Feature | Cybersecurity | March 06, 2017 | By Greg Freiherr

WEB EXCLUSIVE: Why Radiology Should Be Very Afraid Of Cyber Criminals

Editor's Note: This is the first in a two-part series on cybercrime. The second will focus on how radiology can protect itself and its patients.

cybersecurity

Healthcare is an appealing target for cybercriminals. Last year cyberattacks led to the loss of 13 million patient records, according to Symantec Corp., a company focused on addressing cyberthreats. Last August Banner Health alone, with its 23 hospitals and specialized facilities across seven states, reported a data breach affecting 3.7 million patients and staff. The attack is believed to have occurred in June. It was discovered a month later, long after the data was gone.

Banner responded quicker than most.  On average, it takes 229 days to find a breach and 82 to contain it, according to the Ponemon Institute, a cybersecurity research company. Attackers are typically in and out in less than an hour.

 

Attacks On Imaging

Legacy imaging equipment and outdated medical IT systems are easy targets. These systems serve as "pivot points" forcyber criminals, weak links by which hackers can get into medical information technology systems.

What makes them weak is their reliance on obsolete operating systems like Windows NT and XP, which do not have up-to-date security. Even attacks with outdated malware like Conficker can succeed.

Conficker, a computer worm that exploits weaknesses in early versions of Microsoft Windows, was first detected in 2008. "It basically disappeared in early 2009, but in healthcare we see it over and over again because of legacy systems," said Alex Wirth, a healthcare solutions architect for Symantec, who spoke last month at the HIMSS 2017 annual meeting in Orlando.

The reason is that outdated operating systems like NT and XP are no longer being patched for security vulnerabilities. An outdated operating system made a C-arm X-ray system vulnerable, according to a report by TrapX Security, a cybersecurity firm. In this instance, the security company traced the malware to a backdoor in a fluoroscopy workstation running Windows XP. The intent of the attacker was to steal patient data, according to TrapX.

The attack was one of several in the oncology department of a hospital. Each attack targeted medical devices running out-of-date Windows operating systems. These are "quite vulnerable and have no endpoint detection cyber defense installed," according to the TrapX report.

In one attack, a hackster gained access to a hospital network through a backdoor in an X-ray system running Windows NT. A different attack was foiled by TrapX, which created a decoy picture archiving and communication system (PACS). The decoy led the attacker to believe the hack had succeeded. TrapX traced the malware to a backdoor in a magnetic resonance imaging (MRI) system running an unpatched operating system.

 

Medjacking for Dollars

Devices vulnerable to such "Medjacking" include positron emission therapy (PET) and computed tomography (CT) scanners, as well as infusion pumps, medical lasers, ventilators and dialysis machines. The common denominator is their outdated operating systems.

Medjackers may be political operatives or disgruntled employees, according to Wirth. But usually they are cybercriminals motivated by money.

Patient records can be sold on the black market for many times that of a credit card number. And cyber criminals don't even have to steal patient data.  They can hack an information system, encrypt the data, then demand payment to decrypt it. This kind of attack, called ransomware, is growing in popularity. 

Ransomware attacks against all industries, not just healthcare. It rose from 1,000 per day in 2015 to 4,000 per day in 2016, according to the U.S. Department of Justice. The malware is usually delivered through "spear phishing," in which an unsuspecting person in the network opens an email from what appears to be — but isn't — a known person.

Once the data is encrypted, it can't be fixed by anyone other than the cybercriminals.

 

Good Intentions, Bad Security

Noble intentions can be the root of vulnerabilities. Extending the life of a legacy system to save money is one. Another is patient engagement. Spurred by patient demands for increased access to their data, as well as "meaningful use" mandates from the Federal government, providers have created a plethora of patient portals.

"This is where the real vulnerability is," said Krishna Kurapati at HIMSS 2017. The CEO of QliqSOFT, a provider of secure messaging for doctors and nurses, noted that these portals typically are tightly integrated with the electronic medical record (EMR) system.  This makes patient portals a prime target for hackers.

Attacks might come if a patient accesses medical records while on a public network. Kurapati used the example of a Starbucks patron accessing his data. Patient portals are also vulnerable to denial of service attacks during which thousands, even millions of "bots" attack a site. This kind of attack can bring down not just the patient portal but the EMR and other connected IT systems.

