Cyber Attacks on Hospitals Put More Than Data at Risk

In September a cyber attack in Germany caused a death directly for the first time. The case showed that the harm done by an attack is not confined to damaged data and IT systems, or even to financial loss. When a critical sector such as healthcare is compromised, the outcome can decide whether a patient lives or dies.

Old buildings, old systems, stretched budgets

Healthcare is, broadly speaking, an old industry. Some institutions were founded more than a century ago, and part of their technology still runs on legacy software and applications, which leaves them open to attack. Medical instruments and patient devices are also built to be used for many years, so they are likely to depend on outdated systems that struggle against constantly changing threats.

Boris Cipot, senior security engineer at Synopsys Software Integrity Group, said this gives attackers an opening either to reach the data held on such devices or to use them as a foothold from which to move through the network towards sensitive data stored elsewhere. His advice is that devices with no business-critical need for an internet connection should not be connected at all. Where there is a concern, he said, organisations should consider segmenting the network according to potential risk.

Tim Mackey, principal security strategist at the Synopsys Cybersecurity Research Centre (CyRC), pointed to a resourcing problem in hospital systems that grows worse when the community around them is in crisis. Caring for the sick comes first, and cost centres such as cybersecurity come second. Patient data, however, identifies a person uniquely and cannot be changed. Attackers are aware of this, Mackey said, which makes hospitals and healthcare providers prime targets even when conditions are normal.

For Mackey, the central difficulty is that clinicians should be able to reach the patient data they need without extra, unnecessary steps, while that data stays protected from unauthorised access. He described contextual access as the key idea: neither clinicians nor other staff need full access to every record in every situation. According to Mackey, access can be restricted in many ways that avoid complicated security measures, and access virtualisation such as VDI can place a protective barrier around the systems that process electronic health records.

Ransomware against healthcare keeps climbing

Attacks on hospitals have kept escalating, with two more hit by ransomware in the previous month alone. A report from C5 Alliance says attacks on the healthcare sector have risen by more than 150% since the start of the pandemic.

Check Point Research data shows a 33% rise in ransomware attacks on healthcare in Asia Pacific in October. Most of that increase was in Singapore, where attacks on the sector went up 133%, and in India, with a 20% rise.

Tony Jarvis, chief technology officer for Asia Pacific at Check Point Software Technologies, said it is well known that money is the main motive for ransomware gangs, with disruption or sabotage sometimes playing a part. While the pandemic had already caused a shocking number of deaths worldwide, he noted, September brought another attack, this one involving Ryuk, among the most prominent ransomware strains. Such attacks can have catastrophic consequences for hospitals, particularly when wards are full of pandemic patients.

According to Jarvis, Ryuk accounted for 75% of ransomware attacks on the US healthcare sector in October. Typical ransomware is spread widely through large spam campaigns and exploit kits. Ryuk, by contrast, is used only in tailored, targeted attacks, which makes it a greater danger to healthcare. Ryuk and other strains are pushing hospitals to pay ransoms so that staff can get back to saving lives.

Five steps Check Point recommends

Jarvis set out the following measures to prevent ransomware:

1. Be more alert at weekends and on holidays. Over the past year most ransomware attacks were launched at these times, when fewer people are watching.
2. Use virtual patching. The Federal guidance is to patch old versions, which hospitals may find impossible. The alternative is an intrusion prevention system (IPS) kept up to date with the latest packages, which provides virtual patching against the most recent known exploits.
3. Deploy anti-ransomware. Encryption by ransomware is extensive, and anti-ransomware tools with a remediation feature can restore normal operation within a few minutes if an infection occurs.
4. Train users. Teaching staff to recognise and avoid ransomware attempts is vital. Many attacks today begin with a targeted email that carries no malware at all, only a socially engineered message urging the reader to click a malicious link, so user education is often seen as one of the most important defences an organisation has.
5. Treat ransomware as the last stage of an attack, not the first. Ryuk and similar strains buy an existing infection base inside the target organisation. Security teams should watch for Trickbot, Emotet, Dridex and Cobalt Strike infections on their networks and remove them with threat hunting tools, because these open the door to Ryuk.