Electronic Health Reporter

By Jim LaRoe, CEO, Symphion, Inc.

The trend in cybersecurity news is to focus on the latest buzz words like artificial intelligence, blockchain, ransomware, denials of service or HIPAA fines. Recent hacks are front page news. Trends also includes the increasing cybersecurity regulatory mandates such as state laws providing private consumer rights (class actions) against offending healthcare providers and their officers and directors. Another hot topic is the dearth of cybersecurity skills.

CISOs and other business leaders responsible for security of ePHI and business continuity are the intended audience and are being inundated with the tornado of cyber security trends—much of which is vendor driven.  They’re also being pulled in many different directions internally with competing priorities. At a recent panel discussion of CISOs at Northern California HIMSS’ CXO Summit, one busy CISO described how he is repeatedly added to committees on all sorts of different subjects, some of which he had never heard of.

Whitepapers discussing the “top 10 priorities” or “top 10 trends” are commonplace. They’re usually vendor driven and focus largely on the most prevalent asset type — computers. That is, desktops, laptops and servers about perimeter security or internal threats from user behavior; including training users not to click on suspect emails to prevent phishing attacks.

Overlooking Second Most Prevalent Asset Type — Printers

But no one is talking about, or including in the top 10 lists, the second most prevalent asset type in all healthcare providers’ IT enterprises — their printers. For some reason, networked printers (any device that creates an image, electronic or otherwise, including multi-function, single-functions, faxes, scanners, label printers, etc.) are not perceived as the same risk as other computers, even though in the past few years there have been reported hacks of 50,000 to 150,000 networked printers. Also, a research house exposed that faxes can be easily exploited to hack printers and the corporate networks where they reside.

Why is this trend not hot on the minds of top security professionals? It could be because of the origins of today’s modern business printers as “dummy copiers” or the fact that they are often not procured or managed by the information technology department or visible to the information security department.  Or, it could be because vulnerability management, intrusion detection and information security consulting vendors driving today’s messaging do not include printers in their solutions.

Little Known Facts about Print Fleets

Whatever the reason, here are few important facts that you should know about almost all printers in healthcare:

1. Printers are mission critical to patient care and part of providers’ tier one applications.
2. Printers are everywhere. There can be as many as one printer to one employee or between 1:6 and 1:10.
3. Printers are often accessible or visible in public areas and not in protected data centers or offices like many other computers.
4. They aren’t assigned users like desktops or laptops, or system administrators like servers in data centers.
5. Printers have built-in security settings, but they are not being set or maintained.
6. HIPAA requires that all printers be included in the comprehensive risk analysis and cyber hardened for security of ePHI regardless of make, model, age or type.
7. Printers are shipped and regularly deployed and maintained on networks with factory default settings including published factory default administrator passwords to enable bad actors to take control of them.
8. Even if security settings on printers are set at time of deployment, they get unknowingly reset back to factory defaults (turned off).

Why Act Now to Secure Printers?

The easiest answer: because it’s the law (HIPAA) and you’re exposing your company to serious and long-lasting financial risk if you are not acting now to secure (and keep secured) all the printers in your print fleet. Also, the fact that other regulations are being regularly enacted that go beyond HIPAA mandates exposing companies to even more severe penalties.

Also, because the threat landscape has changed and is constantly expanding, and ePHI is increasingly more valuable, making healthcare providers prime targets.  The proliferation of Internet of Things (IoT) medical devices provide new potential entry ways to internally take over printers, and use printers’ trusted access to the rest of the corporate network. There are new threats, likes hacks to two-factor authentication and new threats like virus and ransomware combinations.