SCANHvBCC 2019/2020 Second Runner-Up Submission by Kühne Logistics University

The vulnerability of healthcare IT systems can be resolved.

INTERNET OF THINGS

Security and privacy issues

MOUNTAINWEST HEALTH SYSTEM AND CYBERSECURITY Environment

Cultural Influences

Economic Influences

Political Influences

Strategy Aim: Cybersecurity strategy that is inclusive of MHS‘s supply chain

Internal and external risk

Internal Processes Organizational Structure

Personnel

Mountainwest Health System (MHS)

Aim: Improvement of healthcare quality, safety, patient experience with focus on new innovations and growth

Indirect Direct Core Software Providers

Patients MHS Employees MHS Facilities

Government agencies

Tier ‘n’ suppliers Device Manufacturers

Non-MHS hospitals (in GPO)

MHS is part of a complex ecosystem.

§

§

§

Loosely structured healthcare system Unequal distribution of healthcare providers Lack of IT experts

§

§

§

§

Utilization of existing technologies Controlled data access Reduction of breach lifecycle Looser regulations

Threats

§

Maintaining and sharing patient information Efficiency: Digitization & automation

Opportunities

§

Weaknesses

Strengths

SWOT ANALYSIS OF THE HEALTHC ARE AND CYBERSECURITY LANDSC APE

§ Increase in cyberattacks § Trust (Patientside, in suppliers) § Hardware and software restrictions § Adverse government policies

MAIN THREATS

INTERNAL ACTORS

58 % of nearly 1,400 healthcare incidents analyzed in involved insiders

THIRD-PARTIES

56 % of organizations had a breach caused by their vendors

HARDWARE AND SOFTWARE

Companies blindly trust their hardware and software providers

MHS‘S VALUE PROPOSITION Supply by MHS

Customers

Partners

Experience

▪ Medical- and nonmedical related ▪ Hard- and software

▪ Aim: Quality, safety, patient experience (e.g. digital healthcare)

§ Affordable § Easy to access § Less bureaucracy

Wants

§ Dehumanization of healthcare § Theft of personal data

Fears

Fit Needs

Benefits ▪ Large geographical coverage ▪ Innovative care

Features ▪ Medical- and nonmedical related ▪ Hard- and software

Costs

§ Trust § Involvement § High quality

Revenue

EXTENDED ZERO TRUST STRATEGY

Fit ✚

Addresses main threats

✚

Guarantees patient privacy

✚

Proven in digital healthcare (e.g. DXC.technology)

MHS

CUSTOMERS

Zero Trust Strategy

- John Kindervag, Forrester Research

§ “Trust only what you know.“ §

Trust is seen as a vulnerability

§ “Never trust, always verify.” §

All users are equally verified and equally able to gain access

§

Eliminates the outsider-/insider-paradigm

Benefits ✚ Builds on existing architecture and technology ✚ Simple to implement ✚ Possibility for joint shared risk model with supply chain partners

Limitations −

Cost intensive

−

Complex

−

Long-term implementation (Google: 6 years)

1. Identify the protect surface II. Map the transaction flows D E P L OY I N G A ( E X T E N D E D ) Z E RO T RU S T S T R AT E G Y

III. Build a Zero Trust architecture IV. Create Zero Trust policy V. Monitor and maintain

MHS‘S SUPPLY CHAIN Upstream

Downstream

Inventory Management

Patients Information

Purchasing

Supplier ‘n‘

Cash Manufacturer/ Software Producer

Transport Management Physical flow Internal Supply Chain MHS

INTEGRATING “ZERO TRUST INTO “MHS‘S SUPPLY CHAIN

“Go from too many unknowns to trusting only what you know.”

- Jeff Pollard, principal analyst in cybersecurity at Forrester Research §

Reduce number of suppliers, where possible

§

Create supply chain transparency è stronger supplier selection criteria

§

Integrate processes with partners

PROOF OF FUNCTIONALITY OF A ZERO“ZERO TRUSTTRUST" STRATEGY SUPPORT IN HOW TO IMPLEMENT Access policies

Kipling Method: Who, what, when, where, why and how

Cyber incident response plan Organizational structure

Training Partnerships

§ Companies offering zero trust platforms § American Hospital Association (AHA): Learn more about cybersecurity risks for hospitals

IMPLEMENTING ZERO TRUST: CYBER INCIDENT RESPONSE PLAN

1. Prepare for the possibility of a security incident 2. Identify the type of incident 3. Begin containment and cleaning-up of the incident 4. Eradicate the breach 5. Recovery for being back in production 6. Review lessons learned

