ICS security in healthcare: why software vulnerabilities risk patient safety

Personal Health Information (PHI) is protected by The Health Insurance Portability and Accountability Act (HIPAA), which states that any person’s past, present, and future information provided to a health care provider must be collected, stored, shared, and maintained under HIPAA conventions.

Hospitals need tight cybersecurity, as the U.S. government has warned of new malware attacks on health care systems. These attacks are increasing at an alarming rate, and they pose a severe threat to hospitals and patients by blocking access to important medical information. In Q3 of 2021, 68 ransomware attacks were carried out against healthcare institutions.

Ransom groups target healthcare more frequently because they believe that by attacking this industry, they can get money quickly due to the urgent need for medical data and the widespread notoriety created by such an attack.

Moreover, cybercriminals also threaten to publish or sell the data online, which is leading to more companies willing to pay the ransom than ever before. Federal authorities are continually working to educate the healthcare sector about ransomware prevention.

Medical Device Misconfigurations – A Significant Threat to ICS

Ensuring the safety of patients who use medical devices begins with asset management, i.e., registration of all medical IoT devices in a healthcare setting.

It is vital to understand medical IoT security configurations and any vulnerabilities that may compromise patient safety. Misconfigurations, when left unaddressed, can lead to privacy breaches, especially at public database portals.  It is all the more important when you consider that many of these devices are old, outdated, and using end-of-life operating systems. It can get very difficult to update device configurations or apply security patches.

Mobile devices have eased access and data sharing, but this has also led to a greater risk of privacy breaches, identity theft, ransomware, and other cyber-attacks. Many healthcare institutes allow login to portals from mobile devices. These mobile devices are not secured or do not have any security standards. Unsecured devices have high chances of ransomware, malware, and privacy breach attacks.

Systems that enable medical IoT device administration should be protected with multi-factor authentication, and reliable authorization methods in order to gain access. 

It is also important to note that hospitals worldwide use medical devices with the default passwords they came with. This is a clear invitation for an attacker to take control of devices and manipulate their behavior, putting patient safety at risk.

Additionally, many of these connected medical devices are left with SSH, FTP, and other standard management protocols open for anyone with the means to access them. In fact, sometimes they are even connected to the internet, unprotected and without any firewall to stop access.

In many cases downloading malicious applications and software from unverified and non-trusted sources is a big reason for privacy breaches on mobile devices. These attacks can compromise the security of employee data within the medical portal or application.

The Cost of Ignoring Cybersecurity for Hospitals

Over 600 ransomware attacks on U.S. healthcare institutions cost more than $21 billion in 2021. Another report estimates the average cost of a healthcare cyber-attack at $6.45 million. Malicious attacks on hospitals cost $4.45 million on average.

Weak and outdated cybersecurity systems can be a primary reason for such breaches and financial losses. It is better to invest in new and more reliable technology for cybersecurity than to lose tons of money in such attacks.

Protect Your Hospital and Healthcare Institutions

Hospitals and medical entities are very attractive targets for malicious actors and cyber attackers. It is essential to protect these institutions’ sensitive data against potential cyber risks.  An inability to take necessary measures, and failure to secure hospital and patient data under HIPAA can result in penalties and legal action against responsible persons and departments.

There is no denying that the implementation of internet-connected medical devices has been lightning fast, leaving no time for IT experts to automate the management or update processes of these devices.

It is imperative that healthcare service providers take their ICS security seriously, fix or update software as necessary, and move on to true smart devices. These practices can help them manage and mitigate risk in existing infrastructure to ensure that patient privacy and safety goals are met.

About the Author: Isla Sibanda is an ethical hacker and cybersecurity specialist based out of Pretoria. For over twelve years, she’s worked as a cybersecurity analyst and penetration testing specialist for several reputable companies – including Standard Bank Group, CipherWave, and Axxess.

Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.