Sonia Arista, CISM, National Healthcare Lead, Fortinet

home

authors

sonia-arista-cism-national-healthcare-lead-fortinet

Cybercriminal organizations have targeted the global healthcare industry from the moment it first began to place patient medical, PII and billing information into a connected network.

During the first five months of 2019, healthcare organizations continued to bear the brunt of this pattern of continuous attack. These ranged from targeted attacks involving phishing and customized ransomware to the use of more traditional tactics such as common exploits, malware and botnets. The examples below serve as a takeaway so that we can learn from what has come before.

 were older vulnerabilities, allowing attackers to do things from gaining initial access into environments to even enabling an attacker to execute arbitrary code, including malicious malware. A variety of recent campaigns using these and also newer vulnerabilities have been used to target healthcare facilities.

Malware is used to gain network access, as well as to perform malicious tasks once a network perimeter has been breached. Of the top malware variants found during this analysis, the two fell outside traditional malware techniques. Adware and riskware were among the top malware detected. While many perceive this sort of malware as merely a nuisance, many variants also drop additional malware through a strategy known as malvertising, which injects legitimate online advertising with malware to infect unsuspecting end users.

The other is the Android/Generic.AP malware that targets Android mobile devices. This trojan, if successfully installed on a phone, can establish remote access to its infrastructure, capture keystrokes, collect system information, download/upload files, perform denial-of-service attacks and run/terminate processes. In healthcare networks with BYOD policies, compromised phones can become a conduit for introducing additional malware and gaining unauthorized access.

Of the top 10 botnets affecting healthcare networks, five are mainstays across all industries. Three of the most worrisome are Gh0st RAT, Bladabindi and WINNTI.

Gh0st RAT contains a remote administration tool that includes the typical abilities to take full control of the victim machine, log keystrokes, log webcam and microphone data, and more. Bladabindi is also known as njRAT, and it possesses similar capabilities to Gh0stRAT, but it can also steal stored credentials such as usernames/passwords and other PII. It’s important to note that last year, a fileless version was identified in the wild with wormlike capabilities, and it could propagate by infecting thumb drives. WINNTI contains a trojan that has been used in many targeted campaigns by cybercriminal groups such as Winnti and Axiom.

In addition to traditional exploit, malware and botnet activities, there has also been a spike in targeted attacks. The Orangeworm threat actor group has been identified deploying an older trojan called Kwampirs that targets the systems of MRI and X-ray machines and siphons their configuration data.

The SamSam ransomware, which combines the destructive payload of ransomware with more targeted keyboard attacks, has been targeting the healthcare industry for the last year or so. While many types of ransomware remain relatively unsophisticated, 

 additional capabilities being developed and additional malware being included with the ransomware payload, which should worry security administrators.

Many attacks target older vulnerabilities to gain initial access into the network or to distribute malware. Best practices involve a four-tier process:

Update those systems when new versions are released.

Replace systems that cannot be patched or updated.

Deploy adequate proximity controls for systems that cannot be replaced.

Ensure you have the visibility within your network to identify where your vulnerabilities are and the right information to access the overall risk to the organization. To do this, make sure you know the following:

 — It’s crucial that you understand your mission-critical business processes and the systems those processes utilize. In healthcare, it is imperative that your strategy aligns with protection of critical revenue-generating service lines, or clinical care areas that cannot withstand downtime. 

 — You need a dynamically updated inventory of every asset on your network, including the operating system, applications, data, services, processes, configuration settings and vulnerabilities of each asset. Pay particular attention to services and areas of the business where remote access is prevalent, for example telemedicine or remote clinics.

 — Get familiar with your extended network topology and where and how all applications, workflows and data move. Given the high use of SaaS applications in any given environment, be sure to understand your partner’s cloud infrastructure and security controls.

 —  Devices and other sorts of analysis, monitoring or treatment systems connected to the network need to be particularly identified and secured. Many of these devices are mobile, so they need to be tracked as they move among hospital departments and, in some cases, patients’ homes. 

Many attacks leverage trusted tools already on your internal systems, a process called “living off the land.” Some of these are administrative tools, so malicious activity can be misinterpreted as normal. Understand how such tools function and take measures to harden their functions, restrict their access and baseline normal usage so unexpected activity triggers an alert.

