It'saplotrightoutofHollywood:Nefarioushackersgainaccesstoaworldleader'spacemakerandthreatentoassassinatehimunless$10millionarewiredtoanoffshoreaccount.It'savaguelyfamiliarplot,isn'titTVthrillerHomelandhadasimilarepisodein2012.Orperhapsyouhaveafaintmemoryofheadlinesfrom2007whenthenVicePresidentDickCheney,motivatedbyconcernsthathispacemakercouldbehacked,haditswirelesscapabilitydisabled.
Cheney'spacemakerwasneverhacked,butthefactremainsthatitcouldhavebeen.Andwhilethehumanriskofmedicaldevicevulnerabilityhas,sofar,beenrelegatedtothescreen,itisnotoutoftherealmofpossibility.Increasingly,securityexpertswarnthatmedicaldevicesareparticularlyvulnerabletoattack.
Asevidencedbyheadlinessuchas"MedicalDevicesAretheNextSecurityNightmare,""WhenMedicalDevicesGetHacked,HospitalsOftenDon'tKnowIt,"and"HackersPoseDangertoPatients,"thewarningbellsarebeingsounded.Still,it'stoughtodiscerntherealrisks.
BrianWells,chieftechnologyofficerforcybersecuritycompanyMerlinInternational,citesastudyconductedlastyearinwhichsevenpacemakersfromfourvendorswerediscoveredtohavemorethan8,000hackablevulnerabilities.
"Theresearchersdiscoveredunencryptedpatientdatastoredontwopacemakers,withonethatincludednames,phonenumbers,medicalinformation,andSocialSecuritynumbers.Allofthepacemakershadoutdatedsoftware,withknownvulnerabilities,"hesays.
Thispointstotherealconcernwithmedicaldevicevulnerability.Thegameisstillaboutthedata.Whileitmakesforamoredramaticmovieplot,hackersaren'tgoingafterindividualsorspecificdevices—atleastnotyet.
"Thedeviceisn'tnecessarilywhattheywant—it'swhattheycanfindonthenetworkoncetheygetin,"saysKevinMeany,cofounderandchieftechnologyofficerforVersatile,anITproviderforhealthcareandothersectors."Medicalrecordsareahugecommodityonthedarkweb."
LesleyBerkeyheiser,areviewerfortheElectronicHealthcareNetworkAccreditationCommission(EHNAC)andHITRUSTpractitioneratN-tegritySolutionsGroup,agrees."Themainreasonisstillmoney.PHI[protectedhealthinformation]ontheblackmarketisstillworthalotofmoney.Acybercriminalisgoingforbiggermoneyandbiggerpopulationissues,"shesays.
WhyMedicalDevicesMedicaldevicesaremorevulnerabletocompromisebecauseoftheirinabilitytobeupdated."Thesearedevicesthatdon'thaveagents.Youcan'tinstallantivirussoftwareonthem.Youcan'tputantimalwareonthem,"Meanysays.
ForJeffSchmidt,vicepresidentandchiefcybersecurityinnovatorforColumbusCollaboratory,implantabledevicesepitomizetheinherentweaknessesoftheseconnected,inaccessiblemedicaldevices.
"It'sadeviceyouprobablydon'thavephysicalaccessto,andthey'renotdesignedbysoftwareengineers.They'renotdesignedbypeoplewhothinkaboutremotepatchingandupgradability,"hesays."Ifyoudofindaflaw,whatdoyoudoRequireeveryonetogotothehospitalandhavesurgery"
Ofcourse,somedevicesaremorevulnerablethanothers.Wellspointstovendor-createddevicesthatdonotrunonstandardoperatingsystemssuchasWindows,Mac,orLinux.Whenaskedhoworganizationsknownonstandardvendorsareupdatingtheirdevices,hebluntlyanswers,"Well,theydon't."
Schmidtagrees,notingthatthegreatestpositiveimpactoninformationsecurityhasbeenMicrosoftWindows'auto-update."Theabilityforyouroperatingsystemtoupdateitselfhashadsuchagiganticpositiveimpactonsecurity,"hesays.
AccordingtotheAmericanHospitalAssociation,"Softwarecompanieshavegenerallyprioritizedcreatingasystematicapproachforsharingtimelyupdatesandprovidingguidanceonhowtocompletethem.Similarapproacheshaveyettobedeployedbymedicaldevicemanufacturers."
