When Looking at Security, Consider Every Device
Internet of Things to Complicate Compliance.
When evaluating security, organizations must evaluate every device that is connected to the Internet, whether directly or through the company's network. This includes everything from radiology software systems, to VPNs, to video conferencing equipment, to printers and faxes. The more devices that are connected, the more difficult this process becomes. The move to the Internet of Things is sure to exacerbate this problem as organizations have that many more devices to monitor and control. Healthcare providers should take steps to prepare now by enrolling their devices into device management programs, taking stock of devices that are owned by the company or owned by employees but used for company purposes (e.g., smartphones, tablets, etc.), and implementing processes to receive and address security incident warnings from those outside of an organization, who may not be business associates.
In February 2014, the SANS Institute, with support from Norse, published a report summarizing findings from a year-long analysis of cybersecurity threats in the healthcare industry. The amount of data collected was specific to the healthcare industry:
During the sample period [(September 2012 and October 2013)], the Norse threat intelligence infrastructure—a global network of sensors and honeypots that process and analyze over 100 terabytes of traffic daily—gathered data. The intelligence data collected for this sample included:
- 49,917 unique malicious events
- 723 unique malicious source IP addresses
- 375 U.S.-based compromised health care-related organizations [1]
The organizations that were compromised varied in size and financial resources:
About a third of the organizations represent small providers, while the rest represented clearinghouses, health plans, pharmaceutical companies and other types of medical organizations. Some of these providers were also quite large, with renowned research centers and teaching hospitals among the sources sending out the malicious packets. [2]
Interestingly, while most of the largest data breaches reported to the HHS Office of Civil Rights to date involved business associates, SANS found that a large percentage of the malicious IP traffic emanated from healthcare providers, with covered entities accounting for 78.6% of the compromised organizations:- Health care providers—72.0% of malicious traffic
- Health care business associates—9.9% of malicious traffic
- Health plans—6.1% of malicious traffic
- Health care clearinghouses—0.5% of malicious traffic
- Pharmaceutical—2.9% of malicious traffic
- Other related health care entities—8.5% of malicious traffic [3]
Most strikingly, SANS noted:
Many of the organizations were compromised and, therefore, out of compliance for
months, and some for the duration of the study—meaning they never detected their compromises or outbound malicious communications, nor did they acknowledge warnings from the Norse response team.[4] While it seems surprising that any organization would ignore a direct notice of an on-going security compromise, particularly an organization trusted with sensitive healthcare data, it is not unheard of (see e.g., the pending FTC case against LabMD, which was allegedly brought to the FTC by a security firm, and the FTC settlement with HTC America, where the FTC alleged that HTC ignored vulnerability reports from security experts [5]). But, as we continue to see data breaches in the healthcare space as well as healthcare providers becoming the victims of cyberattacks—such as the attacks against each of Anthem Inc. and Premera Blue Cross—healthcare providers will need to implement stronger policies and procedures to ensure that security warnings are not ignored.
These monitoring programs must include all systems and devices on the organizations' infrastructure. In its analysis, SANS evaluated the types of systems and devices emanating malicious traffic and found a wide variety of systems and edge devices. See Figure 1 below[6]. Many of these devices—particularly network-connected edge devices such as printers, faxes, web cameras, and video conferencing systems are often overlooked as the source of security vulnerabilities, despite being recognized as potential entry points for hackers and cybercriminals.[7]
Specifically:
- Connected medical endpoints. The findings of this study indicate that 7 percent of traffic was coming from radiology imaging software, another 7 percent of malicious traffic originated from video conferencing systems, and another 3 percent came from digital video systems that are most likely used for consults and remote procedures. . . .
