Cyber Security
Apart from the clinical trials and tests that medical devices undergo as part of their release into the general market, government regulations must be enacted to ensure that all such devices undergo a process of stringent security assessments.
Denial of service Attackers can cause a denial of service to restrict authorised healthcare users from utilising health services. Healthcare systems and networks must be designed and architected to provide high availability, that is resilient to a distributed denial of service (DDoS) attack. Critical internet facing healthcare services must implement appropriate DDoS protection.
Ransomware attacks With the recent increase in ransomware attacks affecting multiple industries, it is imperative to ensure that in case a ransomware attack eventuates, the hospital systems are not affected and can be quickly recovered. Attackers launching ransomware attacks generally target data by encrypting it and holding the client ransom by decrypting the data if the ransom is not paid. It must be ensured that in cases of a ransomware attack, appropriate security incident management processes are in place and are followed. Affected devices must be segregated and disconnected from the rest of the network. Backups of all data must be present on dedicated data stores that are not directly connected to the affected client devices. Application whitelisting and advanced endpoint security platforms can be implemented that prevent the execution of malware and proactively detect abnormal behaviour.
IOT attacks The threats that IOT attacks could have on the healthcare sector are three-fold. Many medical and IOT devices have security misconfigurations and vulnerabilities and are connected to healthcare networks. This would result in unauthorised access to, or takeover of, these devices by malicious individuals, leading to attackers using the devices as a pivot to gain unauthorised access to the networks that these devices are connected to. Furthermore, an attacker that has gained unauthorised access to these IoT devices can make them a part of a larger Botnet that could use to launch distributed denial of service (DDoS) attacks on other targets. The remediation to protect such IoT devices is to ensure that they are regularly patched and securely configured. Additionally, such devices are only to be connected to a segregated network that does not connect to the corporate healthcare network.
Regulatory risks Healthcare organisations face increasing regulatory compliance and possible penalties if the confidentiality of
26 | Australian Cyber Security Magazine
healthcare data is breached and the data is not properly secured. Healthcare organisations in the US are bound by the Health Insurance Portability and Accountability Act (HIPAA) and Australian healthcare institutions must assess the various regulatory compliance requirements that affect them such as the Australian Privacy Act 1988. It is recommended that healthcare organisations understand the regulatory and privacy compliance requirements they need to meet, to meet their compliance requirements and ensure that they comply with the requirements, as well certified against such requirements and standards.
Conclusion The pace at which attacks are targeted the healthcare sector across the world, it is only a matter of time when attackers would choose to focus their efforts into launching a targeted attack on Australian healthcare networks. It is important for the healthcare institutions and cybersecurity organisations to work together, to proactively address the risk that affect the healthcare enterprises of today.