Educate Users about Mobile Device Malware

Attackers target mobile devices with corporate access (email and other business applications) to get into the network. However, detecting a phishing email or malicious activity on a mobile device is often more difficult than on a traditional laptop. In fact, cybercriminals are renowned for intentionally launching malware during peak workforce “in transit” timeframes such as lunch and traffic hour, understanding they will get a better response rate!  Ensure that mobile threats are included in your user awareness training program.

downloading malicious programs disguised as legitimate apps pulled from unofficial app stores or email links,

the use of malicious short links in text messages and social media apps that link to malware or infected sites, and

fake Wi-Fi access points in public places that can result in Man-in-the-Middle attacks.

Attackers that gain network access continue to drive deeper into the network to complete whatever goal they are trying to achieve. To reduce the overall impact of these efforts, implement intent-based segmentation in your network. This sort of “continual resistance” can limit lateral movement, slow down attacks and even discourage attackers — giving you more time to detect and mitigate these attacks.  

Ransomware is one of the most common payloads of targeted attacks. Proper preparation includes offline backups, scanning backed-up data and running restoration drills so recovery can be fast and painless. On the business side, talk through these scenarios with your head of communications, operations and finance - and have a plan at the ready.

As long as the global healthcare Industry manages and stores personal, medical and PII data on patients, they will continue to be a prime target for cybercriminals. However, such attacks not only put data at risk but also critical services and even patient lives as it relates to cyber attacks on medical devices. It is essential that the security teams responsible for the care and protection of the data and devices strung across healthcare campuses continuously remain aware of the latest threat trends, practice essential security hygiene and take the steps outlined above to establish and maintain a baseline of security for patients and staff alike.

Sonia Arista is a seasoned Information Security and Technology specialist with over 20 years’ experience. At Fortinet, she is responsible for the go-to-market strategy, solutions and sales growth for the company’s healthcare and life sciences business

Report: How Hackers Attack Healthcare, Compromise Cybersecurity

Patient Records Compromised in Breaches Doubled in First Half of 2019

Why Healthcare Is So Vulnerable to Ransomware and What We Can Do About It

Articles

Malware, adware, trojans and other pests from the past and future rear their heads. 

Cyberattack Threats to Watch For in Healthcare So Far in 2019

Reviewing and responding to current threat intelligence is an essential part of any organization’s cybersecurity strategy. However, the need to regularly consult threat data and update defenses is amplified in the healthcare space, where interruptions to networks can be life-threatening. This is especially true as health systems become more reliant on technology and connected devices tied directly to patients and critical patient care. In addition, the average healthcare organization spends 

 recovering from a breach, which impacts hospital revenue and can severely undermine reputation and trust — two cornerstones of patient experience and retention.

To minimize the risk of successful cyberattacks, security and IT teams must be constantly aware of the new methods designed to infiltrate networks and translate this into new tactics in their security efforts.

While security teams need to remain abreast of all major threat trends — even those that seemingly only target other industries &mdash; there are a few standouts from the most recent 

, which examines data collected during Q1 of 2019, that could specifically impact healthcare.

This refers to a style of attack that appeared consistently throughout Q1. Cybercriminals leverage pre-installed tools, such as PowerShell, that come on targeted systems and can be exploited to launch attacks. This approach facilitates evasion, as the malicious code that is injected appears to be part of a sanctioned process, making it harder for security teams to detect and define. PowerShell, which comes installed on Windows machines, is one of the most popular targets for these types of attacks. Cybercriminals use PowerShell to deliver ransomware and other malicious payloads, to encrypt data and move laterally across the network.

This is a tactic that healthcare IT teams must be highly aware of, especially given the number of IoT devices connecting to the network. Health systems are constantly deploying new connected tools as part of patient treatments, many of which were not built with security in mind. To address this, IT teams should conduct regular checks on devices to ensure no pre-installed tools have been compromised, thereby acting as an entryway into the network.

