Electronic Health Reporter

Guest post by Moshe Ben-Simon, co-founder and vice president of services and research, TrapX Security.

Healthcare is a major market in the United States with annual expenditures that consume almost 17.4 percent of the gross domestic product. Healthcare in the U.S. includes 893,851 physicians, 2,724,570 registered nurses, including physician’s assistants and administrative staff that support them. Additionally, there are approximately 5,686 hospitals that support these professionals directly. The great majority of physician practices now have electronic medical records (EMR/EHR) systems that are all interconnected with the rest of the ecosystem.

The typical hospital is replete with Internet connected systems and medical devices. These devices are also connected to EMR systems that are being deployed at a fast pace across practices and hospitals because of government incentives, such as meaningful use. This creates a highly connected community that brings the most vulnerable devices together with some of the highest value data.

Medical records = big money for organized crime

Healthcare data presents a compelling opportunity for organized crime. Cybersecurity firm Dell Secure Works notes that cyber criminals were getting paid $20 to $40 for health insurance credentials, compared with $1 to $2 for U.S. credit card numbers prior to the Target Breach. The Federal Bureau of Investigation (FBI) issued a private industry notification (PIN) report in April 2014 that noted cyber-attacks will increase against healthcare systems and medical devices because of lax cybersecurity standards and a higher financial payout for medical records in the black market.

As of Mar. 30, 2015, the Identify Theft Resource Center (ITRC) has healthcare breach incidents at 32.7 percent of all listed incidents nationwide. Per ITRC, for the first quarter of 2015, more than 99,335,375 medical records have been exposed and compromised in the United States alone.

As in other industries, the attackers in healthcare may be standalone operators or part of larger organized crime syndicates. The great majority are clearly after valuable healthcare data and economic gain. Health insurance credentials can have a value 20 times that of a credit card on the hacker black market. These attackers know that healthcare networks are more vulnerable and provide greater potential rewards. They have already determined that these vulnerabilities are so extreme as to make healthcare the easiest choice for their attack.

Despite the latest/greatest perimeter network security technology, hackers continue to get in

The risk for ongoing data exfiltration, theft and subsequent HIPAA (Health Insurance Portability and Accountability Act) violations has never been higher. Basic defense-in-depth cyber security products seem to be failing at an increasing rate. The concept of defending a perimeter around hospital networks no longer works against a variety of cyber-attack vectors. Recent studies suggest that most hospitals are unaware of active attackers likely hiding within their medical devices inside their networks already.

These medical devices have become the key pivot points for attackers within healthcare networks. They are visible points of vulnerability in the healthcare enterprise and the hardest area to remediate even when attacker compromise is identified. These persistent cyber-attacks threaten overall hospital operations and the security of patient data.

Most hospital information technology teams are managing a very heavy workload. They must deal with a multitude of vendors and supporting a diverse set of networks across the hospital. Further, they must work to be compliant with HIPAA security rules and other compliance requirements. Cyber security products issue a multitude of alerts and can overwhelm these hospital teams while real cyber security event alerts are perhaps hidden or missed.

Deception technology – a new category of cyber defense for hospitals

Deception technology is a new category of cyber security designed to meet head-on the threats of malicious software, targeted attacks, zero day exploits and other sophisticated attacks. Deception technology provides for the broad scale deployment of a network of camouflaged malware traps that are intermingled with the hospital’s real information technology resources. The traps appear identical in every way to the hospital’s real assets.

Once malware has penetrated the hospital, the attackers move laterally to find high value targets. Upon touching any one of the traps or decoys, they’re caught. Deception technology then issues a high accuracy alert. Note that deception technology alerts are not based upon a probabilistic event or clustering around adjustable thresholds. These are very high confidence events. Almost binary. This cuts through the clutter and makes it clear to the hospital IT team that they likely have an active attacker and a databreach attempt. Some types of deception technology also isolate the malware and deliver a full report directly to the hospital IT team, enabling a rapid path for remediation and removal.

Many hospitals have been looking for additional help from Managed Security Service Providers (MSSPs). Deception technologies generally fit well into MSSP operations. Additional benefits deception technology brings to hospitals include:

• Reduction in time to breach detection. Deception technology detects malware movement unseen by other cyber defense in real-time
• Low to no false positives. A small number of highly accurate alerts keep the hospital information technology team focused on real threats
• Complementary to your existing cyber defense suite. Most vendors have integrations to support centralized reporting and SIEM (security information and event management).

In summary, the data stored within healthcare networks remains a primary target for attackers on a global basis. Healthcare data is highly coveted by cyber attackers and they are relentless in their efforts to penetrate and steal data from our hospitals. Deception technologies provide a new and powerful option for hospitals to reduce the risk of data breach and better leverage the capabilities of the hospital IT team. Deception-based cyber security defense can help meet and defeat the threats of advanced persistent threats (APTs), zero day events and other sophisticated malware.