It’s Way Too Easy to Hack the Hospital

I think honestly, the only thing that's kept this from being a problem with greater consequence is that to date it hasn't been clear that there's a real path to monetization of health data. It's been a lot more profitable to chase down credit card #'s and mass email/password combinations that lead to banking access.

I've long wondered when a solid monetization strategy for health data would show up and we'd see a quick rush to target these datasets. Trends that I see that make me think we're getting closer:

1. Systems are increasingly net-connected, obviously. In some ways it's increasing security (literally most hospitals I've been in you could plug into any ethernet port in the building and be on a network where pretty sensitive data is sent in the clear), but it's making these systems available to a larger number of interested attackers

2. Patients have accounts now. Health data is suddenly a not-insignificant source of email/password combinations for patients (previously just employees). Pretty reasonable to expect that health systems may be the source of future Gawker-style breaches for collecting poorly protected user credentials that can be used elsewhere.

3. The uptick and cost-effectiveness of encryption-ransomware, personal and corporate. It's been interesting to see cases where the data itself isn't monitezed because it has some broad market value, but solely by threatening the owners with it's release or exposure. I won't be surprised if Healthcare organizations or individual patients find themselves victims of extortion either by threatening to publish sensitive health data, or to destroy it.

There is (finally) an extra-linear increase in attention to this issue in Health IT, but there's also quite a large backlog of debt and an enormous number of systems deployed that were built for a different reality than current exists.

I've performed security assessments against many different industries, including banks, large enterprise, barely-funded startups, nuclear power facilities, law firms, hospitals, and more. In each of these fields, you see the "good guys" and the "bad guys" in terms of IT security strength. In hospitals, though, the whole field is terrible. The best of the best -- high-tech facilities that actually care about security -- are still doing terribly compared to the average large enterprise.

Health records are becoming more valuable, and not just because of blackmail. Insurance fraud and identity theft are feasible if you've stolen someone's health records, and the information stored within is only getting broader.

Hospitals wouldn't let their medical tech slip this far. They shouldn't let their security slip, either.

The scary part was that the server room with the PACS and everything else in the building was unprotected with unlocked doors and nobody particularly caring we were there.

Imagine walking into a random law firm and walking into the server room with the ability to copy all data from all the clients.

Not cool, at all.

This right here is the problem - Researchers unveiled serious threats in the hardware - the ones described in the article could all be used to kill. And the response to that? "Shut up, you're scaring people".

Those headlines should be scaring people because they are scary!

Not to minimize the problems with the BGA or with other devices, but this points at least as much to a problem with the "data source", which is left unidentified in TFA. One reason the BGA wouldn't be worried about protecting PII might be that... it should never have PII in the first place. There's a HIPAA violation somewhere, but I don't think it's in the BGA, and the BGA isn't the only host that's assuming a safe network.

Target, Home Depot, etc. have been justifiably criticized for operating their POS devices as if firewalls could possibly be sufficient to protect a large network. Hospitals might consider themselves more noble than mere stores, but it doesn't make a difference to a hacker.

* Business

* Individual citizens, who seem to care little about the confidentiality of their personal information

* Government

* Developers of most software. Even RSA was hacked.

* Even national security organizations: The OPM hack; Snowden walking out of the NSA with all that secret data; CIA leaders taking home top secret information, etc.

Perhaps it's human nature. On the other hand, when it comes to physical security, people often tend to overreact.

Luckily some vendors are starting to take security very seriously (by hiring people like me, for example).

First, HIPAA requirements are in part IT requirements. Every single hospital works really hard to comply with these, because there are huge fines if they don't. Some of the problems with hospital IT security might be due to defects in the already quite onerous HIPAA specification.

The second is that hospitals are extremely low-margin institutions. Most hospitals (even the really big ones) just break even, especially if they're teaching hospitals or serve poorer areas. IT security doesn't really produce any revenue.

I agree it's a problem. This needs a systemic solution–who would pay for IT fixes? Reimbursement is declining and government payment sucks. Most hospitals are in crisis mode as it is.

I worked on a few security consulting projects in healthcare. The HIPAA security rule is way more vague about actual controls than a rational person would assume; much more than analogous regulations on financial data (e.g. PCI-DSS). The HITECH amendment added a lot of breadth regarding which parties must comply, but did little to proscribe specific controls. Most providers, contractors, etc. use a framework called HITRUST that attempts to identify and map actual security controls to HIPAA, but even that is not super actionable.

One of the hardest problems to solve is the immediate criticality of patient data. You absolutely cannot have someone die because a nurse or doctor forgot their password and couldn't look up medical history. Makes practitioners resist adoption, and you end up with "break the glass" (emergency security bypass) functionality on a lot of sensitive systems/data.

Also, I wish someone could do a medical device network security system -- it really isn't the core competency of any of the hardware vendors, and yet is something you can't get wrong. The public protocols (DICOM, HL7, etc.) are at best baroque and don't include the details which matter to security. I wish this didn't have to be a company -- it really could be something funded by NIH or a consortium of device vendors or medical institutions -- but it probably has to be in order to be effective. There's a need for an open standard for medical device security over top of all this, but rather than just publishing a standard, it would be easier to provide working end to end network from device to information system.

There are many gaps while some significantly standout compared to others.

* As highlighted in this article, Security is a huge issue. Given the sensitivity of the data, the sad state of infrastructure does not do any justice.

* A lot of the infrastructure is still paper based. The digital revolution is way behind its time in this sector.

* Medical sciences which is supposed to revolutionize has most of its spend in regulations rather than technology. The advancements in science are excruciatingly slow. Drug discovery has slowed down tremendously.

Not to mention, the poor patient-experience and lack of reach of medicine to the poorest of society.