A Cybersecurity Threat Model for a Combined Cyberattack Against Hospitals and Terrorist Attack in Spain

A Cybersecurity Threat Model for a Combined Cyberattack against Hospitals and Terrorist Attack in Spain Oxford University - Universidad Autónoma de Madrid Project Report CONSULTANTS: Lucas Kello (Principal Consultant) Ivan Martinovic Martin Strohmeier Florian Egloff Academic Coordinator (UAM): Raquel Galindo Dorado A Cybersecurity Threat Model for a Combined Cyberattack against Hospitals and Terrorist Attack in Spain 1. INTRODUCTION This report is structured as follows: Section 2 will provide the necessary background on cybersecurity in the healthcare Hospital cybersecurity is a global concern. According sector. Section 3 discusses the capabilities and motivations to an investigation by Pulse magazine, health record of different threat actors while Section 4 presents the analysis security breaches in the United Kingdom’s at National of potential vulnerabilities in the reviewed hospitals in Health Service rose 20 percent in the last year. Data from Madrid. Section 5 compares the different IT infrastructure 55 hospitals indicated breaches included records dumped paradigms in terms of security and risk. In Section 6, a in public places, records given to the wrong patient and case study on large medical devices discusses the patching patient data given to relatives without permission. In 2015 process. Finally, Section 7 provides recommendations and alone, more than 94 million U.S. health records were concludes this report. compromised, costing affected institutions approximately $46 billion. According to Experian’s 2014 Data Breach Industry Forecast, the healthcare industry will be among 2. BACKGROUND the most susceptible industries to publicly disclosed and This section will discuss the current cybersecurity widely scrutinized data breaches.1 The October 2013 environment in the healthcare sector. We will frst review security breach of the U.S. FDA’s Center for Biologics the reported breaches and systematize them into separate Evaluation and Research compromised 14,000 accounts categories. Following this, we will survey the relevant and demonstrated that competitive pharmaceutical trade academic literature on cybersecurity in hospitals. secrets, which the federal government stores, represent an opportunity for foreign interests to beneft from new drug discoveries without having to invest in them. 2.1 Review of Reported Incidents Hospitals face signifcant cyber risks. Increasingly, hackers The Center for Internet Security reports that the “healthcare seek to exploit vulnerabilities in hospital computer systems industry is plagued by a myriad of cybersecurity-related and devices. Attackers’ motives are diverse—ranging from issues”. The reported attacks can be systematized into four stealing sensitive patient data to creating disruption and different major sectors: chaos in the delivery of services to the use of “ransomware” for criminal proft. With more hospital and patient data 2.1.1 Ransomware moving to the cloud and travelling across multiple national borders, the risk of complex international breaches increases. Ransomware, a type of malicious software that threatens Devices with default passwords that are left unchanged, to publish the victim’s data or perpetually block access and outdated operating systems that are connected to the to it unless a ransom is paid, has become the most network, such as medical databases, are all too common in prominent reported type of attack, not only in the health healthcare. Experts have already found faws in a blood gas care sector. analyzer, a medical image system and radiology equipment. Recent reported incidents with regards to hospitals Fundamentally, the question of cyber threats against include: hospitals is not whether investigative sites will suffer a 1. “Infection with ransomware via outdated server data breach, but when this will occur, and how serious the software. In these cases, the attacker uploaded consequences will be for the healthcare sector as a whole. malware to the out-of-date server without any There is no foolproof way to physically protect digital interaction from the victim, as opposed to infecting records that are frequently accessed, altered and shared, the hospitals through common workstations used by sometimes internationally. But it is possible to up the ante everyday staff. The Hollywood Presbyterian Hospital for hackers and malware by focusing on how you handle in California was one of the hospitals affected, in this data in the frst place. a case which delayed patient care and ultimately This report on cybersecurity in two Madrid hospitals, resulted in the hospital paying $17,000 to regain 2 Moncloa and Fuenlabrada, investigates the current state access to fles and their network.” of preparation against