{"id":13374,"date":"2021-06-08T17:07:58","date_gmt":"2021-06-08T15:07:58","guid":{"rendered":"https:\/\/www.samhallssakerhet.se\/?p=13374"},"modified":"2022-01-11T14:15:45","modified_gmt":"2022-01-11T13:15:45","slug":"why-healthcare-it-security-is-so-hard","status":"publish","type":"post","link":"https:\/\/www.samhallssakerhet.se\/sv\/2021\/06\/08\/why-healthcare-it-security-is-so-hard\/","title":{"rendered":"Why healthcare IT security is so hard"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The problems surrounding IT security in the healthcare sector are causing increasing levels of concern, both among healthcare professionals and in regulatory bodies. Over the past six months, there has been a steady stream of flash messages from the FBI, the Department of Homeland Security, and other security organizations about increased threat levels against healthcare systems. We have seen a multitude of healthcare provider organizations falling prey to ransomware attacks, putting patient safety at risk and causing enormous financial damage.<\/strong><\/p>

But why is this sector experiencing an increase in attacks? Is there something specific about healthcare that makes IT security particularly hard? Yes. Yes, there is.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"IT\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Safety versus security<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The concepts of safety and security are closely related, yet distinct. While safety is about protecting against random failures and mistakes, security is about protecting against malicious attacks. There are few areas where these two concepts are as intricately interconnected as in healthcare. Add to this the fact that the data handled in healthcare systems often has very serious privacy implications and you get a swamp of problems to which there are seldom any perfect solutions\u2014only imperfect compromises.<\/p>

\u00a0”A concrete example: Privacy regulations like HIPAA and GDPR declare that medical records are highly sensitive information and must be carefully protected. This has given rise to security requirements stipulating that only authorized individuals who have been securely authenticated may access the record databases. However, from a safety perspective, having prompt access to medical records can literally be a matter of life or death. In a medical emergency, there is no time for screen locks or forgotten passwords.”<\/strong><\/p>

In practice, the compromises employed to solve this conflict between security and safety tend to range from elaborate \u201cbreak glass\u201d systems, where the normal access control can be bypassed in an emergency, to the more directly pragmatic solution of placing the computer mouse in a blood bag rocker that flips it back and forth, so that the screen lock never activates.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

A trefoil of systems<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

There are also aggravating circumstances in the form of the uniquely tripartite structure of healthcare IT systems.
Of course, all healthcare providers have everyday administrative office<\/strong> systems for tasks such as email and spreadsheets. This aspect of healthcare IT is shared by all large organizations. While the problem of protecting these kinds of systems might not exactly be solved, there is at least a sizeable, shared body of knowledge and best practices for how to deal with them.<\/p>

Bigger healthcare providers also have large numbers of networked medical devices.<\/strong> These range from infusion pumps and insulin monitors to high-end MRI scanners, all hooked up to a computer network for the purposes of monitoring, data sharing, and remote access. These devices are subject to strict safety requirements that are often incompatible with basic IT security practices, such as frequent software updates. Indeed, many medical devices contain embedded computers that run operating systems that are no longer supported<\/strong> by the manufacturer. An IT security engineer might demand that such insecure systems be placed on a fully isolated network, only to quickly discover that this is not possible since the staff requires access to medical data from their office workstations. In addition, many hospitals and clinics have established contracts with specialist providers, such as teleradiology companies, that operate in different time zones to simplify coverage during off-hour shifts. Thus, there is a need to transfer MRI scan results to specialists on the other side of the world.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Healthcare\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Beneath a healthcare provider\u2019s administrative systems and medical devices lies a third, often forgotten, system: the supervisory control and data acquisition (SCADA) system<\/strong> that controls the infrastructure of the hospital or clinic. All the facilities that we take for granted, such as heating, ventilation, electrical power, lighting, and water supply, are all controlled by specialized computer systems. These are critical for the hospital or clinic to function, but seldom draw much attention from an IT security perspective. Yet there are plenty of realistic and frankly frightening scenarios to consider.<\/p>

For example, if a ransomware attacker figures out\u00a0how to target the engineering workstations for the heating and ventilation systems, they could easily stop all major surgery at a hospital by shutting down ventilation to the operating theaters and then disabling the workstations. An attacker that gains access to the power control systems may well be able to take out both primary and reserve power, likely\u00a0leading to life-threatening situations within minutes. And the list of nightmare situations goes on.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