Companies Offering “Zero Trust“ Platforms

PROOF OF FUNCTIONALITY OF A ZERO TRUST STRATEGY

“Zero trust as a viable option to support digital Healtchcare.“ - DXC.technology

ZERO TRUST STRATEGY § Securing the network’s most critical and valuable data, assets, applications and services (DAAS)

EXTENDED ZERO TRUST STRATEGY FOR MHS § Updating MHS‘s technology § More secure than only adding layers of protection

§ Continuous improvement Micro-Perimeter

DAAS

§ PDCA-circle

Additional suggestions 1. RFID 2. Private cloud 3. Hackathon

SUGGESTION I: IMPLEMENT RFID TECHNOLOGY

REASONS FOR IMPLEMENTING RFID Goal §

Increase patient safety by ensuring the products entering MHS facilities are genuine Reduction of gray market and counterfeit products in supply chain

§

A non-genuine product has the potential to both harm the patient and MHS’s reputation

PROOF OF CONCEPT Reduction occurrence of gray market and counterfeit products in various industries

ยง

Success Story of WaliMai ยง

Successfully reduced the occurrence of dangerous counterfeit baby formula by implementing RFID technology

− Older technology (Obsolescence risk) − Large initial investment − Supplier pushback − Additional devices connected to IoT, causing increased IT system vulnerability

Risks can be mitigated by implementing the extended zero trust strategy

L I M I TAT I O N S

BENEFITS OF RFID

Increased asset Increased labor utilization utilization

Reduced Higher visibility Identification Unique and shrinkage of assets in the and unduplicable supply chain differentiation chips of objects by using radio waves

Chips unremovable without causing damage

Reduction of gray market and counterfeit products

Justification of initial investment

REASONS FOR CHOOSING RFID OVER BLOCKCHAIN RFID

Blockchain

✚ Has been studied and tested for many years

−

Needs another 5-10 years before it is mature

Maturity as Cut-Off Criteria §

Implementation of untested and unproven technology is extremely risky and unpredictable è Higher cost

Innovation

Tradeoff

Feasibility

Blockchain

RFID

Partnership with the USbased company “Vizinex“

I M P L E M E N TAT I O N OF RFID TECHNOLOGY BY MHS

§ RFID tags on finished goods level of one supplier Pilot Project

Rollout § RFID tags on finished goods level of all 20 hospitals of MHS

§ RFID tags on the component level for all suppliers and facilities of MHS Ideal Future State

ROI ASSUMPTIONS §

§

Assumptions for average MHS hospital: § 300,000 square feet § 120 beds § 300,000 square feet § 670 employees § 4000 assets to be tagged (Only assets over $30 in value, e.g. pumps, gurneys, and defibrillators) Example cost: § Equipment costs § Training costs § Installation costs § Tag costs § Software costs § Maintenance costs

Cost for a full-scale RFID implementation per hospital:

$350,000

SUGGESTION II: ADAPTATION OF PRIVATE CLOUD

GOAL

OUTCOME

§ Securing patient data and PHI

§ Creation of processes that can be used to detect data breaches quicker

§ Creating awareness of the importance of “software updates” for upstream supply chain partners

§ Reduction of data breach life cycle

P RO O F O F C O N C E P T: AT M S Driving ATM software and operations into the cloud: ✚ Cuts costs up to 40 % ✚ Bank with 100 ATMs can have savings up to 800,000 USD a year ✚ Easy transactions processes: e.g. provision of omni-channel experience ✚ Design of the software to eliminate malware: e.g. remote control ✚ Ability of transactions and services to be shared and re-used elsewhere: e.g. UK

PROOF OF CONCEPT Application by CardTronics §

One of the largest ATM owner/operator of the world

§

More than 110,200 retail ATMs in U.S. and international locales

Why financial institutions? §

Containing sensitive information

§

ATMs’ being prone to cyber attacks due to easily accessible USB slots

BENEFITS OF A PRIVATE CLOUD ✚ Quickly available applications in the cloud platform ✚ Automatically synchronized data ✚ A “remote wipe” capability ✚ Reduction of costs ✚ Increased efficiency ✚ Optimized scalability

Not easily adapted by traditional hospitals (Being unsure, reluctant, resistance to adapt)

LIMITATIONS

Need to overhaul the infrastructure of hospitals − Requirement of better experience for selfservice system − Additional costs Risk Mitigation by: § Targeted communication strategy to overcome resistance § Implementation plan that takes, for example, traditional employees into account

IMPLEMENTATION OF A PRIVATE CLOUD BY MHS

Partnership with Microsoft Healthcare Azure API for Health Record Sharing

Protection Against Fake Updates

✚ Creation of a secure cloud API platform

✚ Impossible to update without visiting the website

✚ Usage of FHIR (Fast Healthcare Interoperability Resources)

