Security: Healthcare systems are "soft-targets": the Next Big Exploit

Previous pieces on Security:

• NBN: the business case for 100-1000Mbps symmetric for SOHO & SME
• Security: The Massive hole in the PCEHR system
• Cyberwar: paper-tiger or real threat?
• NBN, stuxnet and Security: It's worse than you can believe
• Cyberwar: Bush/O'Bama authorised Stuxnet
• The NBN and defending against Cyber warfare attacks.
• The NBN as an Essential Strategic Defence for Cyber-warfare.
• CyberWars, Governments and Internet Security
• Why new Secure Internet solutions are technically Hard

I'd been racking my brains as to how Cybercriminals can "monetise" e-Health Records and writing to someone else, think I've understood it finally after a "Top of the News" report by the Security for Professionals: SANS.

There are two ways to monetise e-Health Records:

• Identity Theft. Huge amount of high-quality info. Medicare Cards are worth 'points' as Govt. ID's.
• Ransomware: healthcare can't operate without its data and they print money by the truckload.

I'm wondering if the attacks reported out of QLD by /AUSCERT on Medical Practices is accidental.
If the CyberCrims haven't understood this yet, they will in 12 months.

In 1998, I couldn't see a way to monetise MP3's on the Internet. How do you charge for freely distributed files?

A: You don't... Apple invented end-to-end Security to sell iTunes to Content Providers.

The other group of attackers to be aware of are "Advanced Persistent Threats" (APT's) - known to do Cyber-Terrorism, and what better target than disrupting Healthcare? It is commonly believed the resources of Nation States are needed to pursue APT's.

The day this piece was written, I'd received a SANS Newsletter, the read for IT Professionals. The lead piece was a long investigative piece by the Washington Post on vulnerabilities in Healthcare Systems.

This is going to be a long running story with some really deep and disturbing implications and exploits.

What other practices/ventures of Organised Crime will we see turn up on the Internet?? We can only wonder...

Since 2004 when the Hackers turned Pro, Organised Crime has been moving in and repeating its real-world trade/tricks on-line. We've also seen more Organisation and increasingly "Industrial Scale" operations...

From the Washington Post article, a quote that shows NO understanding of the CyberCrime world and how dangerous this ignorance is:

OEMR’s leaders acknowledged the flaws but said it would take an experienced hacker to exploit them.

Yes, exactly correct, BUT dangerously ignorant and wrong:

• which is why since the days of "script kiddies", pre-2000, the actual coders have packaged their exploits and on-sold them. That's the primary trade, the secondary market is those whom we perceive to be CyberCriminals... They are clowns running software they didn't write and don't know much about - but just as effective as anyone.

Also, theWashington Post article doesn't ask, "Why Eastern Europe?"

• they are poor and their economies in disarray. People will do "whatever they have to do".
• in the post Soviet Union era, that corrupt system has transformed into Organised Crime
• there are large numbers of very talented, highly-trained and and motivated people available
• they have some areas of very good Internet connectivity

News letter on SANS website.

**************************************************************************
SANS NewsBites                December 28, 2012          Vol. 14, Num. 102
**************************************************************************
TOP OF THE NEWS
  Health Care Sector Lagging Behind Others in Cybersecurity
  Banking Regulator Issues Warning Regarding DDoS Attacks Against Financial Institutions
  FOIA Docs Reveal NSA Industrial Control System Vulnerability Research
  US Legislators Approve National Defense Authorization Act Requiring Contractors To Report Breaches

***************************************************************************


TOP OF THE NEWS
 --Health Care Sector Lagging Behind Others in Cybersecurity
(December 25, 2012)

Researchers say that the health care sector is vulnerable to a variety of cyberattacks. The industry moved quickly to embrace the benefits offered by the Internet but in doing so, exposed medical devices and computers at medical facilities to hackers, who could potentially steal patient information to commit identity fraud and even launch attacks on critical systems within hospitals. Health care "lags behind [other industries] in addressing known problems." Granted, medical facilities have not been the target of attacks as frequently as financial, corporate, and military networks have, but the US Department of Homeland Security (DHS) has recently become concerned that health care could prove an enticing target for hackers. The most recent cybersecurity guidance from the Food and Drug Administration, which oversees medical devices, dates to 2005.

http://www.washingtonpost.com/investigations/health-care-sector-vulnerable-to-hackers-researchers-say/2012/12/25/72933598-3e50-11e2-ae43-cf491b837f7b_story.html

[Editor's Note (Murray): The healthcare sector lags in use, let alone the management, of IT.  Their failure to use electronic healthcare records is killing and impoverishing us.]

NBN: the business case for 100-1000Mbps symmetric for SOHO & SME

Backups don't just protect you from fire, theft or hardware failure: they are now a critical element of security. If you're business cannot run with its computer systems, you cannot run your business without trusted backups.

Around Christmas 2012, there were reports of Ransomware attacks in Queensland. But it was Old News... "Police knew of 30 attacks" two months earlier. Nigel Phair, author of a book on Cybercrime, was quoted in multiple sources.