An abundance of regulations<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

While the technical reality of healthcare IT systems is complex, the regulatory environment in which they exist is a veritable labyrinth. Take, for example, a typical system for the distribution of medical oxygen, in which the gas is led in pressurized pipes throughout a hospital. In a normal setting, the physical pipework will be the responsibility of the facilities staff, while the gas itself is a medical product that is the responsibility of an appointed nurse or physician. In addition, there are industry safety codes for any handling of pressurized gases, which require that an internal gas safety organization be established. It is extremely unclear which of the multiple stakeholders involved has the ultimate responsibility for the IT security of the gas distribution control system.<\/p>

With unclear chains of responsibility, there is an increased risk that issues will fall between the cracks, and it becomes harder to enforce a uniform IT security policy.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Ransomware, the nemesis<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Given all of the above, it should not come as a surprise that many healthcare organizations turn out to be fairly porous targets for a determined attacker. However, most attackers expect some form of monetary gain from their attacks. While stolen medical records have always had a certain value in the marketplace, it was not until the advent of large-scale ransomware operations in recent years that the IT security threat to healthcare organizations\u00a0<\/strong>really began to rise.<\/p>

An ordinary business organization that is hit by a ransomware attack may\u2014out of a certain sense of civic-mindedness or out of pure spite\u2014simply refuse to pay the ransom, which means that all the time and effort the attacker has put into the attack is lost. A healthcare organization, however, will normally be under enormous pressure to restore its systems since patient safety is at risk. For a sufficiently brutal attacker, targeting healthcare organizations simply makes good business sense since they are more likely to pay up.<\/p>

Indeed, while a large portion of ransomware attackers have publicly stated that they will refrain from attacking healthcare organizations during the COVID-19 pandemic, other groups have intensified their attacks, since a victim that is already under pressure from the pandemic will be even more likely to pay the ransom.<\/strong> Of these latter groups, the Russia-based Ryuk gang may be the most notorious, and has figured prominently in warning bulletins issued by government authorities.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Safety\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

A solution, my kingdom for a solution<\/strong><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Unfortunately, there are no easy solutions to the healthcare IT security crisis, no magic black box you can simply hook up to the network, no five-step checklist to solve all your problems. One would wish that IT criminals could simply be put behind bars, but many\u2014or most\u2014operate from rogue jurisdictions such as Iran or Russia, where they are untouchable.<\/p>

This will be a long journey and all stakeholders need to pull together. Not only must device manufacturers learn how to improve device security and law enforcement agencies how to collaborate internationally in an efficient manner\u2014healthcare organizations must also learn how to continuously improve their security in an incremental fashion. However, while there are no easy solutions, there are at least some basic guidelines for improving your security.<\/p>

Chief of these is the realization that you are never done<\/strong>. You are up against motivated and intelligent adversaries who will come up with a steady stream of new ways to attack you. The saying \u201csecurity is a process, not a product\u201d is not just a clich\u00e9. It is also true.<\/p>

Also remember that security needs to be improved in a balanced manner.<\/strong> If you spend all your budget on improving medical device security, you are not really much better off because the bad guys will simply attack your office network instead. You can safely assume that the attackers will always go for your weakest point. And, finally, don\u2019t forget those SCADA systems!<\/strong><\/p>

By Leif Nixon, Security Expert at Sectra Communications<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"SECTRA\"\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Dela inl\u00e4gget:<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t<\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t<\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Senaste:<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t
\n\t\t \n
\"SAR\"<\/div>\n <\/a>\n
<\/i><\/div>\t\t
\n\t\t\t\t

\n\t\t\t\n\t\t\t\tUtan ideella krafter stannar Sverige \u2013 SAR Sweden visar vad samh\u00e4llsnytta betyder i praktiken\t\t\t<\/a>\n\t\t<\/h3>\n\t\t \n

Utan ideella krafter stannar Sverige SAR Sweden visar vad samh\u00e4llsnytta betyder i praktiken Inf\u00f6r M\u00f6tesplats Samh\u00e4llss\u00e4kerhet har vi tr\u00e4ffat Daniel Sandberg, grundare av SAR Sweden,<\/p>\n <\/a>\n \n\t\t\n\t\t\tL\u00e4s mer \u00bb\t\t<\/a>\n\n\t\t

