulnerabilities are identified. This agreement demonstrates our commitment to confronting cybersecurity risks and the unscrupulous cybercriminals who may seek to put patient lives at risk,” Gottlieb said in a statement about the partnership.

With regard to the draft guidance issued this week, it incorporates new recommendations, including a “cybersecurity bill of materials,” which is a list of commercial and/or off-the-shelf software and hardware components of a device that could be susceptible to vulnerabilities. Depending on the level of cybersecurity risk associated with a device, this list can be an important resource to help ensure that device users are able to respond quickly to potential threats, the FDA said.

The draft guidance also introduces two tiers of devices—those with higher cybersecurity risk, including implanted devices such as pacemakers or neurostimulation devices, and standard cybersecurity risk, which includes devices that contain software—based on potential harm to patients from cybersecurity threats. The draft guidance outlines the documentation for inclusion in a premarket submission to the agency to demonstrate that the design of the medical device has adequately mitigated risk.

The FDA will hold a public workshop Jan. 29-30 to discuss the newly released draft guidance.

 

More From Healthcare Informatics

/article/cybersecurity/guest-blog-cybersecurity-shortage-closing-gap

GUEST BLOG: The Cybersecurity Shortage: Closing the Gap

October 17, 2018
by Mac McMillan, Industry Voice
| Reprints
The gap between the level of cybersecurity preparation that should exist in the current environment, and the reality, is both troubling and in need of closer examination

We are by all estimates well over a million cybersecurity professionals short of what we need and racing towards an even bigger shortage in the decade to come.  Current approaches are not likely to produce the number of cyber warriors we are going to need to close this gap.  Not for want of good intention, but I believe we won’t achieve our intended goal, because the environment has changed and if we don’t recognize this change we may never catch up.  There are multiple factors affecting this paradigm shift, but the biggest of them all is the rapidly evolving nature of technology that is moving at lightning speeds and the associated exponential growth in threat produced as a byproduct. 

Closely related is what this means for the rapidly expanding competency that cybersecurity professionals will have to possess just to be effective in the future.  We have known for decades that cybersecurity is a dynamically changing field affected by changes in the physical environment, changes in technology, the evolving nature of threat and the operational impacts of users.  The enterprise is never static, and every change presents a new opportunities and new risks.  If we take healthcare as one example of this just the past two decades have witnessed amazing changes in technology adoption, the rise of hyperconnectivity, the increase in the sophistication and frequency of attacks and the endless application of technology to operations, simple and complex.  This will move even faster in the future as technologists are already talking about faster processing speeds, quantum computing, artificial intelligence, etc.  Making it harder and harder for those who have to secure the enterprise to do that.

In fact, today’s cybersecurity professionals have to be as diverse as the thing they are trying to secure, meaning many different cyberwarriors with very different specializations.  Analysts, administrators, engineers, program experts, threat hunters, monitors, architects, etc.  Making it all the more impossible for current approaches to succeed.  The supply is not going to catch up with the demand one cyberwarrior at a time.  That ship has sailed.  All the college programs in the land, although important, are not going to get us there.  You cannot create a cyberwarrior army large enough, fast enough to solve this problem.  We need a different approach.

In today’s and tomorrow’s information technology environment, everyone who uses a computer will need basic cybersecurity skills, and everyone who works in IT will need specific job-related cybersecurity knowledge and we need both general and specialized cybersecurity professionals.  Individuals who write code should know how to do so with security in mind.  Database developers and administrators should understand the threats associated with what they are doing and how to avoid them.  System engineers should understand network security principles and how to apply them to what they do.  And on and on.  Information system designers, developers, manufacturers, consumers and users need to accept and embrace this basic requirement.  Curriculums from the earliest stage where information technology is introduced should include cybersecurity training.  Curriculums in career fields where information technology will be critical to accomplishing that skill should include cybersecurity training.  No information technology degree should be achievable without cybersecurity as part of the curriculum.  We should promote greater professionalization of the cybersecurity field to define specific career paths from the very specialized to the general practitioner to the strategist to ensure not only the expertise needed at the tactical level, but the professionals with the breadth and scope of knowledge and experience needed at the higher levels of responsibility to lead and develop effective cybersecurity strategies and programs. 

