Health-ISAC Hacking Healthcare 6-17-2020

June 18, 2020

TLP White: This week, Hacking Healthcare looks at the U.S. Cybersecurity and Infrastructure Security Agency’s (“CISA”) announcement of a new strategy to protect Industrial Control Systems (“ICS”) in critical infrastructure sectors from cyberattack. Next, we break down recent threat research that illustrates just how quickly misconfigured databases in cloud environments can be found and exploited by malicious actors, but why that shouldn’t dissuade healthcare organizations from implementing them. Lastly, we look at a project backed by the U.S. National Science Foundation (“NSF”) to secure patient data related to COVID-19 research and explore its implications.

As a reminder, this is the public version of the Hacking Healthcare blog. For additional in-depth analysis and opinion, become a member of H-ISAC and receive the TLP Amber version of this blog (available in the Member Portal.)

Welcome back to Hacking Healthcare.

1. CISA Commits to New ICS Security Strategy.

Last week, CISA’s Director Chris Krebs announced a new strategy to protect ICS in critical infrastructure sectors from cyberattacks.[1] The new strategy emphasizes using data analytics, providing improved training, and deploying new technological solutions.[2] Krebs elaborated by saying, “We’re going to develop deep data capabilities to analyze and deliver information the community can use to disrupt the ICS kill chain.”[3] The announcement came during a virtual meeting of the ICS Joint Working Group (“ICSJWG”), which is a public-private, collaborative, information sharing effort centered around securing and reducing risks to ICS.[4]

This isn’t the only recent development on ICS cybersecurity to come from CISA. A little less than a month ago, CISA, The Department of Energy (“DOE”), and the U.K.’s National Cyber Security Centre (“NCSC”) released a joint document entitled Recommended Cybersecurity Practices for Industrial Control Systems.[5] The two-page info-graphic cleanly and succinctly outlines various cybersecurity considerations, risks, impacts, and proactive steps for ICS owners and operators to improve their cybersecurity readiness.

For those not as familiar with ICS, it is a broad term that covers a range of control systems that are typically found in industrial sectors and critical infrastructure. As the U.S. National Institute of Standards and Technology (“NIST”) points out, “These control systems are vital to the operation of the U.S. critical infrastructures that are often highly interconnected and mutually dependent systems.”[6] Within the healthcare sector, ICS can be found in various manufacturing, chemical, and pharmaceutical processes.

Analysis & Action

* H-ISAC Membership required *

2. How Quickly Are Misconfigured Databases Compromised?

It isn’t uncommon to see news stories about security researchers that come across unsecured databases filled with sensitive personal or business information. Oftentimes, it can take days or weeks for the researchers to contact such an unsecured database’s owners in order to secure it. While most of the time these unsecured databases are a product of accidental misconfigurations, just how fast could they be compromised by malicious actors if left unsecured? As it turns out, very quickly, according to research from Comparitech.

From May 11th to May 22nd, Comparitech constructed a dummy database on a cloud server and left it unsecured. Comparitech was interested in finding out exactly how long you might have to fix something like a misconfiguration error before sensitive data has likely been viewed, stolen, or modified.[7] Despite the vastness of the Internet, and the potential for a relatively nondescript database to be passed over, Comparitech reports that the first unauthorized request came only 8 hours and 35 minutes after the fake database was deployed.[8]

Over the next 11 days, Comparitech recorded 175 unauthorized requests from IP addresses in numerous countries including the U.S., Romania, China, and the Netherlands.[9] It is noteworthy that the database was not initially indexed on popular search engines like Shodan until the 16^thof May. Upon being indexed, the database received the first of its single-day record of 22 unauthorized requests within 1 minute of being listed.[10] Furthermore, a week after the research had concluded, the database was attacked, its contents deleted, and a ransom message was left.

Action & Analysis

* H-ISAC Membership required *

3. NSF Funds Tool to Aid in Protecting Patient Data Used for Research.

Under normal circumstances, the healthcare sector’s vigilant approach to protecting patient data may irritate those who feel that unnecessarily strong privacy and security protections hamper their ability to conduct medical research. In an age where everyone is keen to point to the transformative powers of big data, cloud computing resources, and interoperability, tension exists between the various stakeholders involved in the research process over how to ensure that patient data is treated with the privacy and security it requires. This tension has been heightened during a global pandemic where making data more available for research or for sharing could potentially deliver significant advancements in our understanding of COVID-19.

In an attempt to address part of this problem, The NSF has awarded $200,000 in grant funding to computer scientists at the University of Texas at Dallas and Vanderbilt University Medical Center.[11] The goal is to create “an open-source software tool to help policymakers and health care providers make [decisions regarding how much information health providers can disclose to researchers without violating patient privacy].”[12] The combined University of Texas and Vanderbilt team is “[focusing] on the risks of an individual being identified when patient data is released for research purposes,” and endeavors to be more comprehensive in the characteristics that are evaluated than those that are examined under existing tools.[13]

Action & Analysis

* H-ISAC Membership required *

Congress –

Tuesday, June 16th:

– No relevant hearings

Wednesday, June 17th:

– Senate – Committee on Health, Education, Labor, and Pensions: Hearings to examine telehealth, focusing on lessons learned from the COVID-19 pandemic.

Thursday, June 18th:

– Senate – Committee on Foreign Relations: Hearings to examine COVID-19 and international pandemic preparedness, prevention, and response.

– House – Permanent Select Committee on Intelligence: Hearing on Emerging Trends in Online Foreign Influence Operations: Social Media, COVID-19, and Election Security