May 17, 2020

Symantec announces new cyber threat to healthcare organisations

Cyber Attacks
Health technology
Cyber Attacks
Health technology
Catherine Sturman
4 min
cyber threat
US software company Symantec has recently announced its recent findings surrounding an ongoing cyber threat to the healthcare industry.

Named Orangewor...

US software company Symantec has recently announced its recent findings surrounding an ongoing cyber threat to the healthcare industry.

Named Orangeworm, the cyber attack has affected up to 100 organisations, situated in the US (17%), Europe and Asia, the company has reported.

"According to Symantec telemetry, almost 40% of Orangeworm’s confirmed victim organizations operate within the healthcare industry."

"The Kwampirs malware was found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines.

“Additionally, Orangeworm was observed to have an interest in machines used to assist patients in completing consent forms for required procedures," the company added.

The malware is able to replicate itself over various network, making its worm-like actions inaccessible by outdated virus software and IT systems, such as Windows XP, which have been found to remain rampant across the industry.

However, the malware has also impacted supply chains, IT, pharmaceutical and manufacturing companies who work with healthcare providers. Targeting a number of industries has therefore heightened the range of information which hackers can obtain.

“What they do is clearly aimed at collecting information across the entire healthcare supply chain of their targets. You don’t really see that. What we’re seeing is corporate espionage, not for the sake of sabotage or destruction of equipment, and not for financial gain,” explained Jon DiMaggio, Senior Threat Intelligence Researcher at Symantec.

“The attackers cast a wide net and then choose high-value targets out of the sample. From there, they spend an immense amount of time trying to learn the ins and outs of the target’s systems, including seeking out directories, finding out what everything’s connected to, finding open shares.

See also

“This is speculation, but if they had source code or pirated technology, it would fit the story and would explain why they’re so interested in how things operate. But that’s just a theory.

“The situation could be so much worse; these guys have the capability to wipe hard drives or destroy equipment,” he continues.

“Implementing basic security procedures like patching and network segmentation would prevent this threat with minimal work. And, the healthcare community as a whole needs to push their software vendors to consider security more so than ease-of-use.”

Jalal Bouhdada, Founder and Principal ICS Security Consultant for Applied Risk, also outlined why "security by design" is crucial to cure security issues in the healthcare industry.

“It is perhaps no surprise that a new attack group, dubbed Orangeworm, has been discovered targeting the healthcare industry. There have been repeated warnings that healthcare systems are easy pickings for cybercriminals, and although there has been an understandable desire within the industry to press ahead and unlock the benefits of IoT technology, a lack of consideration regarding the security ramifications of this has begun to concern many,” he says.

“While innovation in the healthcare industry is having a great impact on the quality of life for many people, what if the opposite is also true? While in the case of Orangeworm it seems the attackers were only looking to learn about the inner workings of a system, could this often life-saving medical equipment be turned against us?

“There has been much speculation over potential scenarios in which devices such as insulin pumps are hijacked and held to ransom; or terrorists attack connected pacemakers en masse. Sadly, this is no longer the stuff of fiction, as made clear by the FDA’s recent warnings regarding exploitable flaws in connected cardiac pacemakers. Medical device manufacturers must come to terms with the idea that the security of the healthcare equipment itself is also a life and death issue.

“Medical device manufacturers must now begin adhering to best practice security advice. New data privacy laws and strict FDA requirements mean the responsibility is now with the developers to ensure the protection of networks and systems, or they will face the consequences.

“To help meet these obligations, the security industry and medical device manufacturers must develop a closer relationship, ensuring that new devices are developed with security defences baked in. The ethos of “secure by design” must become entrenched within all product developers."

Share article

Jul 25, 2021

Getting ready for cloud data-driven healthcare

 Joe Gaska
4 min
Getting ready for cloud data-driven healthcare
 Joe Gaska, CEO of GRAX, tells us how healthcare providers can become cloud-based and data-driven organisations

As healthcare continues to recognise the value of data and digital transformation, many organisations are relying on the cloud to make their future-forward and data-centric thinking a reality. In fact, the global healthcare cloud computing market was valued at approximately $18 billion and is expected to generate around $61 billion USD by 2025. 

At the forefront of these changes is the rapid adoption of cloud-based, or software-as-a-service (SaaS), applications. These apps can be used to handle patient interactions, track prescriptions, care, billing and more, and the insights derived from this important data can vastly improve operations, procurement and courses of treatment. However, before healthcare organisations can begin to dream about a true data-driven future, they have to deal with a data-driven dilemma: compliance. 

Meeting regulation requirements

It’s no secret that healthcare is a highly regulated industry when it comes to data and privacy – and rightfully so. Patient records contain extremely sensitive data that, if changed or erased, could cost someone their life. This is why healthcare systems rely on legacy technologies, like Cerner and Epic EHRs, to manage patient information – the industry knows the vendors put an emphasis on making them as secure as possible.

Yet when SaaS applications are introduced and data starts being moved into them, compliance gets complicated. For example, every time a new application is introduced into an organisation, that organisation must have the vendor complete a BAA (Business Associate Agreement). This agreement essentially puts the responsibility for the safety of patients’ information — maintaining appropriate safeguards and complying with regulations — on the vendor.

However, even with these agreements in place, healthcare systems still are at risk of failing to meet compliance requirements. To comply with HIPAA, U.S. Food and Drug Administration 21 CFR Part 11 and other regulations that stipulate the need to exercise best practices to keep electronic patient data safe, healthcare organisations must maintain comprehensive audit trails – something that gets increasingly difficult when data sits in an application that resides in the vendor’s infrastructure.

Additionally, data often does not stay in the applications – instead healthcare users download, save and copy it into other business intelligence tools, creating data sprawl across the organisation and exposing patient privacy to greater risk. 

With so many of these tools that are meant to spur growth and more effective care creating compliance challenges, it begs the question: how can healthcare organisations take advantage of the data they have without risking non-compliance?

Data ownership

Yes, healthcare organisations can adhere to regulations while also getting valuable insights from the wealth of data they have available. However, to help do this, organisations must own their data. This means data must be backed up and stored in an environment that they have control over, rather than in the SaaS vendors’ applications.

Backing up historical SaaS application data directly from an app into an organisation’s own secure cloud infrastructure, such as AWS or Microsoft Azure, makes it easier, and less costly, to maintain a digital chain of custody – or a trail of the different touchpoints of data. This not only increases the visibility and auditability of that data, but organisations can then set appropriate controls around who can access the data.

Likewise, having data from these apps located in one central, easily accessible location can decrease the number of copies floating around an organisation, reducing the surface area of exposure while also making it easier for organisations to securely pull data into business intelligence tools. 

When healthcare providers have unfettered access to all their historical data, the possibilities for growth and insights are endless. For example, having ownership and ready access to authorised data can help organisations further implement and support outcome-based care. Insights enabled by this data will help inform diagnoses, prescriptions, treatment plans and more, which benefits not only the patient, but the healthcare ecosystem as a whole. 

To keep optimising and improving care, healthcare systems must take advantage of new tools like SaaS applications. By backing up and owning their historical SaaS application data, they can do so while minimising the risk to patient privacy or compliance requirements. Having this ownership and access can propel healthcare organisations to be more data-driven – creating better outcomes for everyone. 

Share article