Karen Epper Hoffman

home

authors

karen-epper-hoffman

Far larger than the searchable surface web, the “dark” web is becoming a more sophisticated marketplace for finding illegal goods like underage pornography, prostitutes, and illegal drugs. And its role in exchanging personal information, like credit card information and—healthcare records&mdash;is also growing.

Highly prized by cybercrooks, the data held by medical providers, from doctors and dentists to hospitals and insurance companies, might fetch several times the going rate of financial records because they include more information that can be used for fraud and malfeasance, including insurance details, medical background, and family information. In 2016 alone, there were 355 major breaches that affected at least 15 million healthcare records at hospitals, dental clinics, senior care facilities, and other organizations, according to the Identity Theft Resource Center.

“The cybercriminal ecosystem relies on the acquisition and trade of information, including financial and personal information,” says Michael Marriott, an analyst at the cybersecurity research firm Digital Shadows. Although financial information is the most popular data for sale, as it is quicker to monetize, victims can change or reset their passwords and credit card numbers, Marriott points out.

Protected health information (PHI), on the other hand, is prized because the exposed data is often “non-volatile, [meaning] you can’t simply reset this information, and so there is a far longer tail,” Marriott says. Indeed, the complete and often unchanging nature of healthcare records means they draw as much as $7 per record on the dark web, while credit card numbers or other basic financial data might earn a dollar or less.

This past summer, in July 2017, one dark web listing offered the sale of as many as 1 million medical records—a move that resulted in the firing of an employee at the global health insurance company Bupa. The company accused that individual of stealing data from more than 100,000 customers, according to 

. The trove included customer information, birth dates, nationalities, and other administrative data.

And that was far from the most egregious dark web healthcare data dump. Last year, another anonymous bad actor offered datasets from 3 unspecified US healthcare institutions for sale on another dark web marketplace.

Just 4% of the internet is visible to the general public, according to Dustin S. Sachs, associate director for Navigant Consulting, a company that examines the dark web and provides other related services. The “clear web” is where most people conduct all of their online business, like checking email, Facebook, and Twitter, and buying things from Amazon and other popular sites. But the clear web that most people know and use is merely the “tip” of the internet iceberg. The other 96% of the web is made up of the deep web, a subset of the internet that cannot be found by search engines like Google—this includes all web pages that are behind membership logins, company and organization web pages used internally, and data like medical records, financial files, and academic databases, as well as the more malevolent dark web, a black market brimming with data, drugs, and services.

“Despite the fact that the dark web has indeed become home to many online criminal denizens, who do indeed use this channel for their illicit and illegal dealings around the globe, this largely undiscovered portion of the internet does serve another larger role in connecting its users,” says Sachs, speaking on dark web commerce at the ISC(2) Congress in Austin, Texas, this past September.

The deep web holds 7 times as much data as the surface internet, according to Sachs. Ironically, the dark web itself was originally created in the early 1990s by the US Navy, to communicate with secret operatives in parts of the world where it was not safe or advisable to pass information through public channels. Even in recent years, despite its negative aspects and uses, the dark web has become a channel through which citizen reporters share news and access social media from countries that strictly control other forms of media, Sachs notes.

With this in mind, what can healthcare organizations do to better protect their data?

Education programs that promote the access and availability of affordable care treatments in the mainstream market could help deter people from going to the dark web. Providers should also be aware of potential Health Savings Account (HSA) fraud. HSA fraud has evolved substantially over the past year, becoming more difficult to detect, as HSA accounts typically have less subscriber and institutional oversight. Recent estimates suggest that there are more than 20 million existing HSA accounts that hold nearly $37 billion in assets, which represents a year-over-year increase of 22% for HSA assets and 20% for accounts. 

Bryan Hurd, MBA, senior executive at Versive, an artificial intelligence-fueled cybersecurity technology vendor, says that utilizing innovation in the healthcare industry should include a strong set of community requirements for security from start to finish of a product or service. “Ultimately, there are a variety of strategies and tactics healthcare CIOs and CISOs can deploy to protect against dark web-fueled cyberattacks,” says Hurd. “CIOs, CISOs, and security managers and analysts should monitor and fix those vulnerabilities present in their networks that currently have one-day exploits on sale in the dark web.”

Articles

Electronic medical records have become a valuable commodity for criminals on the dark web. The problem might get worse before it gets better.

