Why healthcare IT security is so hard

In practice, the compromises employed to solve this conflict between security and safety tend to range from elaborate “break glass” systems, where the normal access control can be bypassed in an emergency, to the more directly pragmatic solution of placing the computer mouse in a blood bag rocker that flips it back and forth, so that the screen lock never activates.

A trefoil of systems

There are also aggravating circumstances in the form of the uniquely tripartite structure of healthcare IT systems.

Of course, all healthcare providers have everyday administrative office systems for tasks such as email and spreadsheets. This aspect of healthcare IT is shared by all large organizations. While the problem of protecting these kinds of systems might not exactly be solved, there is at least a sizeable, shared body of knowledge and best practices for how to deal with them.

Bigger healthcare providers also have large numbers of networked medical devices. These range from infusion pumps and insulin monitors to high-end MRI scanners, all hooked up to a computer network for the purposes of monitoring, data sharing, and remote access. These devices are subject to strict safety requirements that are often incompatible with basic IT security practices, such as frequent software updates. Indeed, many medical devices contain embedded computers that run operating systems that are no longer supported by the manufacturer. An IT security engineer might demand that such insecure systems be placed on a fully isolated network, only to quickly discover that this is not possible since the staff requires access to medical data from their office workstations. In addition, many hospitals and clinics have established contracts with specialist providers, such as teleradiology companies, that operate in different time zones to simplify coverage during off-hour shifts. Thus, there is a need to transfer MRI scan results to specialists on the other side of the world.

Beneath a healthcare provider’s administrative systems and medical devices lies a third, often forgotten, system: the supervisory control and data acquisition (SCADA) system that controls the infrastructure of the hospital or clinic. All the facilities that we take for granted, such as heating, ventilation, electrical power, lighting, and water supply, are all controlled by specialized computer systems. These are critical for the hospital or clinic to function, but seldom draw much attention from an IT security perspective. Yet there are plenty of realistic and frankly frightening scenarios to consider.

An abundance of regulations

While the technical reality of healthcare IT systems is complex, the regulatory environment in which they exist is a veritable labyrinth. Take, for example, a typical system for the distribution of medical oxygen, in which the gas is led in pressurized pipes throughout a hospital. In a normal setting, the physical pipework will be the responsibility of the facilities staff, while the gas itself is a medical product that is the responsibility of an appointed nurse or physician. In addition, there are industry safety codes for any handling of pressurized gases, which require that an internal gas safety organization be established. It is extremely unclear which of the multiple stakeholders involved has the ultimate responsibility for the IT security of the gas distribution control system.

With unclear chains of responsibility, there is an increased risk that issues will fall between the cracks, and it becomes harder to enforce a uniform IT security policy.

Ransomware, the nemesis

Given all of the above, it should not come as a surprise that many healthcare organizations turn out to be fairly porous targets for a determined attacker. However, most attackers expect some form of monetary gain from their attacks. While stolen medical records have always had a certain value in the marketplace, it was not until the advent of large-scale ransomware operations in recent years that the IT security threat to healthcare organizations really began to rise.

An ordinary business organization that is hit by a ransomware attack may—out of a certain sense of civic-mindedness or out of pure spite—simply refuse to pay the ransom, which means that all the time and effort the attacker has put into the attack is lost. A healthcare organization, however, will normally be under enormous pressure to restore its systems since patient safety is at risk. For a sufficiently brutal attacker, targeting healthcare organizations simply makes good business sense since they are more likely to pay up.

A solution, my kingdom for a solution

Unfortunately, there are no easy solutions to the healthcare IT security crisis, no magic black box you can simply hook up to the network, no five-step checklist to solve all your problems. One would wish that IT criminals could simply be put behind bars, but many—or most—operate from rogue jurisdictions such as Iran or Russia, where they are untouchable.

This will be a long journey and all stakeholders need to pull together. Not only must device manufacturers learn how to improve device security and law enforcement agencies how to collaborate internationally in an efficient manner—healthcare organizations must also learn how to continuously improve their security in an incremental fashion.

However, while there are no easy solutions, there are at least some basic guidelines for improving your security.

Chief of these is the realization that you are never done. You are up against motivated and intelligent adversaries who will come up with a steady stream of new ways to attack you. The saying “security is a process, not a product” is not just a cliché. It is also true.

Also remember that security needs to be improved in a balanced manner. If you spend all your budget on improving medical device security, you are not really much better off because the bad guys will simply attack your office network instead. You can safely assume that the attackers will always go for your weakest point.

And, finally, don’t forget those SCADA systems!