✚ No “new update” emails from the company

✚ Successful application by banks, financial service providers, chemical industry, health services, medical technology, and insurance industries

✚ Avoidance of trojan horses with Microsoft Security Essentials (MSE) antivirus

✚ Automatic updates to keep the system current

IMPLEMENTATION OF A PRIVATE CLOUD BY MHS

Partnership with Microsoft Healthcare Microsoft 365 for Hospital Teams

Microsoft Healthcare Bot

✚ Secure communication

✚ Built-in symptom checker

✚ Delegation of important tasks through the platform

✚ Understanding of medical terminology ✚ Triaging patients

✚ Integration of electronic health records system

Utilizing Microsoft Healthcare‘s expertise in cybersecurity ensures that MHS can concentrate on their core competency: Patient care.

REQUIRED INVESTMENT Loss Range of US-Hospitals due to Cyberattacks §

Between $ 3 million and $ 10 million

§

Average loss: $ 6.5 million

Microsoft Healthcare §

Combination of “Value-Based Care” and Fee-for-Service

§

Cloud flat rate per year: $ 658,972

$ 658,972 $ 6,500,000

1. Subscription Fee for Patients a. Fee-for-Service: Paying for each service separately b. Flat rates starting from 1 year up to 10 years

T H R E E WAYS TO MONETIZE

II. Bundle Price for Patients a. Episode-based payment b. Bundling similar services, e.g. blood analysis related services, otolaryngology – ENT services

III. Patient Specific Pricing a. Clustering patients based on services b. Depending on the type of the service, e.g. contagious diseases, hard-diagnosed diseases, rare diseases

SUGGESTION III: CONDUCTING A HACKATHON

Creative problem solving

MOUNTAINWEST HEALTH SYSTEM HACKATHON – EXTENDING “ZERO TRUST“

Goal Detecting points of vulnerability in MHS‘s supply chain è Incl. testing the potential benefits of: § RFID § Private cloud § Extended zero trust strategy

PROOF OF CONCEPT Top Industries for Hackathons

3,450 Hackathons in 2016

1,568 MHS Hackathon

470

230

Tech

33.4 %

Finance

10.0 %

Retail

8.6 %

Health

7.9 %

Manufacturing

7.9 %

Telecom

5.7 %

Other

26.5 %

REASONS FOR A STUDENT HACKATHON MHS Student Hackathon

75 %

✚ New and innovative ideas ✚ Testing new system and its vulnerabilities before its rollout ✚ Corporate MHS hackathon not feasible ✚ (e.g. Google has much bigger IT team) ✚ Employer branding ✚ Creation of brand awareness

25 % Public Hackathons

Internal Hackathons

PARTICIPANTS

This ensures the participants have adequate knowledge

BENEFITS FOR STUDENTS

Experience

Company insights

Parallel track for workshops, networking and mentor program

Winners can participate in RSA Conference

Travel expenses

External communication needs to emphasize student benefits è Clarify that MHS wants to give students a chance, not just use them for cheap labor

Chances for an internship, postgraduation job

IMPLEMENTATION AND ACTION PLAN Strategic decisions

Ideation process

Plan

Preparation of hackathon

Two-day hackathon

4 months before

Day Zero

Do

10 months before

6 months before

First idea & funding

Call for applicants

Award ceremony

Check

HR follow-up

Ongoing

Act

~ 1 month Preselection

Repeat

Proof of concept

Before roll-out Implement changes

IMPLEMENTATION: FIRST IDEA AND FUNDING Partnerships to reduce resources and cost for MHS University of Kansas ✚ One of the 20 best cybersecurity schools in the US ✚ Free/cheap venue ✚ Technical requirements given (e.g. Wifi, computers)

ChallengeRocket. com ✚ Experienced partner in organizing hackathons ✚ Less effort and resources required by MHS

Microsoft Health Care ✚

Vizinex

Proof of concept for MHS

Others §

Local suppliers (e.g. food, advertisement)

§

Media

✚ Cost savings

CALL FOR APPLICATIONS §

Extensive communication since it is a new event (e.g. campus marketing, direct contact with professors)

§

Team size: 2 – 4 individuals

Applications for one of three spectrums RFID - Application for Hardware I. II. III.