Combating the Dark Side of Healthcare

As the medical industry becomes more technologically decentralized by innovations such as mobile devices, hospital equipment that runs on IP protocols, and sensors in almost everything, keeping healthcare secure is becoming a more complex task.

The growing evolution of this so-called “Internet of Things” in enterprises was a hot topic at the recent 

. Presenters and attendees described this new age of IoT as one in which corporate users can stay connected and more easily track patients, medications, and developing situations—and also one in which criminals will have more, potentially less-secure areas of access to healthcare organizations.

A recent study by the Ponemon Institute found that while 67% of medical device makers say  they anticipate their devices will be attacked within the next year, a mere 17% have taken major steps to prevent attacks. According to IT researcher Gartner, one quarter of all digital security attacks will be directed through IoT devices and machines. It is this kind of mismatch that has given IT decision-makers a false sense of security about the coming changes in their more connected environments. Three-quarters of IT department decision-makers say they are “confident” or “very confident” that all the medical devices and equipment on their networks are indeed secure, a security survey of more than 200 healthcare IT professionals released in July by ZingBox found.

“In today’s healthcare environment, everything from patient monitors, imaging systems, smart beds, IV pumps, home patient monitors and more are IoT driven,” says Dean Weber, chief technology officer of Mocana, a secure technology provider, which recently introduced its own IoT platform. “If there is anything that recent news has taught us, it is where there are connected devices, there are vulnerabilities and cyber-attacks.”

Since security experts know many of the vulnerabilities that exist—ranging from no security to issues associated with authentication on multiuser medical devices&mdash;Weber says the industry needs to implement strong encryption.

The ZingBox study found that more than 9 out of 10 healthcare IT networks already have IoT devices in their system—and often as many as 10 to 15 of these Internet protocol-driven devices per hospital bed.

In healthcare, Weber says risk is measured in terms of loss of life, human safety and reliability of the systems. While data privacy is critical, “compromised systems directly [affect] patient care and can put the patient’s privacy at risk.”

“For this reason,” Weber adds, “it is imperative that these devices meet the traditional compliance standards, but also maintain strong cryptographic controls, including multi-factor authentication, secure boot, secure update, and secure, encrypted communications.”

Black Hat 2017: Key Cybersecurity Vulnerabilities for Healthcare Systems

Black hat 2017: Hacking Healthcare Devices, Stopping Hearts and ‘Jacking’ Brains

Nuance Details Damages from NotPetya Attack: Money Lost, but PHI Safe

These are the vulnerabilities in the current health IT landscape.

Black Hat 2017: Securing the Internet of Things

The culmination of several factors has made the healthcare industry a perfect target for cybercriminals. Understanding those factors, experts say, is critical to creating a more secure industry moving forward.

Cybersecurity experts provided background and clarity on the factors that have led to cyber vulnerability, and the state of healthcare cybersecurity at the recent Black Hat conference in Las Vegas. Healthcare organizations including hospitals, have a couple of key things that so-called “black hat,” or bad-guy, hackers want: valuable information and money, experts explained.

Ransomware has been a large and growing cybercrime scheme for more than two years, according to information security insiders at Black Hat. And healthcare organizations, including hospitals, are in the crosshairs of many of these malicious attacks. This is due in part, experts say, to how hospitals went about moving to paperless workflows. By rapidly digitizing their data to enhance accessibility, many healthcare organizations overlooked securing their new digital records as they transitioned to paperless processes and systems.

Also, with patients’ lives sometimes hanging in the balance, hospital and medical providers often pay less attention to information security in the name of fast, accurate care and responsiveness. Understandable as these priorities may be, they are creating a perfect storm for malicious hacking groups to use phishing emails or exploit other system vulnerabilities to wedge into the healthcare company’s networks and take over their data stores. And the beauty of the scam for the hackers is that they do not even need to steal this illegally accessed information, or resell it, at greater risk to themselves from law enforcement—they simply demand a ransom be paid by the victim organization, usually in untraceable Bitcoin.

Black Hat 2017: Hacking Healthcare Devices, Stopping Hearts and ‘Jacking Brains’

The desire on the part of organized cybercriminals and talented script-kiddies alike to make money with their online attacks is driving them to steal, or exfiltrate, sensitive patient data (including Social Security numbers, addresses, insurance information, family and health background) or organizational data, which they can later sell on the dark web. Cyber-criminals are also using their digital skills to infiltrate health organization networks and lock down or encrypt the organization’s own files and information, with the threat that if the organization does not pay a “ransom” the criminals will destroy the data — creating tremendous potential patient risk, regulatory exposure, and damage to the organization’s reputation if they fail to comply.