Security systems and edge devices. In this study, most of the malicious traffic passed through or was transmitted from VPN applications and devices (33 percent), whereas 16 percent was sent by firewalls, 7 percent was sent from routers and 3 percent was sent from enterprise network controllers (ENCs). This indicates that the security devices and applications themselves were either compromised, which is a common tactic among malware families, or that these “protection” systems are not detecting malicious traffic coming from the network endpoints inside the protected perimeter—inside the firewall or behind the VPN concentrator. . . . [8]
[1] Barbara Filkins, Health Care Cyberthreat Report: Widespread Compromises Detected, Compliance Nightmare on Horizon, SANS Institute Whitepaper, 3, Feb. 2014.[2] Id.
[3] Id.
[4] Id.[5] LabMD Inc. v. Tiversa Holding Corp. et al., Case No. 2:15-cv-00092, U.S. District Court for the Western District of Pennsylvania (Jan. 21, 2015); Press Release, Federal Trade Commission, HTC America Settles FTC Charges It Failed to Secure Millions of Mobile Devices Shipped to Consumers: Company Required to Patch Vulnerabilities on Smartphones and Tablets, Feb. 22, 2013, https://www.ftc.gov/news-events/press-releases/2013/02/htc-america-settles-ftc-charges-it-failed-secure-millions-mobile.[6] Filkins, supra note 1, at 8.
[7] Nicole Perlroth, Cameras May Open Up the Board Room to Hackers, NYTimes.com, Jan. 22, 2013, https://www.nytimes.com/2012/01/23/technology/flaws-in-videoconferencing-systems-put-boardrooms-at-risk.html
[8] Filkins, supra note 1, at 7.
-------------------------------------
Posted by Tatiana Melnik on March 28, 2015
|
November 2024
| Su | Mo | Tu | We | Th | Fr | Sa |
| | | | | 1 | 2 |
| 3 | 4 | 5 | 6 | 7 | 8 | 9 |
| 10 | 11 | 12 | 13 | 14 | 15 | 16 |
| 17 | 18 | 19 | 20 | 21 | 22 | 23 |
| 24 | 25 | 26 | 27 | 28 | 29 | 30 |
|
Blog Home
Newest Blog Entries
7/23/15 Hospital Settles with OCR for $ 218,400 Over Cloud-Based File Sharing
6/8/15 Two California Privacy Bills to Watch in 2015
3/28/15 When Looking at Security, Consider Every Device
3/9/15 Alabama Board of Optometry Makes Final a Rule on Telemedicine
1/25/15 Indiana Court of Appeals Upholds $1.44 Million Jury Verdict Against Walgreen Co. in a Privacy Breach Case; Denies Rehearing
12/9/14 Malware Leads to a $150,000 OCR Settlement with a Behavioral Health Provider
11/30/14 Can a Board of Medicine Use the State’s Prescription Drug Database in Investigating Physician Actions?
11/29/14 Under the Florida Telemedicine Rule, Can a Physical be Conducted by Telemedicine?
11/19/14 Wearables and the Challenge for Consumer Device Makers
10/28/14 A Few Telemedicine Resources
10/27/14 FCC: The Newest Regulator to Throw its Hat into the Data Privacy and Security Ring
Blog Archives
July 2014 (1)
December 2013 (5)
August 2014 (4)
June 2015 (1)
June 2014 (3)
May 2014 (6)
February 2014 (4)
September 2014 (1)
April 2014 (6)
October 2013 (9)
March 2014 (3)
July 2015 (1)
October 2014 (2)
November 2013 (3)
November 2014 (3)
March 2015 (2)
January 2014 (4)
January 2015 (1)
December 2014 (1)
Blog Labels
EHR (2)
Healthcare Competition (1)
Social Media (2)
Big Data (3)
Dental (1)
BYOD (2)
Medical Marijuana (1)
Telemedicine (7)
Security (1)
FAQ (6)
Healthcare Fraud (1)
Financial Services (1)
Marketing (1)
Mobile Apps FDA (2)
Privacy Litigation (3)
Identity Theft (1)
Mobile Apps (2)
Data Breach (10)
Meaningful Use (4)
HIPAA (3)
Employment (1)
Privacy (4)
FCC (1)
|
