Penetration Test Report (IndependentSecurityEvaluators): securing hospitals

Securing Hospitals
A research study and blueprint
Independent Security Evaluators | www.securityevaluators.com
February 23, 2016
SECURING HOSPITALS
Abstract
The research results from our assessment of 12 healthcare facilities, 2 healthcare data facilities, 2 active medical devices from one
manufacturer, and 2 web applications that remote adversaries can easily deploy attacks that target and compromise patient health. We
demonstrated that a variety of deadly remote attacks were possible within these facilities, of which four attack scenarios are presented in
this report. To understand these ecosystems, a two year study was performed from January, 2014 through January, 2016 of critical
elements within these facilities as they relate to securing patient health. Our goal was to create a blueprint --a step-by-step action plan--
that all medical facilities can follow as the foundational element in reaching full security readiness. The research was driven by a hands-
on analysis of various healthcare systems, applications, and budgets, interviews with hospital, data center, and medical device
manufacturer employees, and sourcing industry knowledge from thought leaders on our advisory board. The findings show an industry in
turmoil: lack of executive support, insufficient talent, improper implementations of technology, outdated understanding of adversaries,
lack of leadership, and a misguided reliance upon compliance. These findings illustrate our greatest fear: patient health remains extremely
vulnerable. The output of the research is the production of a modern patient-health focused attack model, and a blueprint that advocates
a phased approach to security design and implementation for healthcare facilities that focuses on the protection of patient health assets.
Independent Security Evaluators | www.securityevaluators.com
February 23, 2016
SECURING HOSPITALS
Executive Summary
This report delivers the results of our research in investigating a variety of hospital and healthcare-related infrastructures and systems,
identifying industry-specific pitfalls and shortcomings, and creating a blueprint for how entities in the space can improve their security posture
by the most effective means. In all, we investigated 12 healthcare facilities, 2 healthcare data facilities, 2 active medical devices from one
manufacturer, 2 web applications, and a multitude of other devices, applications, and systems found on these healthcare facility networks.
AN INADEQUATE THREAT MODEL
One overarching finding of our research is that the industry focuses almost exclusively on the protection of patient health records, and
rarely addresses threats to or the protection of patient health from a cyber threat perspective. The background, motivating factors, nuances,
and misunderstandings that perforate the healthcare industry with regard to security are discussed at length in this report. In summary,
we find that different adversaries will target or pursue the compromise of patient health records, while others will target or pursue the
compromise of patient health itself. These adversaries and their likely targets are summarized here.
Patient Health Patient Records
Targeted Untargeted Targeted Untargeted
Adversary
(Specific Victims) (Indiscriminate) (Specific Victims) (Indiscriminate)
Individual /
YES
Small Group
Political
Groups / YES
Hacktivists /
Organized
YES YES YES
Crime
Terrorism /
YES YES
Terrorist Org.
Nation States YES YES YES YES
The two major flaws in the healthcare industry with regard to threat model are that 1) the focus is almost entirely on protecting patient
records, and 2) the measures taken address only unsophisticated adversaries: essentially, only one of the adversaries listed above --the
Individual or Small Group adversary highlighted above in yellow. The industry is aware and speaks to Organized Crime and Nation State
adversaries, but underestimates their sophistication and motivation. The strategies aim to curtail blanket, untargeted (i.e., indiscriminate)
attacks to obtain patient healthcare records, and ignores the motivations and strategies that would be employed if targeting patient health
or specific victims’ health records. These motivations and scenarios are highlighted in red in the above table.
As a result, a multitude of attack surfaces are left unprotected, and attack strategies that could result in harm to a patient are not
considered. The following summary provides an overview of these types of attacks.
| 3
SECURING HOSPITALS
PATIENT HEALTH ATTACK MODEL
One of the primary contributions of this research is the Patient Health Attack Model. To our knowledge, no comprehensive attack model is
available for the healthcare industry that catalogs the attack surfaces affecting patient health assets. We have cataloged and describe in
detail the following primary, secondary, and tertiary attack surfaces that expose patient health. The following diagram illustrates this attack
model.
Primary Attack Surfaces
 Clinicians
 Medicine
 Active Medical Devices (AMD)
 Surgery
Secondary Attack Surfaces
 Patient Samples
 Passive Medical Devices (PMD)
 Electronic Health Records (EHR)
 Test Results
 Work Orders
 Connected Power
 Schedules
 Inventory Systems
 Sanitary Conditions
 Procedure Precision
 Time
Tertiary Attack Surfaces
 Inventory Systems
 Climate Controls
 Environmental Controls
 Physical Storage
 Physical Transport
 Barcode Scanners / Printers
 Connected Power Many of the above attack surfaces have little value with regard to personally identifiable
 Laboratory Equipment information (PII) or personal health information (PHI)--the assets hospitals strive to protect
 Clinicians most—yet they have direct consequences with regard to patient health. These attack surfaces
are largely left unprotected by hospitals and are precisely the attack surfaces to be targeted
by an adversary seeking to harm a patient.
| 4
SECURING HOSPITALS
COMMON DESIGN ISSUES
We found that the hospitals were failing on a variety of levels to properly address modern security threats. Problems ranged from business-
level, organizational problems (e.g., a lack of funding, staff, or training) to technical problems specific to departments (e.g., vulnerable
network design, use of legacy systems, and the use of vulnerable vendor systems). Through the fog, it is difficult to pinpoint which issues
are the impetus for others, as many of the problems directly or indirectly exacerbate the others, amplifying issues. However, the issues
listed in the table to the left are the most notable security design deficiencies with hospitals we investigated.
We believe the impetus for most security issues in hospitals stems from a drastic lack
Business
of funding for security departments, a lack of appropriate staffing of security personnel,
and a lack of effective security training at all levels of the organization. Until these
 Lack of funding
issues are addressed, it will be difficult to overcome some of the other design flaws.
 Lack of appropriate staffing
 Lack of effective training
Hospitals had very few proper security policies and procedures, and those that did
 Improper organizational structure exist were ineffective in practice. Furthermore, very little was done with regard to audit
to determine what security problems existed and to create action plans to address
Policies and Procedures
them. Without proper policy and procedures in place, it will likely lead to heavy waste
and the implementation of ineffective technical security measures.
 Lack of defined policy
 Lack of audit procedures With regard to technical security design issues, we found that hospitals were
antiquated in their network designs, and unsure about the technologies that could
Technical effectively help them. In many cases, vendor products purchased for a security purpose
were inappropriate for the organization, and those systems that were appropriate were
 Lack of network awareness deployed incorrectly, all