The gap between the good guys and the bad guys is growing, because we are still trying to solve the problem in the same antiquated way, one cyberwarrior at a time.  There is zero unemployment in the field right now, and many of the people filling cybersecurity roles today are only marginally competent.  Because not only does it take education in multiple disciplines to be become knowledgeable in the field it takes experience, which can only be attained in time.   We are never going to be successful following the path we’re on today.   We need to recognize the paradigm shift that has occurred and embrace the new reality.  Everyone who deals with information technology has to be part cyberwarrior.  Everyone has the responsibility to understand basic computer security skills and the cyber threats that can keep them from accomplishing their mission.  In the military we call this awareness of risk operational security and every soldier, sailor, airman and Marine from top to bottom is charged with understanding operational risks so they can mitigate them regardless of their job specialty.  

Some organizations are beginning to realize this new reality and are taking steps to change how they approach educating the workforce of the future.  One such organization is the University of Texas, which I had the pleasure of supporting recently, who is building a new graduate certificate program within their healthcare curriculum to train members of the workforce to move into healthcare, particularly former veterans.  What is unique about this curriculum is that they have integrated cybersecurity knowledge so that graduates of this program not only prepare themselves for a career in healthcare by learning practical skills, but they learn about where cybersecurity is important and why they need to understand it to be successful.  Their lab environment is unique in that it replicates the hospital experience, admissions, ER, the smart patient room, OR, radiology, pharmacy, etc. and in each lab cybersecurity will be taught along with the information technology associated with those environments as well as the cyber threats that affect both privacy and security there.  A curriculum that teaches not only practical skills needed to work in healthcare, but how to protect patient data and operations.  The program has included several experienced healthcare CISOs as contributing staff lending real world expertise to what they are building.  These are the type of visionary programs we need more of if we are going to close this gap in cybersecurity skills.

Mac McMillan is president and CEO of the Austin, Texas-based CynergisTek consulting firm.

 


Related Insights For: Cybersecurity

/article/cybersecurity/six-lessons-boston-children-s-hacktivist-attack

Six Lessons From Boston Children’s ‘Hacktivist’ Attack

October 17, 2018
by David Raths, Contributing Editor
| Reprints
CIO Daniel Nigrin, M.D., says hospitals must prepare for DDoS and ransomware

Most health system CIOs have heard about the 2014 attack on Boston Children’s Hospital by a member or members of the activist hacker group Anonymous. The hospital was forced to deal with a distributed denial of service (DDoS) attack as well as a spear phishing campaign. Yesterday, as part of the Harvard Medical School Clinical Informatics Lecture Series, the hospital’s senior vice president and CIO Daniel Nigrin, M.D., discussed six lessons learned from the attack.

Although the cyber-attack took place four years ago, there have been some recent developments. The attack was undertaken to protest the treatment of a teenager, Justina Pelletier, in a dispute over her diagnosis and custody between her parents and the hospital. In August 2018 Martin Gottesfeld, 32, was convicted of one count of conspiracy to damage protected computers and one count of damaging protected computers. U.S. District Court Judge Nathaniel Gorton scheduled sentencing for Nov. 14, 2018. Gottesfeld was charged in February 2016. 

 According the U.S. Department of Justice, Gottesfeld launched a massive DDOS attack against the computer network of the Boston Children’s Hospital. He customized malicious software that he installed on 40,000 network routers that he was then able to control from his home computer. After spending more than a week preparing his methods, on April 19, 2014, he unleashed a DDOS attack that directed so much hostile traffic at the Children’s Hospital computer network that he temporarily knocked Boston Children’s Hospital off the Internet. 

 In his Oct. 17 talk, Nigrin said cyber criminals still see healthcare as a soft target compared to other industries. “The bottom line is that in healthcare, we have not paid attention to cybersecurity,” he said. “In the years since this attack, we have seen ransomware attacks that have brought hospital systems to their knees. We have to pay more attention and invest more in terms of dollars and technical people, but it really does extend to entire organizations — educating people about what a phishing attack is, what a social engineering attack is. These need to be made a priority.”

He offered six lessons learned from Boston Children’s experience:  

Webinar

How to Assess IT Risk in a Healthcare Environment

In this webinar, Community Health System’s CISO Scott Breece and Lockpath's Sam Abadir will discuss the unique IT landscape of the healthcare industry and the challenges this presents for IT risk...

1. DDoS countermeasures are critical. No longer can healthcare organizations assume that a DDoS attacks are things that only occur against corporate entities, he said. “Prior to this event, I had never thought about the need to protect our organization against a DDoS attack,” he said. “I will submit that the vast majority of my CIO colleagues were in the same boat. And that was wrong. I think now we have gotten this understanding.”