Potentially Medical Records are being especially targeted. This is Hacking-for-Cash, not healthcare related hacktivism as seen in the UK. AFR had a story in early December and mentioned AusCERT's posts on ransomware.

Regardless how a system is compromised, the only reason "ransomware" can succeed is simple:

People cannot restore from backups.

As the AusCERT post says, just because you once scheduled backups to run, doesn't mean they are running.

Case 2: Medical centre

The attacker took control of the doctors’ database containing patient records. The attacker provided proof that recovery was possible by safely returning two sample files belonging to the medical centre. The ransom demand was $4,000.

In this case, the attacker had actually infiltrated the medical centre some weeks prior to the ransom demand. During this time the attacker had made numerous strategic changes within the system such as disabling the patient database in the tape backup scheduler. After several weeks of backup tape rotations, recent backups were not available even in the medical centre’s offsite storage location. Additionally the medical centre’s USB hard disk backup device was plugged in to the system, and had therefore already been seized by the attacker.

The cure was to erase and rebuild the server, and recover older data from backup tapes. In this case, the medical centre had good practices such as keeping two different types of backup, applying security patches and maintaining an up-to-date business continuity plan. However, repelling these targeted ransomware attacks requires stronger defenses.

AusCERT advises those affected to not engage with the attackers. There's a simple reason:

They want to make the maximum amount of money from you, they aren't bound by any  code of ethics or morality, as demonstrated by the metaphorical gun to the head of the hostage, they can't be tracked easily and dealing with International cyber-criminals is notoriously difficult.

The initial payment you make will only be the first payment of many, not full and final as they'd like you to believe. Like any good parasite, they'll quickly figure out how much blood they can draw: how much this thing is worth to you and your capacity to pay.

What the "authorities" aren't saying is how far and how fast this particular monetisation of exploits will travel.

We know its not going to double its reach every few seconds like "slammer", because of the manual work involved in identifying targets and setting up the backups.

Even if it doubles just every month, that's a 1000-fold increase in a year. Because the Internet is "born global", what we see in Australia will happen everywhere.

Business Case for High-Speed symmetrical links

Every small business that doesn't want to be shutdown by hackers needs guaranteed, verified off-site backups. Just like fire and theft insurance, you need good backups - and via the NBN is what you want. For this is to be useful in an age of Gigabyte and Terrabyte data storage is at least 100Mbps (gives you 3.6Gb/hour). But it needs to be symmetrical, the same upstream as downstream, to be useful for both backups and restores.

Remember: no user has ever asked for a backup, they only ever ask for restores.

Ideally, Retail Service Providers and ISP's will offer local access off the same PoI (Point of Interconnect, the NBN version of a Telephone Exchange for 100,000 subscribers). This means your data packets won't have to travel down and back the transit/backhaul link from the PoI to the ISP/RSP, uselessly consuming expensive bandwidth and clogging the ISP's network.

Which may need the co-operation of NBN Co for ISP/RSP's to install the appropriate network appliance at the PoI.

In a reasonable world, you'll be able to partner with someone you know in your area and each serve as the off-site backup site for the other. If the hardware fails or fills up, they are close by and you can buy a new disk and dash over there...

But that only works if:

• links are fast (daily backups under and hour, weekly under 10 hours), and
• access is cheap. (not $1,000's/month for 10Mbps, but ~$100/mth for 100Mbps symmetrical).

NBN: The Smart Internet Revolution comes to Healthcare

A letter to Paul Budde on this topic.

Unexpectedly, I think I've identified how Coles and Woolworth's are going to fulfil a long-time ambition: enter the Pharmacy prescription market.

They can take a lead from Australia Post and setup either dedicated self-serve collection lockers near each site, and/or piggy-back on their existing Home Delivery service. They have the logistics operations and expertise to execute on this right now.

---

Subject: A surprising healthcare Structural Industry Reform due to NBN and "The Internet"

Paul et al,

This thought arose in the last couple of days:
Australia Post's "parcel lockers" will unleash significant change in on-line buying from Australian e-tailers, because it addresses the same old-technology "last mile" problem addressed by the NBN.

With the NBN/PCEHR driven Electronic Prescriptions, I think it will drive a Structural Reform of Community Pharmacies - most dispensing will take place in automatic facilities and be direct-delivered. Local pharmacies won't be able to compete on price, just as corner-stores, small fruiterers, bakeries and butchers were displaced by Woolies and Coles in the last 30 years. They'll enter a vicious-spiral of lower-turnover forcing higher mark-ups which will reduce turnover more, etc etc.

BUT, some Pharmacies will survive, just as some small stores still survive with Coles and Woolies, often in the same shopping malls like my local mall. Because they provide "value-add" services, understand customer-service and don't focus on commodity products where they can't win.

Which will have implications for Healthcare:

Pharmacists play an important community role in the use, not prescription, of drugs.
[On-going Operations vs single-shot Project work.]

