Supply Chain Attacks Could Pose Biggest Threat to Healthcare

Healthcare organizations often overlook the part of their operations where they are most vulnerable. Supply chain attacks pose a greater threat than exposed medical devices, report researchers who have analyzed the industry's risk since WannaCry hit in May 2017.

WannaCry may not have been built to target healthcare but the massive ransomware operation still left its mark on the industry, blocking National Health Service (NHS) trust hospitals from accessing patient records and forcing doctors to reschedule appointments and surgeries.

The profound effect on the healthcare industry prompted researchers at Trend Micro and the Healthcare Information Trust Alliance (HITRUST) to investigate healthcare network risks flying under the radar. They specifically looked into how supply chain cyberthreats, and exposed connected medical systems and devices, affected organizations' security posture.

Connected medical devices demand scrutiny as cybercriminals can take advantage of their exposure to break into organizations, run botnets, take data, or launch ransomware attacks.

"There's definitely more devices now, and wider exposure brings a greater landscape, greater aperture for attack," says Greg Young, vice president of cybersecurity at Trend Micro. Confidentiality, integrity, and availability are always considered in device security but with healthcare devices, safety must be considered as well, he adds. It's not a stretch to recognize an IoT attack on medical devices could cause physical harm to patients.

Diagnosing Supply Chain Threats

Industries like telecom, financial services, and consumer technology know all too well the risk of supply chain attacks. As healthcare relies more heavily on supply chain vendors, third-party service providers, and cloud-based systems, its organizations are also recognizing the risk.

Attackers can abuse third-party goods and services to steal confidential information, change data, install malicious software, introduce an unapproved function or design, or bring counterfeit devices into the organization. The risk of supply chain attacks in healthcare has grown along with the number of devices as attackers see an opportunity to manipulate them.

Researchers highlight several entry points an attacker can use to compromise a hospital's supply chain. A key one is the device manufacturer; a hospital has no control over whether a device is tampered with during the manufacturing process. They also lack insight into the security of distribution centers, suppliers, software developers, and shipping companies.

"Globally, supply chain and counterfeit devices are an increased risk," says Young. Older, harder-to-patch devices, many of which aren't subject to protective inspections like a regular operating system, are a "stepping stone" into the rest of the IT environment.

The industry has started to buckle down on device security to prevent certain types of supply chain attacks. For example, the FDA now mandates Unique Device Identification codes for all medical devices. This code indicates a device's version, model, manufacturing date and batch number, expiration date, and serial number. All this data is entered in a global, publicly accessible database so patients can check if a device is counterfeit.

Ransomware Down, Targeting Up

Researchers found cybercriminals are narrowing their focus on the healthcare space, opting for more focused attacks as opposed to broader campaigns.

Young points out how ransomware attacks on healthcare organizations steadily declined between October and December 2017. High-risk indicators of compromise (IoCs) dropped from 4,330 to 2,354 between November and December, and total IoC have also declined from October through December. The shift is a sign that attackers are changing tactics.

"The broad splashing of random kinds of attacks is down, but how much they're targeted is definitely up," he explains. The number of ransomware families has been growing since 2012, with a major spike from 29 families in 2015 to 247 families in 2016, and 327 in 2017.

Massive campaigns waste resources and are more likely to be tracked, says Young. Cybercriminals are using specific attacks to maximize their impact on each organization. For example, if they know an organization has a Windows 10 environment, they'll use a Windows 10-based attack.

"My own belief is the level of targeted attack is increasing more rapidly than the granularity of defenses," he notes.

Healing Healthcare Security

Young warns not to get too distracted by healthcare-specific needs. Patching, response capabilities, and monitoring are essential: "Those are the basics and the things almost everybody gets wrong today, but those are the high-impact areas," he says.

It's also important to pay attention to non-medical IoT devices entering the hospital, which could also prove a risk. Smart televisions in patients' rooms, smartboards, or smart devices in labs that aren't part of normal testing could all be a jumping-off point for attack.

Related Content:

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.