There have been several high-profile ransomware attacks this year, which have demonstrated a high degree of targeting and planning. In fact, in one instance of LockerGoga, the attackers had already done the due diligence to gain privileged credentials that enabled the execution of the malware. With these credentials, they were able to operate with minimal evasion or obfuscation tactics deployed. This indicates that they had already evaluated the network defenses and determined these measures unnecessary.

Anatova was another standout ransomware in Q1, encrypting as many files as possible and ensuring minimal chances of restoration. Overall, it looks as though criminals are moving away from a purely opportunistic model of malware distribution to focus on specifically selected networks.

With this in mind, health systems must strengthen their malware defenses and ensure they have current data backups. Hospitals are known to be targets for ransomware attacks, as they are more willing to pay to reclaim data, most likely due to deficiencies or poor planning in data recovery and continuity processes. Upon payment of the ransom, reclaimed data may be corrupted or missing, leading to a potential impact on patient safety.

Evaluating the types of websites being leveraged and the phase in the cyber kill chain at which they were accessed provides insight into how cybercriminals structure their attacks, helping with defense efforts. It was interesting to note when pre- and post-compromise activity occurs. Pre-compromise activity is three times more likely to occur during the workweek, as there is often unintentional employee involvement. Post-compromise activity, however, occurs fairly consistently across weekdays and weekends, as little to no user interface is required.

This brings to mind an important point about segmentation. Healthcare is an industry of constant uptime. The emergency department network, for example, must be running at all times, including the weekend, and cannot be halted or slowed due to an attack. However, there are other departments that close. Should a device belonging to that department log on during off time, such unusual behavior could be an indicator of an attack. Compromised systems operating during irregular business hours to initiate or extend attacks, or to move laterally across the network, could possibly affect high-need networks like the ED. This is why healthcare systems should segment essential networks to add an extra layer of defense while isolating those devices exhibiting anomalous behavior until their intention can be determined.

Final Thoughts on Health IT Cybersecurity

Healthcare systems are common targets for cyberattacks. Staying aware of popular attack vectors and strategies enables IT teams to better secure crucial network functions. Moving forward, health IT teams should keep these Q1 findings in mind and fortify defenses accordingly.

Sonia Arista is responsible for the go-to-market strategy, solutions and sales growth for the healthcare business at 

Medical Informatics Engineering Pays $100K for Data Breach of 3.5M Patients

How Important Is Protecting Patient PHI to Your Vendors?

Health Execs Say Vendors Are the Worst Cyberthreat. But Most Don’t Vet Partner Security

To minimize risk, health IT teams must be aware of new methods being used to infiltrate networks.

3 Trends Plaguing Healthcare Cybersecurity & How to Fight Them

The digital and physical worlds are not just intersecting — they are merging. And it seems clear that there are few places where the implications of such convergence pose greater risk than in the healthcare industry, where lives are literally on the line.

To better understand the risks and concerns of this latest trend, Fortinet recently surveyed members of the College of Healthcare Information Management Executives (CHIME), a professional organization for chief information officers (CIOs) and other healthcare IT leaders.

The survey reveals two noteworthy trends regarding the state of security in healthcare — as well as what care providers need to do next.

1. Physical Security and Cybersecurity Converging

Three-quarters of survey respondents ranked the integrating of physical controls and cybersecurity as “critical” or “important.” That’s because respondents also identified that this issue will only become more acute over time as physical security systems increasingly connect to the network. Physical security is used to lock down sensitive hospital areas and to protect electronic patient data stored in medical devices, computers and data centers — as well as to secure access to stored paper documents. But most physical access controls to data-sensitive areas (e.g., key card readers and number pads) do not collect or analyze access data or share that information with other security systems.

Of course, correlating data from physical systems with an organization’s broader cybersecurity architecture can help reduce risks and better identify compromised patient data from sources inside the organization. Last year, 

 came from insider threats. Sharing data between physical access controls and cybersecurity solutions — such as identity and access management (IAM), network access control (NAC) or user and entity behavior analytics (UEBA) solutions &mdash; can help organizations more effectively detect suspicious user or device activities.