Inshort,thesameprincipleofautomaticpatchingmustberequiredofmedicaldevicemanufacturers."In2018,nobodyshouldbebuyinganythingthatthey'regoingtodeployremotelythatisnotremotelyupdatableinsomesaneway,"saysSchmidt,whorecommendsorganizationsusetheirbuyingpowerinordertopositivelyinfluenceresponsiblesecuritydevelopmentbymanufacturers.HepointstotheMayoClinic,whichrequiressecuritytestingofallmedicaldevicespriortopurchase.
HowIt'sHappeningThegoodnews,ifitcanbecalledsuch,istherearenonewtricksupthehackers'sleeves.Medicaldevicesarecompromisedinthesamewaysnetworkshavetraditionallybeenbreached.
AsWellsputsit,"Thebadguysusetheusualapproaches—openfirewallports,phishing,etc—togetintothenetwork,andthentheymoveontothedevices."
SchmidtechoesWells,"They'rekillinguswithphishing.It'sunreasonablethatweexpectMabelinaccountingtobeabletodistinguishbetweenamaliciousandnonmaliciouse-mailattachment.That'safailureofmyindustrythatwehaven'tbeenabletomitigate."
Meanyillustrateshoweasilythesecompromisescanoccur.Recently,hetookhis14-year-oldforacheck-up.Whilehewasinthephysicianwaitingroom,hedecidedto"pokearoundonthewireless"fromhiscellphone.Hewasn'tsurprisedbywhathefound.
"Basically,theyhadtoomanySSIDs[servicesiteidentifiers]advertisedoutintheirwirelessspace."WhatMeanydiscoveredwasseveralprintersonthenetwork,aknownflawwherebyprintersadvertisethemselvesonthenetworkfordirectprinting.
"Vendorsdothattomakeiteasyforusers,butit'snotsecure,"hecontinues,"Onceyougetpastthatperimeter,it'sprobablyprettywideopen."
Conceivably,Meanycouldhavebreachedaprinterandprobedthepractice'sentirenetworklookingforvaluabledata.Whilemostpeoplehavelearnedtheimportanceofmaintainingstrongpasswordsontheircomputers,manyofthedevicesoperatingonthesamenetworksdonothavethesamelevelofpasswordprotection—ifany.Vulnerabledevicesonaflat,unsegmentednetworkhavebecomethekeystothekingdom.
Schmidtexplains,"Devices[can't]havedefaultpasswords.Howmany"username:admin,password:admins"arethereHowmanysharedcredentialsarethereYouknowthere'sonevideocamerasystemthat20peopleneedtogetaccesstoandtheyallusethesameusernameandpassword."
MedicalDevicesandIoTSchmidt,Meany,andWellsallmentiondecidedlynonmedicaldevicesintheirdescriptionsofhowcompromisesoccur.Fromprintersandsecuritycamerastointernet-enabledthermometersandsprinklersystems,theissue,atleastforsecurityexperts,islessaboutmedicaldevicesthanitisaboutdevicesingeneral,orthings,asintheInternetofThings(IoT).
Berkeyheiserhighlightsthisdifficulty:"Itgetsreallysquirrely.WouldyouconsidermyphoneamedicaldeviceItdepends.WhatifIhavetheKardiaMobileapponmyphone"
WiththerapidexpansionofIoT,lookingnarrowlyatthevulnerabilityofanysubsetofdevices,medicalorotherwise,canbelimiting.Yes,thedevicesthemselvesarevulnerablelargelyduetotheirinabilitytobepatchedorupdated,buttheirconnectivityonopen,flatnetworksis,perhaps,thebiggerandmoreeasilyremediedproblem.
"Takeaninsulinpump,"Berkeyheisersays."Ifthedataonitfeedtothephonewhichcanfeedtothelaptopwhichcanfeedtothedoctor'soffice,youcanseethatyoufollowtheflowofthedata."Thevulnerabilityoftheinsulinpumpitselfisonethingbutthevulnerabilityofthenetworkisanotherlevelaltogether,sheadds.
NetworkSegmentationEachoftheexpertsinterviewedbroughtuponesolutionthateveryhealthcareentityshouldbeemploying:networksegmentation.
"Healthcareorganizationsshouldconsidertheimplementationofacomprehensivenetworksegmentationarchitecturetocreateanentirelyseparatenetworkenvironmentsolelydesignatedformedicaldevices,"Wellssays."Ifattackerscompromiseadevice,there'sonlysomuchharmtheycandobecausethedeviceis'walledoff'fromeverythingelsewithintheenterprise."