\n \t\t\n\t\t\t12 mars, 2026\t\t<\/span>\n\t\t <\/div>\n \t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t
\n\t\t\t
\n\t\t \n
\"Kultur<\/div>\n <\/a>\n
<\/i><\/div>\t\t
\n\t\t\t\t

\n\t\t\t\n\t\t\t\tM\u00f6t Kultur och Kvalitet p\u00e5 M\u00f6tesplats Samh\u00e4llss\u00e4kerhet 2026\t\t\t<\/a>\n\t\t<\/h3>\n\t\t \n

Intervju med Johanna Bergsten Kultur och Kvalitet – workshops med AVTRYCK Hur skapar vi ett tryggt samh\u00e4lle d\u00e4r alla verkligen f\u00e5r plats \u2013 ocks\u00e5 personer<\/p>\n <\/a>\n \n\t\t\n\t\t\tL\u00e4s mer \u00bb\t\t<\/a>\n\n\t\t

\n \t\t\n\t\t\t11 mars, 2026\t\t<\/span>\n\t\t <\/div>\n \t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t
\n\t\t\t
\n\t\t \n
\"Krisledningspodden\"<\/div>\n <\/a>\n
<\/i><\/div>\t\t
\n\t\t\t\t

\n\t\t\t\n\t\t\t\tKrisledningspodden blir officiell mediepartner till M\u00f6tesplats Samh\u00e4llss\u00e4kerhet 2026\t\t\t<\/a>\n\t\t<\/h3>\n\t\t \n

Murphy Solution & Krisledningspodden – officiell mediepartner 2026 Vi \u00e4r glada att v\u00e4lkomna Krisledningspodden som officiell mediepartner till M\u00f6tesplats Samh\u00e4llss\u00e4kerhet 2026. Syftet med samarbetet \u00e4r<\/p>\n <\/a>\n \n\t\t\n\t\t\tL\u00e4s mer \u00bb\t\t<\/a>\n\n\t\t

\n \t\t\n\t\t\t5 mars, 2026\t\t<\/span>\n\t\t <\/div>\n \t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t
\n\t\t\t
\n\t\t \n
\"\"<\/div>\n <\/a>\n
<\/i><\/div>\t\t
\n\t\t\t\t

\n\t\t\t\n\t\t\t\tM\u00f6t SpectraWatch – experter inom dr\u00f6narbevakning\t\t\t<\/a>\n\t\t<\/h3>\n\t\t \n

Intervju med Matilda Olsson M\u00f6t SpectraWatch – experter inom dr\u00f6narbevakning Vi \u00e4r glada \u00f6ver att ha SpectraWatch som utst\u00e4llare p\u00e5 M\u00f6tesplats Samh\u00e4llss\u00e4kerhet 2026. SpectraWatch \u00e4r<\/p>\n <\/a>\n \n\t\t\n\t\t\tL\u00e4s mer \u00bb\t\t<\/a>\n\n\t\t

\n \t\t\n\t\t\t26 februari, 2026\t\t<\/span>\n\t\t <\/div>\n \t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t
\n\t\t\t
\n\t\t \n
\"Lina<\/div>\n <\/a>\n
<\/i><\/div>\t\t
\n\t\t\t\t

\n\t\t\t\n\t\t\t\tSamarbetet med SOFF forts\u00e4tter 2026\t\t\t<\/a>\n\t\t<\/h3>\n\t\t \n

Intervju med Lina Bonander Samarbetet med SOFF forts\u00e4tter 2026 Vi har haft n\u00f6jet att v\u00e4lkomna Lina Bonander, omr\u00e5desansvarig Samh\u00e4llss\u00e4kerhet, SOFF (S\u00e4kerhets- och f\u00f6rsvarsf\u00f6retagen) till Kistam\u00e4ssan<\/p>\n <\/a>\n \n\t\t\n\t\t\tL\u00e4s mer \u00bb\t\t<\/a>\n\n\t\t

\n \t\t\n\t\t\t23 februari, 2026\t\t<\/span>\n\t\t <\/div>\n \t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/article>\n\t\t\t\t<\/div>\n\t\t\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

L\u00e5t oss h\u00e5lla kontakten<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Anm\u00e4l dig till v\u00e5rt nyhetsbrev nedan och f\u00e5 den senaste informationen om m\u00f6tesplatsen. <\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\n\t\t\t\n\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t