possible cyber attacks in these 2. “On June 14, 2017, the Pacifc Alliance Medical institutions. It will discuss possible vulnerabilities and learned its networked computer systems were generate recommendations which show a path towards affected by a cyber incident, which IT offcials later improved security and resilience in the future. determined to be ransomware. The medical center shut down its systems and initiated its response and recovery procedures. Offcials were able to decrypt 1 See Experian, 2014 Data Breach Industry Forecast, https://www. oppinsurance.com/wp-content/uploads/2014/02/experian-2014-data- breach-industry-forecast.pdf 2 https://www.cisecurity.org/ransomware-in-the-healthcare-sector/ 1 A Cybersecurity Threat Model for a Combined Cyberattack against Hospitals and Terrorist Attack in Spain the infected fles and have since taken action to restore Reported major examples of such data breaches include: 3 the affected systems.” 1. “Banner Health is contacting 3.7 million individuals 3. “Atlanta-based Peachtree Neurological Clinic whose personal information may have been accessed uncovered a 15-month breach to its computer system in a cyberattack that began on systems that process while investigating a separate ransomware attack. credit card payments for food and beverage purchases The clinic reported nearly 176,295 patient records at Banner locations. The breach then expanded to were potentially affected.” 4 include patient and health plan information.” 8 4. “Fayetteville-based Arkansas Oral & Facial Surgery 2. On March 21, Bowling Green, Kentucky-based Med Center notifed 128,000 patients of a July ransomware Center Health, which includes several hospitals, attack on its computer network that may have issued a public notifcation saying that on Jan. 4, compromised some patient names, dates of birth and 2017, “during the course of an internal investigation, Social Security numbers, among other data.”5 we determined that [a] former Med Center Health employee had, on two past occasions during their 5. The most publicized attack in Europe was the employment, obtained certain billing information WannaCry attack on the UK National Health Services by creating the appearance that they needed the in May 2017. The UK National Audit Offce reports: information to carry out their job duties for Med “The attack led to disruption in at least 34% of Center Health.” This breach affected almost 700,000 trusts in England although the Department and NHS individuals.9 England do not know the full extent of the disruption. On 12 May, NHS England initially identifed 45 3. “Peachtree Orthopedics has announced a hacker NHS organizations including 37 trusts that had been gained access to a patient database containing names, infected by the WannaCry ransomware. Over the addresses, dates of birth, email addresses, treatment following days, more organizations reported they had codes, prescription records, and Social Security been affected. In total, at least 81 out of 236 trusts numbers. The breach notifcation letters sent to across England were affected.” 6 patients on October 7, 2016 explain that the hacker potentially stole the contents of the database.” 10 Not all ransomware attacks on hospitals have been publicly reported, however, just from the size of the known incidents These examples illustrate the severity of data breaches, we can deduce that ransomware has been the main active which can be conducted both by outsiders and insiders. threat vector for attacks on hospitals in 2017. While they do not actively interfere with health care operations in a direct way, they can lead to serious 2.1.2 Data Breaches consequences for patients in the long run (e.g., blackmail Data breaches are generally more diffcult to detect compared or fraud). In most industrialized countries laws exist which to ransomware attacks or other active cybersecurity issues. require public notifcation of data breaches concerning In 2017, there have been many large cases where hospital patient data, causing a potentially severe loss of reputation security has been breached and data siphoned off by attackers for the affected health care provider. with the intent to exploit or sell it. It is likely that many such 2.1.3 Distributed Denial of Service Attacks attacks have not been noticed (yet) as they do not necessarily have a noticeable impact on day-to-day operations. Distributed denial of service (DDoS) attacks, which overpower and effectively disable network connections using The U.S. Department of Health and Human Services numerous distributed clients, are extremely common against provides a breach portal, that as of the time of writing lists services connected to the global Internet, from popular 391 data breaches affecting 500 or more individuals within 7 websites to governments. For hospitals,

Load more