The important thing for the NBN I slipped in my letter to my local MHR:

• video "in-home" consultations

Medicare and the Dept of Health (esp. their funding for Medicare Locals) needs to address and develop Policy and payments/service schedules for the many ancillary healthcare services that will be needed to support Healthcare-in-the-Home, part of which will be in-home visits (for medication and dispensing-aid reviews), on-line video-calls and, when needed, practice-rooms visits.

There are probably 10-20 ancillary healthcare specialities needed for good in-home care, Pharmacy being just one. We know from successful Community Support programs for increasingly common conditions like Diabetes, that a) they are cost-savers by preventing expensive hospital admissions and b) require the close coordination and cooperation of teams of ancillary healthcare professionals.

Every Government needs to be actively seeking Healthcare savings through technology and simple procedural steps like In-home care. Reducing Hospital expenses and Nursing Home demand is critical for budgets surviving the economic impact of the Ageing population over the next 40 years.

If there is to be successful "Coordinated Multi-Disciplinary Care, Monitoring and Exception Reporting" program delivered by In-Home and In-community care via Best Practice Treatment Guidelines for even the top 22 conditions examined by the Caretrack study, then there will have to be reliable, centralised IT systems supporting it, including wireless mobile devices and Apps.

Just like in a hospital, a doctor (GP), will be able to order a per-patient customised, standard Treatment regime for any patient and know that it will be competently, diligently and consistently delivered by other healthcare staff. When the doctor needs to review the patients' progress, or gets called in to deal with complications or poor progress, they can rely on full, accurate and pertinent patient records.

None of which will happen by accident: it has to be designed, delivered and co-ordinated.

But especially, it has to be controlled and monitored: there needs to an explicitly assigned person responsible for the monitoring, care and follow-up of every individual in a programme.

Perhaps in the Community, as in Hospitals, this supervision, administration and coordination role belongs to Masters-level Nurse Practitioners.

cheers
steve

Letter to my local (ALP) member on this.
http://stevej-on-it.blogspot.com/2012/10/nbn-and-pcehr-transforming-world-of.html

Piece on the changes...
http://stevej-on-healthcare.blogspot.com.au/2012/10/i2p-internet-changes-everything-no-more.html

Piece on Caretrack Best Practice and the need for Coordinated Multi-Disciplinary Care, Monitoring and Exception Reporting:
http://stevej-on-healthcare.blogspot.com.au/2012/10/i2p-caretrack-and-beyond.html

The 22 medical conditions examined by Caretrack, in order of percentage appropriate care:

• Coronary artery disease
• Dyspepsia
• Chronic heart failure
• Hypertension
• Low back pain
• Panic disorder
• Chronic obstructive pulmonary disease
• Diabetes
• Venous thromboembolism
• Osteoporosis
• Depression
• Atrial fibrillation
• Cerebrovascular accident
• Community-acquired pneumonia
• Osteoarthritis
• Preventive care
• Surgical site infection
• Asthma
• Hyperlipidaemia
• Obesity
• Antibiotic use
• Alcohol dependence

NBN and PCEHR: Transforming the world of Healthcare

A letter I've written to my local member, Dr Andrew Leigh, on changes needed to support a coming revolution in Healthcare resulting from the NBN and PCEHR initiatives.

Pharmacies will be yet another Industry that'll experience a Structural Economic Change due to the Internet.

---

Subject: The implications of Electronic Prescriptions: Medicare need to subsidise Medication Reviews & monitoring by Pharmacists

Dear Dr Leigh,

Would you be able to pass this onto the Health Minister for me?

I've written a piece that I believe addresses a major blind-spot in Healthcare in the Internet Age:

"The Internet Changes Everything: No more Dispensing Community Pharmacies"
http://stevej-on-healthcare.blogspot.com.au/2012/10/i2p-internet-changes-everything-no-more.html

The NETA's introduction of the PCEHR will inevitably lead to wholesale electronic prescriptions by GP's in super-clinics, fulfilled by central, automatic dispensaries.

This will destroy the current business model of Pharmacies and remove community access to an increasingly important resource: independent expert review and monitoring of medications.
[I've termed them "Consulting Community Pharmacists".]

We've probably got 10 years lead time, but maybe much less.
Action is needed to prepare for what will be needed and have it available in good time.

We know from the increasingly fast uptake of smartphones (2007) and tablets (2010) that penetration of new on-line services/devices in Australia is both rapid and pervasive. This service (direct delivery prescriptions) will take off like wild-fire around 2014, when Australia Post have their lockers fully rolled out and the GP practice software developers have implemented electronic prescriptions for the PCEHR.

By then, the Federal Govt needs to develop policies to support the new services needed, training/certification/registration procedures and prescribing-rights (multi-level?) for Consulting Pharmacists and Medicare rebates and appropriate service levels for in-home, remote (video) and in-practice-room consultations.

This Government has introduced significant reforms embracing new technologies (NBN, PCEHR) and will derive substantial efficiencies and cost savings from them.

Anticipating and addressing this predictable and inevitable outcome of those reforms would be yet another notable achievement for you all.

regards
steve jenkin