Case in point: Last February, Hollywood Presbyterian Medical Center in California made headlines throughout the country when it became public that the hospital had been the latest to fall prey to ransomware attackers, who demanded $17,000 in the alternative online currency in order to regain access to their locked-down systems and encrypted data. Other hospitals and healthcare companies across the United States have seen similar attacks and had their information and systems ransomed, but many never make their attacks public.

A report on the growth of ransomware from the Institute for Critical Infrastructure Technology [ICIT] predicted that 2016 would see a big leap in ransomware attacks because of the ease of attack (technically and logistically speaking) and the high financial upside, as compared to risks, for the attackers. Healthcare companies are typically more motivated than other industry sectors to pay the money and retrieve their access because of the potential danger to human life if patients get sick or die while their networks are hung up and inaccessible, experts say.

Hospitals Were Collateral Damage in Colossal Cyber Attack

Massive International Ransomware Attack Hits Merck, Pennsylvania Hospital

Should Healthcare Systems Be Concerned About Hidden Cobra

Recent advances in technology have not only given way to new and better machines to test our health and potential for disease, but increasingly to implantable medical devices that can regulate the rhythms of the heart, manage a diabetic’s insulin levels, or take other life-saving measures.

However, with these terrific new rewards come potential risks — particularly the ability for these medical devices to be breached, shut down, or otherwise manipulated by a person who is able to exploit these devices’ wireless capabilities.

According to digital security researchers and vendors at the recent annual 

 conference in Las Vegas, hacking medical implanted devices has been a concern for several years and remains a growing threat as nefarious hackers, organized cyber-crime rings, and adversarial nations become increasingly more sophisticated and well-funded. Case in point: The recent massive 

, which locked down hospital medical records and hit radiology and MRI machines, could have spread to implantable devices as well, creating widespread device outages or possibly even deaths, according to information security insiders.

While death by hacking sounds a bit extreme and morbid, the reality of these attacks has been under close investigation by researchers for at least five years, and potential vulnerabilities have already emerged. In 2016, research scientists in the United Kingdom, at Oxford and the University of London published a study that they had conducted, testing how people using a deep-brain stimulation (DBS) neuro-stimulating device — often given to Parkinson’s disease sufferers &mdash; were susceptible to so-called “brainjacking.” The U.K. research paper outlined that an attacker could exploit the device’s connectivity flaws to turn off the DBS device or ruin the battery, thereby causing tissue damage, potentially changing the behavior, causing pain or affecting impulses in the device’s wearer.

Indeed, the ability to hack or compromise such medical implantable devices may have first gained public notice when prominent security researcher Barnaby Jack at a security conference in 2012 demonstrated exactly how a malicious hacker could take over and execute 

a fatal attack on someone with a pacemaker or defibrillator

. The following year [2013], former Vice President Dick Cheney told a 60 Minutes interviewer that it was due to fear of assassination by hack that he had previously had the wireless capabilities shut off on his own pacemaker. [Researcher Jack, who also contended that the U.S. government and medical developers need to do more to protect implantable device patients, died of a drug overdose in 2013, on the eve of a demonstration he was set to give at that year’s Black Hat conference on the hackability of medical implantables.]

The area remains a hot topic, as well as a concerning one, for the medical device and information security communities alike. Recently, a security researcher from information security vendor Rapid7 discovered that his Johnson & Johnson diabetes pump was able to transmit information unencrypted, a security gap that could allow potential attackers to “sniff” out a way to remotely pump more insulin, or withhold it, which could cause hypoglycemia in a diabetic patient. [The Rapid7 researcher notified the Johnson & Johnson company, Animas Corp., that makes the pump, and the vulnerability was patched.]

Two Quick Steps to Jumpstart Your Cybersecurity Plan

Google Finds Another Privacy Controversy in Healthcare

Researchers at Black Hat USA described the growing threat of hacked medical devices.

Karen Epper Hoffman

Articles

Combating the Dark Side of Healthcare

Black Hat 2017: Securing the Internet of Things

Black Hat 2017: Key Cybersecurity Vulnerabilities for Healthcare Systems

Black Hat 2017: Hacking Healthcare Devices, Stopping Hearts and 'Jacking' Brains