Feature | Cybersecurity | May 06, 2019 | By Maxim Chernyak

How to Protect Patient Health Data With Security Testing Automation

According to the National Association of County and City Health Officials, only 33 percent of the organizations plan against cybersecurity threats and initiate patient identity protection protocols.

According to the National Association of County and City Health Officials, only 33 percent of the organizations plan against cybersecurity threats and initiate patient identity protection protocols. 

As the National Association of County and City Health Officials state, healthcare breaches remained to be costly and disastrous for the organizations in 2018. Each patient record exposure can cost up to $400, and hackers always try to access the medical information of hundreds of thousands of patients at once. Meanwhile, the National Association also notes that only 33 percent of the organizations plan against cybersecurity threats and initiate patient identity protection protocols. 

 

Cybersecuity Threats Rolling Over Into 2019

Certainly, 2019 will only add fuel to the fire. Some of the most expected healthcare cybersecurity threats for this year are associated with increased personalization and selectivity, as well as social engineering. In particular, the trends lean toward malicious actors exploiting increasingly blurred boundaries between professional and personal activities. When people use their work accounts for accessing personal resources or follow the bring-your-own-device (BYOD) policy without precautions, it may lead to accidental data exposure or offer hackers a gateway into the individual’s workplace network.

Additionally, phishing is expected to become an even more advanced hacking approach, with scammers tuning up their emails and messages with the person’s information available from ad preferences and social media presence. We also should not forget about the ever-rising tide of identity thefts, when hackers access social security numbers and credit card data of their victims. 

This increased focus on personalization in healthcare cybersecurity threats puts the majority of healthcare organizations in even higher danger. Apart from the direct and blunt software attacks, hackers will target the human factor as well, trying to violate data from the inside. If the providers are unable to defend themselves even at a basic level, they will not be able to allocate resources for further planning and mitigation of emerging threats. 

So, the first step towards avoiding patient data breaches and cutting on settlement fines should be eliminating the known threats and system vulnerabilities regularly with the help of security testing automation. Testing automation brings in a major advantage for ensuring a provider’s infrastructure security. It tackles the basics, defining the most probable bottlenecks in different components of a single system as well as detecting integration loopholes between disparate applications and platforms.

Testing automation does not offer a silver bullet for the healthcare system security assurance and should go together with other testing techniques for more efficiency. However, it can cross out the known vulnerabilities to spare security testers’ time on exploratory testing and mitigating up-and-coming threats. 

Below is an example of a roadmap for successful security testing automation. It shows possible applications, limitations, and processes beyond automated security tests.

 

Starting From a Thorough Health IT Asset Survey

Healthcare organizations’ internal IT infrastructures are systems with many elements, and each should be identified prior to testing automation. This inventory includes not only PCs, storage, servers, and installed software, but also corporate (or personal in case of BYOD) mobile devices, and medical devices too. 
Mapping and understanding these physical assets, their location, purpose, and applications they run, security specialists can evaluate the risks and prioritize their testing activities. 
Each asset’s risk can fall into one of the categories: 
   • Components (OS, firmware, patches, external applications) 
   • System-wide changes
   • New software configuration errors 

Risk categorization allows organizations both to find and focus on the most pressing vulnerabilities. It also helps to navigate across more common problems in healthcare software security, such as unpatched OS, poor authentication, inadequate security protocols, weak passwords and more.
Although quite trivial, these vulnerabilities might be the first target for hackers. Knowing that healthcare organizations can lack strong security policies in place, cybercriminals can resort to simpler attacks and still succeed in unauthorized data access. On the other hand, security testing specialists can automate continuous scanning and even eliminate such vulnerabilities. 

 

Automating Cyber Security Tests

Based on the defined risks, security testing specialists can then segment the tasks for testing automation into functional, non-functional, application and infrastructure security scanning, as well as application logic testing groups. The testing teams can also define the success criteria to ensure that critical vulnerabilities are addressed in a way that benefits the organization in question.

One of the best practices implies that each application assigned for testing automation can be broken down into functions. This approach offers substantial application test coverage and helps to identify different vulnerabilities more effectively. Furthermore, security testing specialists can range the found vulnerabilities according to their severity and plan for fixes accordingly, either in a single upgrade or through multiple patches.

Launching Mock Cyber Attacks

While the series of automated tests helps to reveal vulnerabilities in certain system components, it still cannot ensure that the whole system will withstand a possible breach. To make sure that malignant activities do not lead to data exposure or theft, security testing specialists should initiate a mock-attack. It often focuses on such security basics as SQL injections, URL redirects, and open ports in the firewall.