Private Cloud - Application for Software

Hack replica of system before new technology implementation Hack replica of system implemented in pilot phase Ideas for improvement

Business Processes - “Zero Trust“ Implementation Possible projects: § Data access policy § Supplier selection crieria § Cyber incident response plan § Organizational structure

3 teams per spectrum are invited for the 2-day hackathon (max. 36 participants)

REQUIRED BUDGET Currently unknown if proposed partners cooperate (physical goods and financial support) è After pre-selection, invite 3 teams per spectrum, max. of 4 people per group (36 participants) $50 per participant per day – food, misc. (2 days) $50 per participant per day – housing in a shared hotel room (2 days) $200 for travel expenses

Estimated đ??śđ?‘œđ?‘ đ?‘Ą = $50Ă—2 đ?‘‘đ?‘Žđ?‘Śđ?‘ + $50Ă—2 đ?‘‘đ?‘Žđ?‘Śđ?‘ Ă—36 đ?‘?đ?‘Žđ?‘&#x;đ?‘Ąđ?‘–đ?‘?đ?‘–đ?‘?đ?‘Žđ?‘›đ?‘Ąđ?‘ + $200 ∗ 36 đ?‘?đ?‘Žđ?‘&#x;đ?‘Ąđ?‘–đ?‘?đ?‘–đ?‘?đ?‘Žđ?‘›đ?‘Ą = $10,900 + Buffer = $15,000

OUTCOME MEASURES & Q U A N T I F I C AT I O N O F R E S U LT S

Tangible

Intangible

Spectrum I and II:

Overall hackathon:

Determine how often the replica system was hacked (Old and improved one)

Multiply by the estimated cost of a breach

§ Quality of ideas/innovations (Evaluation by judges) § Participant’s satisfaction (Survey) § Recruiting benefits – number of contacts made and response rate

IMPLEMENTATION AND ACTION PLAN Kotter‘s 8 Step Change Model I. Creating a climate for change §

Extensive communication to overcome resistance of change from employeees and patients

Three Phase IT Migration - recommended by Google‘s deployment team III. Implementing and II. Engaging and enabling the whole organization sustaining change Hackathon III. MHS-wide II. Early I. Core IT Adoption adopters

Set up of MHS‘s “Cyber Initiative“

1

2

3

Create urgency

Create a coalition

Develop vision and strategy

4 Communicate the vision 2 years

5 Empower action

6

Get quick wins

8

7

Leverage wins to drive change

Embed in culture

3-4 years

COMMUNICATION AND ENGAGEMENT STRATEGY MHS Employees §

Kickoff Information Event §

§

Short introduction at every MHS facility

Change ambassadors §

Intrinsic motivation of change to convince other employees of “Cyber Initiative“

§

Create feeling of “bottom-up“ change by involving them in decision making

Patients § Personas § Segment different degrees of “resistance“ by patients and train employees how to handle each one

§ Brochures, posters and newsletter § Information about the benefits and security side of the technologies

§ Information events § E.g. invitations for final pitch of Hackathon

Goal: Overcoming resistance, creating trust and engaging the most important stakeholders

OUTCOME MEASURES Hard KPIs

Soft KPIs

§ Reported incidents

§ Patient satisfaction (e.g. patient survey)

§ Number of major security incidents

§ Employee satisfaction (e.g. employee survey)

§ Number of small security incidents (To set priorities)

§ Employee involvement (e.g. workshops conducted)

§ Cost per incident § Amount of time to resolve an incident § Downtime during an incident § Employee turnover § Interactions of employee devices on network § Number of patients

By investigating these KPIs, the improvement achieved by MHS‘s “Cyber Initiative“ can be monitored

ROI OF MHS‘S CYBERSECURITY INVESTMENT

(Hypothetical loss from cybersecurity attacks – Investment to prevent) Cost of investment = % ROI of Cybersecurity investment

§ Hypothetical loss from cybersecurity attacks §

Average total cost of a data breach in the healthcare industry: $6.45 million

§ Investment to prevent §

Implementation of extended zero trust strategy, including cost for RFID implementation, private cloudservice and hackathon costs

FUNDING “Black Book’s annual cybersecurity survey reveals healthcare enterprises are not maturing fast enough, processes continue underfunded and understaffed,”

§

Government grants Global healthcare cybersecurity spending will exceed $65 billion cumulatively over next five years

§

§

Examples of organizations MHS could potentially receive funding from to undergo research §

European Commission

§

National Institutes of Health

§

Food and Drug Administration

Potential Grant:

SCALABILITY & TRANSFERABILITY

MHS

Transferability ยง

Other devleloped countries with similar healthcare structure

ยง

Develping countries critical since e.g. corruption makes it hard to build reliable bonds with partners

Scalability ยง

Zero trust strategies have a different scope depending on main threats of the healthcare system

ยง

High investment hindering factor, but business processes easy to adapt