Why Healthcare Security Matters

ronjor · Apr 11, 2018

Imagine you're having a CT scan and malware alters the radiation levels – it's doable

By John E Dunn 11 Apr 2018
WannaCry was a wake-up call for healthcare, but the sector is still terribly vulnerable to attack
Click to expand...

ronjor · Apr 14, 2018

A test of patients: the challenges of healthcare IT

Sylvester Wong Fri 13 Apr 2018 3.20pm
Working in healthcare IT provides a unique set of challenges. Unlike many other typical IT departments, the decisions made in the healthcare sector directly affect patient wellbeing. This adds an additional level of pressure and reliance on the IT team that isn’t typically seen in other organisations.
Click to expand...

ronjor · Apr 15, 2018

Healthcare companies raise $6.8B in Q1, topping tech and every other industry

by Clare McGrane on April 13, 2018
Healthcare has been a winner so far in 2018, at least in terms of venture capital.
Click to expand...

ronjor · Apr 15, 2018

Canadian pharmacy fined $34 million for illegal imports

HELENA, Mont. — Apr 13, 2018, 6:54 PM ET By Matt Volz, associated press
An online pharmacy that bills itself as Canada's largest was fined $34 million Friday for importing counterfeit cancer drugs and other unapproved pharmaceuticals into the United States, a sentence that one advocacy group called too light for such a heinous crime.
Click to expand...

ronjor · Apr 19, 2018

Researcher Billy Rios, Talks Medical Device Security at RSA Conference 2018

by Tom Spring April 18, 2018
Researcher Billy Rios, founder of WhiteScope, discusses medical device hacking at RSA Conference 2018 with Threatpost’s Tom Spring. Rios also talks about his work where he demonstrated how an attacker could remotely hack an internet-connected car wash and used it to attack and damage vehicles.
Click to expand...

guest · Apr 19, 2018

Brainjacking: A Potentially Deadly Type of Hacking
April 19, 2018
https://www.bleepingcomputer.com/news/security/brainjacking-a-potentially-deadly-type-of-hacking/

Hacking the brain of someone with an implanted medical device is not a far-fetched illusion. While at one time a concept relegated to hair-raising Hollywood movies, scientists in Belgium have found that a wireless brain implant, known as a neurostimulator, can be hacked using off-the-shelf materials. By utilizing remote exploitation, hackers can make voltage changes that, “could result in sensory denial, disability, and death.”
Securing medical devices
The researchers in Belgium describe their preferred method for securing medical devices in a paper entitled Securing Wireless Neurostimulators. It was presented at the Eighth ACM Conference on Data and Application Security and Privacy last month and involves reverse engineering of an unnamed implantable medical device and using cheap equipment to receive and transmit messages to and from it.
U.S. government issues alerts
The U.S. Department of Homeland Security joined the chorus by issuing an alert regarding the use of hard-coded (unchangeable) passwords in medical devices. But, it has been argued that security measures need to be part of the design by the manufacturers, thus mitigating at least some of the potentially dire consequences. The use of rechargeable implants is one such improvement because it guards against battery-draining attacks.
The Food and Drug Administration (FDA) has pointed out that all medical devices carry a certain amount of risk. The regulatory agency gives the nod to medical devices when there is a reasonable assurance that the benefits to patients outweigh the risks.
Click to expand...

guest · Apr 19, 2018

FDA Wants Medical Devices to Have Mandatory Built-In Update Mechanisms
April 19, 2018
https://www.bleepingcomputer.com/ne...to-have-mandatory-built-in-update-mechanisms/

The US Food & Drug Administration plans to ask Congress for more funding and regulatory powers to improve its approach towards medical device safety, including on the cybersecurity front.

An FDA document released this week reveals several of the FDA's plans, including the desire to force device makers to include mandatory update systems inside products for the purpose of delivering critical security patches.
Medical devices to come with a "Software Bill of Materials"
In addition, the FDA also plans to force device makers to create a document called "Software Bill of Materials" that will be provided for each medical device and will include software-related details for each product.

Hospitals, healthcare units, contractors, or users will be able to consult the medical device's bill of materials and determine how it functions, what software is needed for what feature, and what technologies are used in each device.
FDA plans new entity —a mix between CERT and the NTSB
Last but not least, the FDA wants to create a new entity called the CyberMed Safety (Expert) Analysis Board (CYMSAB) that will be a public-private partnership.
Click to expand...

ronjor · Apr 20, 2018

FDA issues worldwide 'recall' on heart implants for security firmware update

Liam Tung (CSO Online) on 20 April, 2018 02:58
The US For and Drug administration is urging patients with heart implants from Abbot Laboratories to visit a healthcare centre and install a firmware update that addresses a remote hacking vulnerability and a rapid battery depletion bug.
Click to expand...