 

The Cloud — A Soft Target

Vulnerability to cyberattack is taking on a new dimension, as providers move patient data into the cloud. "People are taking advantage of the fabulous opportunity to collaborate and get their jobs done using cloud applications," said Deena Thomchick at HIMSS 2017. The problem, according to the senior director of cloud security at Symantec, is that "your data is going all over the place."

A top concern, not surprisingly, is data compromise. Nevertheless, Gartner, a research and advisory firm specializing in IT, reported that the cloud is being viewed less as a threat to enterprise IT and more as  an extension.  While concerns about security and compliance continue regarding the cloud, security is becoming less of one.

The bottom line is that nothing — not the cloud, on-premise, or hybrid systems — can be 100 percent safe. At HIMSS 2017, Symantec's Wirth said healthcare is being asked by administrators to "secure the unsecurable" — and to do so with minimal funding, limited staffing and often little management support. And the outlook is not good.

But there are plenty of ways to reduce risk — simple, practical and pragmatic ones that can go a long way toward combating cybercrime.

Greg Freiherr has reported on developments in radiology since 1983. He runs the consulting service, The Freiherr Group.

Editor’s note: The second of this two-part series on cybersecurity describes how patient data and medical systems can be protected. "How Radiology Can Fight Cyber Crime," can be found here.

Related Content

FDA Clears Bay Labs' EchoMD AutoEF Software for AI Echo Analysis
Technology | Cardiovascular Ultrasound | June 19, 2018
Cardiovascular imaging artificial intelligence (AI) company Bay Labs announced its EchoMD AutoEF software received 510(...
News | Remote Viewing Systems | June 14, 2018
International Medical Solutions (IMS) recently announced that the American College of Radiology (ACR) added IMS'...
Wake Radiology Launches First Installation of EnvoyAI Platform
News | Artificial Intelligence | June 13, 2018
Artificial intelligence (AI) platform provider EnvoyAI recently completed their first successful customer installation...
How AI and Deep Learning Will Enable Cancer Diagnosis Via Ultrasound

The red outline shows the manually segmented boundary of a carcinoma, while the deep learning-predicted boundaries are shown in blue, green and cyan. Copyright 2018 Kumar et al. under Creative Commons Attribution License.

News | Ultrasound Imaging | June 12, 2018 | Tony Kontzer
June 12, 2018 — Viksit Kumar didn’t know his mother had...
Zebra Medical Vision Unveils AI-Based Chest X-ray Research
News | Artificial Intelligence | June 08, 2018
June 8, 2018 — Zebra Medical Vision unveiled its Textray chest X-ray research, which will form the basis for a future
Konica Minolta Launches AeroRemote Insights for Digital Radiography
Technology | Analytics Software | June 07, 2018
Konica Minolta Healthcare Americas Inc. announced the release of AeroRemote Insights, a cloud-based, business...
Vinay Vaidya, Chief Medical Information Officer at Phoenix Children’s Hospital

Vinay Vaidya, Chief Medical Information Officer at Phoenix Children’s Hospital

Sponsored Content | Case Study | Artificial Intelligence | June 05, 2018
The power to predict a cardiac arrest, support a clinical diagnosis or nudge a provider when it is time to issue medi
How image sharing through a health information exchange benefits patients while saving time and money is depicted in this slide shown at HIMSS 2018. Graphic courtesy of Karan Mansukhani.

How image sharing through a health information exchange benefits patients while saving time and money is depicted in this slide shown at HIMSS 2018. Graphic courtesy of Karan Mansukhani.

Feature | Information Technology | June 05, 2018 | By Greg Freiherr
A regional image exchange system is saving lives and reducing radiology costs in Maryland by improving the efficiency
Using Imaging Analytics for Radiology, VCU Health in Richmond, Va., has developed a dashboard to view turnaround time analysis. This functionality allows drill down for each technologist and radiologist and looks at the different steps of the imaging cycle.

Using Imaging Analytics for Radiology, VCU Health in Richmond, Va., has developed a dashboard to view turnaround time analysis. This functionality allows drill down for each technologist and radiologist and looks at the different steps of the imaging cycle.

Sponsored Content | Case Study | Information Technology | June 05, 2018
Sharon Gibbs, director of the radiology department at VCU Health in Richmond, Va., aims to provide quality, timely and...
PACS and the Road to Reconstruction
Feature | PACS | June 05, 2018 | By Dave Whitney and Jef Williams
The PACS — picture archiving and communication systems — have been in existence for more than 45 years. One of the...
Overlay Init