Security testing teams should also identify sensitive systems, which can disrupt care delivery in case of an attack. Such systems can be devices related to acute patient care or surgery, for example, anesthesia monitors or dialysis machines. Depending on their sensitivity, such applications or physical assets should be accessed with limitations, or should not be targeted during the mock-attack at all to ensure patient safety.

Mock-attacks should be repeated from time to time to cover emerging vulnerabilities with system updates, new applications and devices. Certainly, they should be automated to save time and effort. This way, security testing specialists will be able to create a case scenario and then just tweak it to cover more variables instead of manually repeating the full processes. 

 

Beyond Security Testing Automation 

Once they are done with infrastructure security testing automation, security testers will get a whole knowledge base of the organization’s vulnerabilities, their range and severity. This information can be used as a foundation for further automation, such as for:

   • Security workflows
   • Continuous security monitoring tools   

   • Threat detection for preventing breaches

   • Threat response

Best practices of care delivery keep changing, so health IT systems support flexible updates and upgrades by default. Yet, each new component in such a system creates both a promise and a potential vulnerability. Therefore, security testing should be considered an ongoing process to be enhanced, tweaked and repeated regularly. 

Certainly, providers should consider using manual testing tools to explore upcoming threats and complement their automated testing results, occasionally shifting their focus between different activities. Only by staying flexible can healthcare organizations protect themselves both from basic and more advanced threats. 

 

Editor’s note: The author, Maxim Chernyak, is a head of test automation and performance testing lab at A1QA, an expert in test automation methodologies and tools for functional and nonfunctional testing. Accountable for the education and adoption of state-of-the-art quality engineering practices by QA teams.

Related Content

iCAD's ProFound AI Wins Best New Radiology Solution in 2019 MedTech Breakthrough Awards
News | Computer-Aided Detection Software | September 09, 2019
iCAD Inc. announced MedTech Breakthrough, an independent organization that recognizes the top companies and solutions...
A smart algorithm has been trained on a neural network to recognize the appearance of breast cancer in MR images

A smart algorithm has been trained on a neural network to recognize the appearance of breast cancer in MR images. The algorithm, described at the SBI/ACR Breast Imaging Symposium, used deep learning, a form of machine learning, which is a type of artificial intelligence. Image courtesy of Sarah Eskreis-Winkler, M.D.

Feature | Society of Breast Imaging (SBI) | September 06, 2019 | By Greg Freiherr
The use of smart algorithms has the potential to make healthcare more efficient.
Philips and Fujifilm booths at SIIM 2019.

Philips and Fujifilm booths at SIIM 2019.

Feature | SIIM | September 06, 2019 | By Greg Freiherr
Pragmatism from cybersecurity to enterprise imaging was in vogue at the 2019 meeting of the Society of Imaging Inform
Heath information technology diagram showing use of cloud storage.
Feature | Archive Cloud Storage | September 04, 2019 | Tyna Callahan
In healthcare, critical systems are being used to deliver vital information and services 24x7x365.
Global Diagnostics Australia Incorporates AI Into Radiology Applications
News | Artificial Intelligence | September 04, 2019
Global Diagnostics Australia (GDA), a subsidiary of the Integral Diagnostics Group (IDX), has adopted artificial...
The CT scanner might not come with protocols that are adequate for each hospital situation, so at Phoenix Children’s Hospital they designed their own protocols, said Dianna Bardo, M.D., director of body MR and co-director of the 3D Innovation Lab at Phoenix Children’s.

The CT scanner might not come with protocols that are adequate for each hospital situation, so at Phoenix Children’s Hospital they designed their own protocols, said Dianna Bardo, M.D., director of body MR and co-director of the 3D Innovation Lab at Phoenix Children’s.

Sponsored Content | Case Study | Radiation Dose Management | September 04, 2019
Radiation dose management is central to child patient safety. Medical imaging plays an increasing role in the accurate...
New Report Reveals Vulnerabilities of Internet of Things-enabled Healthcare Devices
News | Cybersecurity | August 29, 2019
Use of the Internet of Things (IoT) is booming, with IHS Markit forecasting there will be 73 billion connected devices ...
Royal Solutions and ZipRad Partner to Tackle Order Entry and Pre-authorization
News | Electronic Medical Records (EMR) | August 27, 2019
August 27, 2019 — Medical data delivery company Royal Solutions has partnered with ZipRad to streamline imaging exam
Glassbeam Introduces AI-powered Rules and Alerts Engine for Clinsights
News | Analytics Software | August 23, 2019
Glassbeam Inc. revealed several technology enhancements in its Rules & Alerts engine that make it dramatically...
Sectra Signs Enterprise Imaging Contract With Vanderbilt Health
News | Enterprise Imaging | August 21, 2019
Sectra will install its enterprise imaging picture archiving and communication system (PACS) and vendor neutral archive...