Upload
lyminh
View
214
Download
0
Embed Size (px)
Citation preview
Cybersecurity in Healthcare: From the sidelines to the headlines
Sean P. Murphy CISSP, ISSMP, CPHIMS, FACHE, HCISPP, CIPP / IT
By way of introduction…
Sean Murphy
FACHE, CPHIMS, CISSP-ISSMP, CIPT, HCISPP
Vice President, Chief Information Security Officer Premera Blue Cross, Seattle, WA
Retired Air Force Medical Service (Lieutenant Colonel)
Experience in military and civilian healthcare organizations as CIO, CISO, and CTO
Chair, HIMSS Privacy and Security Committee (2010)
(ISC)2 Committee to establish HCISPP credential (2014)
Job Analysis and Exam Writer
Author of multiple chapters, white papers, and conference speaker to include “Healthcare Information Security and Privacy,” (2015) McGraw Hill
Served as founder, officer, working group member, and active member of affiliated local professional groups over many years
Agenda
The road to here for healthcare
How times have changed
−Sideline to headlines
Cybersecurity enters healthcare
Peeking forward
Questions / Comments / Criticisms
SOURCE: ID Experts: Ponemon Study;
Third Annual Benchmark Study on Patient
Privacy & Data Security ; Dec 2012 ;
Infographic included
• Breaches are epidemic • Often multiple per org • Data loss is costly • It is getting worse • Healthcare lags behind • Patients are affected
The road to here in healthcare
The road to here in healthcare
Electronic healthcare record implementation > 75%
− As of 2011, over 150 EXABYTES {1000 (1018)} of data; projected to double / year
Every healthcare customer has a requirement to analyze / mitigate risk
− Monitoring and incident response emerging as “must-have” as well
HIPAA Omnibus Final Rule increased accountability; adds 3rd party risk
Daily headlines on security breaches; rising to Board Level Concerns
Healthcare organizations are not in the business of providing world-
class cybersecurity; the adversary is world-class
HIPAA is not prescriptive; but getting it wrong is costly (fines/penalties)
Healthcare depends on interoperability and sharing
Unlike financial records, medical record misuse is hard to rectify
(A detour on our road) What
is a medical device?
The challenge in cybersecurity starts with telling the difference
between a medical device and any other IT computing platform
(A detour on our road) What
is a medical device? Used for diagnosis, treatment, and
therapy
Sensors, Imaging, Measures, Alerts, and
Radiation to name just a few functions
Special purpose, regulated by US Food
and Drug Administration (FDA)
IMHO—this has been a key dependency for
implementing cybersecurity in healthcare
(A detour on our road) What is a
medical device?
Not always digital or networked, but
they increasingly are.
X-ray, MRI, Infusion Pumps, Pacemakers
Also, movement toward implantable,
ingestible, and wearable inter-connected
devices
(Detour continued) Increase
in embedded IT & networking BAN and PAN are medical
networks using the hospital network
Federal Communications Commission (FCC) authorized specific frequency for BAN
Protocols: RFID, DICOM, IEEE 802.11x / WiFi, Bluetooth, ZigBee (2.4 GHz), IEEE 11073, medical instrumentation bus
10
WAN
MAN
LAN
Personal Area Network
Body Area
Network
(Detour continued) Increase
in embedded IT & networked
Body Area
Networks
Home health
networks
In hospital
settings, allow
free movement
of patient and
around patient
11
(Merging back on our road)
Impact of cybersecurity: patient
care / safety IT = Mission Critical while CE = Life Critical
One size IT security best practices, indiscriminately
applied without manufacturer evaluation = patient
safety risk
(Merging back on our road)
Impact of cybersecurity: patient
care / safety Health Org’s do not manufacturer med devices
Even after purchase…(21 CFR Part 820)
Regulated independently
FDA plus international standards
Clinicians (customers) are not asking for cyber
capability…
they want (pay for) clinical capability
(Merging back on our road)
Impact of cybersecurity: patient
care / safety Health Org’s do not manufacturer med
devices
Even after purchase, manufacturer
is key
Medical device incident reporting
process
Patch management
Access management
• SOLUTION?:
Implement best practices from banking, military, telecomm, etc.
• IMPACT:
Usually, intended.
-- compliance
-- privacy
-- security
Often, unintended.
-- risk
-- patient safety
(Back on the road) The road to here in healthcare
How times have changed: from the sidelines
to the headlines
• Over 50% of breaches come from
employees or business associates
(HITRUST)
• 35% of breaches were lost or
stolen laptops (2013) (Redspin)
• Unauthorized use second-most
prevalent source of data breach
• Current “hacking” attacks
make up 11%, but the
number is growing
• Of these, 11% were phishing
• Ransomware, intentional
attacks, monetized medical
records increasing
(healthITsecurity)
FUTURE
• EHR and Health Information
Exchange increases risk
• State-sponsored terrorism will
target healthcare (MGMA
2014)
• Detection and correction are
becoming the imperative
(Gartner)
Traditional breach 2015 Year of
Cyberattack Data Focus
Fifth Annual Benchmark Study on Patient Privacy and Data
Security, Poneman Institute (2015)
How times have changed: from the sidelines
to the headlines
High Costs Of
Healthcare Data
Breaches
• Abnormal Churn
• Reputation
• Board Action
• Delay care
• W / hold info
• TRUST
• Investigations
• Fines & Penalties
• Class Action law suits
• Identity theft / false claims
• Availability of information
• Security at any cost
How times have changed: from the sidelines to the headlines
High Cost of Healthcare Data Breaches
Source: Fifth Annual Benchmark Study on Privacy and Security of Healthcare Data, Ponemon Institute
How times have changed: from the sidelines to the headlines
“Near-misses”
(non-data breaches
that still require
detection and
escalation) increase
costs
Source: Ponemon Institute/Symantec
High Cost of Healthcare Data Breaches
How times have changed: from the sidelines to the headlines
High Cost of Healthcare Data Breaches
Source: Gartner BYOD Survey
How times have changed: from the sidelines to the headlines
And now the headlines…
HEALTH IT SECURITY | September 8, 2015
(Major Academic Medical Center) joins list of largest health
data breaches of 2015
USA TODAY | April 14, 2015 “I had no idea (they)
had my data. Why did
(they) have my data?”