Schmidtbreaksitdown:"ThereisnoreasonwhyMabel'sdesktopinaccountingshouldbeabletotalktothesecuritycameraorthethermostatorviceversa.There'snoreasonthevideocamera,onceitgetshackedup,cangotalktoMabel'smachineinaccounting.Yet,inmanyenterprises,thatishowitis.Everythingisflat."
"Perimeterprotectionisn'tenough,"Meanysays."Wehavetobringitinside."
Encryptioniskey."Forsegmentationtowork,youneedstrongencryption—evenbetterthanwhatweuseforphones—tocloseeverythingoff,"Wellssays.
SpottingHackedDevicesOnceabadactorhaspenetratedthenetworkandbegunwanderingaroundlookingforvaluabledata,thetrickbecomesfiguringoutthebreachhasoccurredandshuttingitdown.Meanydescribeswhydiscoverymaybedifficultwithoutfingerprinting.
"Thenetworkhasbecomealivingorganism,"hesays.Therefore,it'snecessarytoknowthebaselinebehaviorofeachdeviceonthenetwork.Anultrasoundmachinebehavesinacertainway.Aheartmonitorbehavesuniquelyaswell.Byestablishinga"fingerprint"foreachdevice,Meanymonitorsnetworkbehavior.
Hedescribesapossiblescenario:"Oneday,theheartmonitorstartstalkingtootherserversorgoingouttotheinternet.Itneverdoesthat.NowI'mseeingbehaviorthatdoesn'tmatchthefingerprint.Icanalertonthoseandshutitdownimmediately."
Schmidtadds,"Netflowonhumannetworksisdominatedbytherandomnessofhumanbeings.Humanbeingsaren'tsuperpredictable,sotheyhaveverystrangenetworktraffic.Butifyoulookatamedicaldevice,refrigerator,thermostat,anykindofdevicepluggedintoanetwork,they'revery,verypredictable."
Wellswarnsthatbadbehavioronthenetworkmaynotalwaysbethateasytoidentify."Goodhackersgenerallydon'tsignalwhatthey'redoing—theytakeprideinstayingstealthy.Tothem,that'stheartofwhattheydo,"hesays.
Meanydoesacknowledge,"[Hackers]cansitdormantforalongtime,likelittleagentswaitingforcommands."Thetrickistowatchthenetwork;eventuallyyouwillseeactivity,henotes.
DefensiveMeasuresAsanEHNACreviewer,Berkeyheiserandhercohortsemphasizetheimportanceofvoluntaryaccreditationprograms."Wetrulybelievethatsettingforthbestpracticesacrossprivacyandsecurity,followingtheflowofthedata,implementingthelifecycle,constantlyusingrisk-basedapproachestoestablishwhereissuesareandconstantlymitigatingthem,allthosethingsinaprogramforaccreditationorcertificationwillreallyhelptheindustry,"shesays.
BerkeyheiseralsopointstoworktheONChasdoneinpushing"continuousqualityimprovementandtheadoptionofproductlifecycle."InJanuary,theONCannouncedtheformationofTEFCA(TrustedExchangeFrameworkandCommonAgreement),whichplanstoreleaseamoredetailedoutlineofvoluntaryguidelinesforbestpracticestandardsbeforetheendoftheyear.Theguidelineswillincludelanguageaboutdevicelifecycle.
"Someworrythathealthcarewon'ttakemedicaldevicevulnerabilityseriouslyuntilacataclysmiceventoccurs,"Berkeyheisersays.
ForMeany,whosejobitistopreventsuchanevent,theanswerforhisclientsis"near-zerotrustlevelsofsecurity,"adding,"Thatisunfortunatelywherethisworldistakingus."
"Weneedtothinkaboutsecurityinadvance,"Schmidtsays."That'ssomethingsecuritypeoplealwayssayandweneverdo.Ifsomeoneissittingdowntodesignanewthingamajigger,theyshouldthinkaboutwhattheriskprofileis,whatthethreatmodelis,howweneedtosecurethisthing,whoisgoingtoneedtoaccessitandunderwhatconditions,[and]howarewegoingtoupdateandpatchitinadvance."
Berkeyheieserwouldarguemuchoftheadvanceworkhasbeendone;it'sonlyamatterofapplyingwhat'salreadybeenlearned."IgobacktomybasicHIPAAsecurityfrom2005and2006whenitwasimplemented.It'sstillthesame,"shesays."Itdoesn'tmatterifit'sHIPAAsecurityfordoctorsandhospitalsorifit'smedicaldevicemanufacturers.Theorganizationneedstoadoptappropriatetechnicalcontrols."