2.  Know what depends on the internet. Having a really detailed understanding of what systems and processes in your organization depend on internet access is critical, Nigrin stressed. You also mush have good mitigation strategies in place to know what to do if you lose internet access — whether it is because you have a network outage due to a technical issue or a malicious issue. “As healthcare has become more automated and dependent on technology, these things are crippling events. You have got to know how you are going to deal with it ahead of time. Figuring it out on the fly is not going to work.”

3. Recognize the importance of email. Email may be seen as old-school, Nigrin noted, but it is still the primary method to communicate, so you have to think about how you can communicate and get the word out in scenarios where you don’t have email or lose voice communication. “In our case, we were super-lucky because we had just deployed a secure texting platform, so we could do HIPAA-compliant texting, and when our email was down, that was how we communicated, and it was very effective,” he explained.

4. Push through security initiatives – no excuses anymore.  Because he is a doctor himself, Nigrin feels OK picking on doctors about security. Historically they have always pushed back on security measures such as dual-factor authentication. He paraphrases them saying “Come on, Dan, that is an extra 10 seconds; I have to carry a secure ID, or you have to send me a text message on my phone. It is a pain. I don’t want to do it. I am the highest-paid employee in your organization and that is time better spend on something else.” But Nigrin argues that we can’t afford to think like that anymore. He used the Anonymous attack as an opportunity to push through four or five security initiatives within the next two to three months when he had everyone’s attention. “The platform was burning, and the board of trustees was willing to expend the money to pay for it all. They all of a sudden recognized the risk.”

5. Securing audio- and teleconference meetings. Nigrin said this topic wouldn’t have occurred to Boston Children’s until they were warned by the FBI. “The FBI told us about an attack that affected them when they were dealing with Anonymous. When Anonymous was attacking the FBI, the FBI convened internal conference calls on how to deal with it. Anonymous had already breached their messaging platform and intercepted the calendar invites that invited everyone to dial in. Anonymous basically was called into the meeting. Within 30 minutes of one of those meetings, the entire audio transcript of the conference call was posted to YouTube. “So we took heed of that and made sure that when we had conference calls, we sent out PINs over our secure texting platform,” he said.

6. Separating signal from noise. During the attack, Boston Children’s set up a command center and told employees: if you see something, say something. “We didn’t know what attack was coming next. We were flying blind,” Nigrin said. “We started to get lots of calls into our command center with reports of things that seemed somewhat suspicious,” he remembers. People got calls on their cell phone with a recorded message saying your bank account has been compromised. Press 1 to talk to someone to deal with it. “Today we would recognize this as some type of phishing scam and hang up,” he said, “but at the time it was sort of new. People started calling us and we didn’t know if this was Anonymous trying to get into the bank accounts of our senior clinicians. Was it part of the attack? It was tough for us to detect signal from noise.”

In the Q&A after his presentation, listeners were curious about how much the incident cost the hospital. Nigrin said there two big costs incurred: One was the technology it had to deploy in an emergent way to do DDOS protection and penetration testing. The other was revenue lost from philanthropic donations. Together they were close to $1 million.

Another person asked if the hospital had cyber insurance. Nigrin said they did, but when they read the fine print it said they were covered only if they were breached and technically they were never breached, so the insurance company was reluctant to pay. Although they eventually got compensated for a good share of it, the hospital also made sure to update its policy.

Still another attendee asked Nigrin if ransomware attacks were still targeting hospitals. He said they definitely were. “Think about community hospitals just squeaking by on their budgets,” he said. “They don’t have millions to spend, yet their data is valuable on the black market. Attackers recognize we are dead in the water as entities if we don't have these systems. We have important data and will do anything to get our systems back up and running.”

Nigrin said even large health systems can be vulnerable because some technology they deploy is run by third-party vendors who haven’t upgraded their systems. An example, he said, might be technology to record videos in the operating room setting. Some vendors, he said, are not accustomed to thinking about security. They are unable to update their software so it works on more modern operating systems. That leaves CIOs with a tough choice. “We can shut off the functionality or take the risk of continuing to use outdated and unpatched operating systems. Those vendors now have woken up and realize they have to pay more attention.”

 

 


See more on Cybersecurity

betebettipobetngsbahis