However, according to Fortinet’s recent 

, six of the top 12 exploits identified in Q4 2018 were Internet of Things (IoT)-related — and four of those twelve were related to IP-enabled cameras. IoT devices are notoriously vulnerable to attacks, and access to these security devices represents a serious threat for healthcare institutions. Compromised cameras could not only be used to obscure malicious onsite activities or prevent healthcare providers from monitoring patients, but they could also open an entry point into connected cybersystems from which cybercriminals could launch DDoS attacks, steal PII information, initiate ransomware attacks and more.

2. Demand for and Risk of IoMT Remain High

While the Internet of Medical Things (IoMT) keeps growing, most healthcare organizations are still unprepared to address the security concerns they are introducing. In rating security priorities for 2019, survey respondents listed IoMT device protection at the top: 60% ranked this as a “critical” or “high.” However, almost three-quarters (71%) of survey respondents also admitted that they are still in the process of segmenting their networks to protect these devices — and the patients who rely on them &mdash; from compromise.

Like traditional IoT, most IoMT devices lack built-in security capabilities. Not only can they not defend themselves, many cannot even be patched. Even more alarming, many of them include hard-wired backdoors to allow vendors to troubleshoot these devices remotely.

This inherent vulnerability exposes organizations to significant risk. Cybercriminals in search of electronic medical records (EMR), for example, or opportunities to disrupt broader institutional services, are increasingly targeting IoMT devices. Of course, network segmentation gives healthcare IT and security teams a more comprehensive view of internal traffic, allowing them to detect anomalous activities associated with compromised IoMT devices. And at a minimum, medical devices and sensitive patient data should have their own dedicated network segments to ensure threats are detected and mitigated faster than with edge protection alone.

However, traditional network segmentation isn’t enough to defend against today’s advanced threats. Instead, intent-based segmentation needs to be implemented due to its ability to efficiently and dynamically translate business intent into the “where,” “how” and “what” of network segmentation. This functionality shortens the time needed to provide fine-grained access control, and those segmentation rules can be automatically adjusted based on continuous trust assessments of users and device behaviors. As part of an integrated security architecture, intent-based segmentation is essential for effectively improving an organization’s defensive posture, mitigating risks, supporting compliance and boosting operational efficiency.

At more than half of surveyed organizations, physical security is overseen by building and maintenance teams, with virtually no interaction with the cybersecurity team. In fact, fewer than one-third of organizations track and measure physical security at the CEO level at all — and only 17% of organizations involve their boards of directors in decisions related to physical security policy.

In the era of digital transformation, however, where physical security and cybersecurity solutions are being converged, executives now need to be able to measure risk and track it on a regular basis. As a result, 

security now needs to be elevated to a line-of-business concern for C-suite executives

 and boards of directors. Without an effective and comprehensive security strategy in place that addresses both physical and cybersecurity concerns, the costs of a major data breach that compromises this new attack vector could cripple or even kill an organization.

 suggest, there are some critical areas of concern that need immediate attention. While the merging of physical and digital tools and the continued adoption of IoMT devices in healthcare deliver better patient outcomes at lower costs, for these trends to be successful they must be fully integrated in the organization’s overall security solutions strategy.

To accomplish this, business and security leaders must work together to identify new points of exposure and implement security strategies designed to protect vulnerable patient data while reducing risk exposure. For many organizations, this requires creating and deploying a fully integrated security architecture that delivers threat-intelligence sharing, visibility, control and automation across the distributed network for consistent management and orchestration that close the gaps between converging technologies and networked environments.

Sonia Arista is a seasoned Information Security and Technology specialist with over 20 years’ experience. At 

, she is responsible for the go-to-market strategy, solutions and sales growth for the company’s healthcare business.

How HHS Is Addressing Cybersecurity Threats

Consumers Are Not Prepared to Handle Cybersecurity Threats, Report Finds

Why Experts Think e-Commerce Hacker FIN6 Is Moving Into Healthcare

What healthcare organizations need to do to protect their patients from data breaches.

Sonia Arista, CISM, National Healthcare Lead, Fortinet

Articles

Cyberattack Threats to Watch For in Healthcare So Far in 2019

3 Trends Plaguing Healthcare Cybersecurity & How to Fight Them

New Healthcare Survey: Cyber and Physical Convergence Increases Cyberthreat Risk