Minimalist · Apr 21, 2018

A US healthcare company seemingly exposed on the public internet contact information for roughly 10,000 medical professionals.

IT pro Brian Wethern said he warned Health Stream nine days ago that one of its now-removed websites had left a database of users out in the open, allowing anyone to slurp the first and last names of medics, and their email addresses and ID numbers. These professionals appear to be connected to Health Stream's Neonatal Resuscitation Program.
Click to expand...

https://www.theregister.co.uk/2018/..._leaves_nrp_database_sitting_out_in_the_open/

ronjor · Apr 23, 2018

'Orangeworm' Cyberspies Target Healthcare Sector in US, Europe, Asia

By Eduard Kovacs on April 23, 2018
A threat group tracked by Symantec as Orangeworm has been targeting healthcare organizations in the United States, Europe and Asia, but the attacks do not appear to be the work of a nation state.
Click to expand...

ronjor · Apr 26, 2018

Why Hackers Love Healthcare

Allan Alford 4/26/2018
The migration of valuable data to the cloud is piquing the interest of cybercrimimals. But there are ways to fight back.
Click to expand...

ronjor · Apr 30, 2018

How a gaming chip could someday save your life

by Will Knight April 30, 2018
Nvidia has made a fortune selling chips for games and AI. Now it wants to reboot hospitals.
Click to expand...

Minimalist · Apr 30, 2018

KRACK Vulnerability Puts Medical Devices At Risk

A slew of devices from medical technology company Becton, Dickinson and Company (BD) are vulnerable to the infamous KRACK key-reinstallation attack, potentially enabling hackers to change and exfiltrate patient records.

The KRACK vulnerability, discovered last October, is an industry-wide glitch in the WPA and WPA2 protocol for securing Wi-Fi that can cause “complete loss of control over data,” according to the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). It explained in an advisory that KRACK “could allow an attacker to execute a ‘man-in-the-middle’ attack, enabling the attacker within radio range to replay, decrypt or spoof frames.”
Click to expand...

https://threatpost.com/krack-vulnerability-puts-medical-devices-at-risk

ronjor · May 2, 2018

IT errors responsible for 450,000 missed cancer screenings

Sam Clark Wed 2 May 2018 1.16pm
IT errors were responsible for missing invitations to breast cancer screenings for 450,000 women in the UK, it has been revealed. The error has been estimated to be connected to between 135 and 270 deaths, according to Health Secretary Jeremy Hunt.
Click to expand...

Minimalist · May 11, 2018

Crypto-Miners Supplant Ransomware as the Top Healthcare Cybersecurity Threat

Malicious crypto-miners have supplanted ransomware as the top healthcare cybersecurity threat, a cross-sector report revealed.

The April 2018 edition of the Healthcare Information and Management Systems Society (HIMSS)’s “Healthcare and Cross-Sector Cybersecurity Report,” which referenced the recent “Comodo Cybersecurity Q1 2018 Report,” found that crypto-miner attacks increased over the course of the quarter while ransomware attacks decreased.
Click to expand...

https://securityintelligence.com/ne...e-as-the-top-healthcare-cybersecurity-threat/

ronjor · May 13, 2018

Interesting development.
Walmart's next healthcare move: Using data to identify bad doctors

By Veronica Combs | May 11, 2018
Data analysis is at the heart of Walmart's new approach to healthcare, which will only include doctors who practice evidence-based medicine.
Click to expand...

hawki · May 22, 2018

"LifeBridge data breach exposes personal information of 500,000 patients...

The attacker accessed the health system’s servers through one of its physician practices, LifeBridge Potomac Professionals. Information potentially taken included names, addresses, birth dates, insurance information and Social Security numbers found in the patient registration and billing system..."

http://www.baltimoresun.com/health/bs-hs-data-breach-lifebridge-20180522-story.html

ronjor · May 25, 2018

1 in 10 healthcare organizations paid a ransom within the last year

Help Net Security May 25, 2018
More than one in three healthcare organizations have suffered a cyberattack within the last year, while almost one in 10 have paid a ransom or extortion fee, according to Imperva.
Click to expand...