I-HEALTH BEAT | June 1 2015
(Indiana Health System) is notifying
about 220,000 patients of a breach that
could go back as far as November 2013
“Mean time to
discovery (MTD) is
around 270 days”
Health data breaches sow
confusion, frustration
Behind the headlines:
Settlement Costs and Fines
Increasing
SE
TT
LE
ME
NT
S
Company
Date of
Breach/
Settlement
No. of
Records
Type of
Records
Settlement
Fund Basis
AvMed
(Florida)
2010/
Jan. 2014
1 million Social Security
Numbers and
Health records
$3.1 M Partial refund of insurance premiums
(up to $30 per individual) for not
receiving the level of security
promised.
Stanford
University
(CA)
2009/
Apr. 2014
20,000 Health records $4.1 M Patients will receive $100 each and the
hospital will have to fund a program
for 2 years that trains medical
professionals to protect patient
records.
FIN
ES
Entity Date
Fine
Amount Cause
New York
Presbyterian/
Columbia University
May 2014 $4.8 M Improper deactivation of a server containing personal
information.
Triple S
Management
Feb. 2014 $6.8 M Failure to take all required steps in a breach.
WellPoint Jul. 2013 $1.7 M Leaving confidential information accessible over the internet.
Cybersecurity enters healthcare
Old Reality New Reality
“Keep them out” “Stop them on the inside”
Servers in the datacenter Services in the cloud
Users connecting to the office network
from corporate computers
Users connecting from the Internet on BYOD
and mobile
Dumb malware targeting everyone Smart, deliberate attackers targeting you
Attackers exploit vulnerabilities Attackers exploit accounts
Protect the systems:
- Patch vulnerabilities
- Anti-virus catches malware
Systems are always vulnerable:
- Attackers can compromise any server
- Attackers can compromise any endpoint
- Any Internet access is an entry point
Network architecture:
- Web servers in the DMZ
- Everything else in “trusted internal
network”
Network architecture:
- Protect the servers from the users
- Use segmentation to contain breaches
Accounts are safe with username and a
strong password
Strong authentication is necessary to
protect accounts from compromise
Prevention Detection and Response
Cybersecurity enters healthcare: Current
Security Methods are Not Sufficient
Source: Chris Williams (Leidos Cybersecurity)
with modifications from Sean Murphy (Leidos Health)
IDS = intrusion detection system VPN = virtual private network
Cybersecurity enters healthcare
Protect
Identity
Detect Correct
Recover
Risk Assessment
Continuous
Security
Monitoring
Incident
Forensics
Security
Management
Security
Training
• Primary Sources of Information Protection Workforce
Privacy
Medical Technician
InfoTech
Health Information Management
Legal
Risk Management
Clinical Engineering
Device System Administrators
Super Users (Lab, Rad, Pharm)
Internal IT Staff
Other Industry
Cybersecurity enters healthcare:
CyberSecurity Talent Search
• Getting to the desired competencies
Privacy
Medical Technician
IT Security
Ethical/Legal
Program Management
IT Security
Incident Reporting
Healthcare
Clinical Engineering
Manufacturer/Vendor Risk
Specific Medical Device
Clinical Workflow
IT Security
Patient Safety
Admin, Technical, and
Physical Controls
Business Continuity
Disaster Recovery
Telecommunications
Healthcare Industry
Regulatory Environment
Privacy and Security in Healthcare
Information Governance and
Risk Management
Third Party Risk Management
Cybersecurity enters healthcare: Cybersecurity Talent Search
Peeking forward
1. Emphasis on detection
2. Less reliance on the endpoint and server
3. Application whitelisting
4. Network segmentation
5. Two-factor authentication
6. Log aggregation and security incident event management (SIEM)
7. 24x7 security monitoring and incident response
8. Incident rapid response teams
9. Forensics tools and capabilities
10. Security incident metrics
− Build defenses around disrupting the attack sequence
− Don’t believe that “by doing everything right” you will be immune
− Measure attacks and defenses using metrics
Peeking forward
This is a national security concern: − Healthcare is a critical infrastructure
− Hacktivists, organized crime, nation states are at our door (in our house?)
− The data is being monetized
Crystal ball: − Cyber offense continues to get easier and more complex
− Cyber defense is a battle against complexity, patience, purpose
− Cloud, mobile and BYOD only make the defense harder
− No silver bullets from technology, ever
− Rapid change though, so you need to stay current
− Focus must be on swift detection and response
− Speed of attacks is going to increase
− Automated attacks will necessitate automated defenses
− Attackers will improve, share info…we must too
Peeking forward
What healthcare cyber pros should do: −Make sure security is a management priority
−Build defenses around disrupting the attack sequence
−Don’t believe that “by doing everything right” you will
be immune
−Measure attacks and defenses using metrics (threat
intelligence)
−Affiliate locally, participate as much as you can,
network!
Agenda
The road to here for healthcare
How times have changed
−Sideline to headlines
Cybersecurity enters healthcare
Peeking forward
Questions / Comments / Criticisms
Cybersecurity in Healthcare: From the sidelines to the headlines
Sean P. Murphy CISSP, ISSMP, CPHIMS, FACHE, HCISPP, CIPP / IT