ronjor · May 29, 2018

Unusual Breach Report by Humana Shines Light on Fraud Prevention

Marianne Kolbasuk McGee (HealthInfoSec) • May 29, 2018
Use of Analytics Apparently Helped to Prevent Fraud, Warn Victims
Click to expand...

ronjor · May 30, 2018

Mental Health Provider Pays Ransom to Recover Data

Marianne Kolbasuk McGee (HealthInfoSec) May 29, 2018
A mental healthcare practice's decision to pay a ransom to have sensitive patient data unlocked illustrates the difficult choices that organizations can face when attempting to recover from a ransomware attack.
Click to expand...

ronjor · May 31, 2018

FDA Medical Device Plan: a Baby Step in the Right Direction

May 31, 2018 07:12 by Taylor Armerding Dan Lyon
The federal Food and Drug Administration’s (FDA) recently released Medical Device Safety Action Plan begins with a declaration that would seem to put it and most of the cyber security industry in parallel universes.
Click to expand...

ronjor · May 31, 2018

Regulator: Don't Neglect Physical Security of 'Workstations'

Marianne Kolbasuk McGee (HealthInfoSec) • May 31, 2018
OCR Alert Offers Insights on Keeping Patient Records Secure
Click to expand...

guest · Jun 2, 2018

Problems Loom for Buyers Following Healthcare M&A
June 1, 2018
https://www.infosecurity-magazine.com/news/problems-loom-for-buyers-post/

For buyers that have acquired a healthcare company, cybersecurity issues are not coming to light until after the deal is done, according to a new report, Reshaping Healthcare M&A: How Competition and Technology Are Changing the Game, published by West Monroe Partners.

One reason those issues aren't discovered prior to closing the deal is that most targets don’t allow sufficient access to discover cyber issues, said Brad Haller, director in West Monroe Partners’ mergers-and-acquisitions practice.

As a result, many acquirers are dissatisfied with their cyber-diligence, but there are additional causes of dissatisfaction. Haller said, "Diligence partners can sometimes disappoint by not providing creative enough solutions to the cyber problems discovered. That is, a buyer always wants to know how a cyber problem can be addressed without throwing a ton of money at it but that’s often the advice they get."
Click to expand...

guest · Jun 6, 2018

NHS England fingered over failure to forward patient correspondence
Millions wasted and patient harm 'cannot be ruled out'
June 6, 2018
https://www.theregister.co.uk/2018/...ailure_to_forward_patient_correspondence_pac/

NHS England is to blame for a backlog of 374,000 items of undelivered clinical correspondence following a move to Capita's Primary Care Services contract, the Public Accounts Committee has concluded today.

The NHS has wasted £2.4m pounds reviewing the handling of misdirected clinical correspondence, after Capita commenced a seven-year contract to provide primary care support services in 2015.
Previously GPs forwarded clinical correspondence to local primary care services centres, and a proportion erroneously continued to do so after the contract was outsourced to Capita.

"However, this time it was NHS England which was far too slow to treat the issue seriously and take action," said the committee.

"Basic administrative efficiency should not be difficult to deliver. The systemic nature of this incident is a big concern and money which should have been spent on patients has instead been spent cleaning up the mess.
"Failure to deliver key aspects of the end-to-end service, delivered by Capita and other organisations, impacted primary care services and, potentially, put patients at risk of serious harm," it said last month.
Click to expand...

guest · Jun 7, 2018

Apple's Health Record API released to third-party developers; is it safe?
June 7, 2018
https://www.computerworld.com/artic...sed-to-third-party-developers-is-it-safe.html

While the move promises to streamline the sharing of healthcare data, it also could open the door to that highly sensitive data falling into the wrong hands.
Medisafe's prescription app plans
For example, medication management platform Medisafe will be among the first to connect with the Health Records so consumers can import their prescription list without manual entry, enabling pill reminders and allowing the user to get relevant medication information. Family members can also receive alerts in case a patient is not responding to prompts.
The growth of healthcare data sharing
EMR vendors such as EPIC, Cerner, Athenahealth, Meditech and AllScripts worked with Apple to enable integration with the mobile app. When a patient downloads the Apple Health app and chooses to allow their health data to be transferred from a healthcare provider to Apple's Health Record, it is encrypted and does not traverse Apple's network.
How safe is safe?
"Even if you allow your health records to be sent to your device, can Apple really assure you that they can't be hacked? There is no such thing as a hack-proof iPhone, or any other device for that matter," said Jack Gold, principal analyst with J. Gold Associates.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

hawki Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

hawki Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Useful Searches