The Healthcare and Public Health Sector Coordinating Council (HSCC) has published a new Model Contract Language template for healthcare delivery organizations (HDOs) to use when procuring new devices from medical device manufacturers (MDMs) to ensure each party is aware of its responsibilities for cybersecurity and device management.

“Medical device cybersecurity responsibility and accountability between MDMs and HDOs is complicated by many conflicting factors, including uneven MDM capabilities and investment in cybersecurity controls built into device design and production; varying expectations for cybersecurity among HDOs; and high cybersecurity management costs in the HDO operational environment through the device lifecycle,” explained HSCC. “These factors have introduced and sustained ambiguities in cybersecurity accountability between MDMs and HDOs that historically have been reconciled at best inconsistently in the purchase contract negotiation process, leading to downstream disputes and potential patient safety implications.”

The Model Contract Language is intended to be a reference for shared cooperation and coordination between HDOs and MDMs for security, compliance, management, operation, services, and MDM-managed medical devices, solutions, and connections. The aim is to help HDOs reduce the cost, complexity, and time spent in the contracting process, minimize privacy and security risks, and ensure the confidentiality, integrity, and availability of HDO healthcare technologies.

The contract framework is based on three of the fundamental pillars of cybersecurity: Performance, maturity, and product design maturity, with those three pillars subdivided into 14 core principles

Core Principles of the HSCC Model Contract Language for Medtech Cybersecurity

The contract states that MDMs are required to make their products secure by default, have all security features enabled, reduce the attack surface as far as is possible, and ensure their products are free of malware and unnecessary code and services. All products are required to have the following security controls as standard:

• Network controls
• Physical security
• Anti-malware
• Intrusion detection
• Data encryption
• Access management
• Security patching
• Audit & logging
• Protection against malicious code
• Privilege escalation controls
• Document reference architecture
• Remote access controls

MDMs, HDOs, and group purchasing organizations are encouraged to review the Model Contract Language template and adopt as much of it as is necessary for their organization. “The more uniformity and predictability the sector can achieve in cross-enterprise cybersecurity management expectations, the greater strides it will make toward patient safety and a more secure and resilient healthcare system,” said HSCC.

The post HSCC Releases Model Contract Template for HDOs and Medical Device Manufacturers appeared first on HIPAA Journal.

This week, researchers at Palo Alto’s Unit 42 team published a report that shows security gaps and vulnerabilities often exist in smart infusion pumps. These bedside devices automate the delivery of medications and fluids to patients and are connected to networks to allow them to be remotely managed by hospitals.

The researchers used crowdsourced scans from more than 200,000 infusion pumps at hospitals and other healthcare organizations and searched for vulnerabilities and security gaps that could potentially be exploited. The devices were assessed against more than 40 known vulnerabilities and over 70 other IoT vulnerabilities.

75% of the 200,000 infusion pumps were discovered to have security gaps that placed them at an increased risk of being compromised by hackers. Worryingly, 52% of the analyzed devices were found to be vulnerable to two serious infusion pump vulnerabilities dating back to 2019, one of which is a critical flaw with a CVSS severity score of 9.8 out of 10 (Wind River VxWorks CVE-2019-12255), and the other is a high severity flaw with a CVSS score of 7.1 (Wind River VxWorks CVE-2019-12264).

Vulnerabilities in infusion pumps could be exploited to cause harm to patients. By gaining access to the devices, attackers could stop the delivery of drugs and fluids or cause the devices to deliver potentially fatal doses of drugs. Vulnerabilities could also be exploited to gain access to, modify, or delete sensitive patient data, and it is the latter type of vulnerability that is most common.

“While some of these vulnerabilities and alerts may be impractical for attackers to take advantage of unless physically present in an organization, all represent a potential risk to the general security of healthcare organizations and the safety of patients – particularly in situations in which threat actors may be motivated to put extra resources into attacking a target,” said the researchers. “Our discovery of security gaps in three out of four infusion pumps that we reviewed highlights the need for the healthcare industry to redouble efforts to protect against known vulnerabilities, while diligently following best practices for infusion pumps and hospital networks,”

Large hospitals and clinics can use thousands of infusion pumps. When vulnerabilities are discovered, patching or applying compensating controls quickly can be a major challenge. First, the affected devices must be identified, then they must be patched, fixed, or replaced. If any vulnerable device is missed, it will remain vulnerable to attack and a patient’s life may be put at risk.

It is important to maintain an accurate inventory of infusion pumps (and other IoMT devices) in use and to have the capability to rapidly discover, locate, and assess utilization of the devices. Security teams should perform a holistic risk assessment and proactively find vulnerabilities and identify compliance gaps.

Risk reduction policies should be applied. “Real-time risk monitoring, reporting, and alerting are crucial for organizations to proactively reduce IoMT risk,” suggest the researchers. “Consistent profiling of device activity and behavior yields data that can be accurately converted into risk-based Zero-Trust policy recommendations.” Hospitals and clinics should also take steps to block known targeted IoT malware, spyware, and exploits, prevent the use of DNS for C2 communications, and stop access to bad URLs and malicious websites to prevent the loss of sensitive data.

The post Security Issues Identified in 75% of Infusion Pumps appeared first on HIPAA Journal.

The healthcare industry has been extensively targeted by ransomware gangs and victims often see paying the ransom as the best option to ensure a quick recovery, but the payment does not always put an end to the extortion. Many victims have paid the ransom to obtain the decryption keys or to prevent the publication of stolen data, only for the ransomware actors to continue with the extortion.

The advice of the Federal Bureau of Investigation (FBI) is never to pay a ransom following a ransomware attack, as doing allows the threat actors to put more resources into their attacks, it encourages other threat groups to get involved in ransomware, and because there is no guarantee that paying a ransom will allow the recovery of data or prevent the misuse of stolen data.

A recent survey conducted by the cybersecurity firm Venafi has helped to quantify the extent to which further extortion occurs. The survey has provided some important statistics about what happens when victims pay or do not pay the ransom demands. The survey was conducted on 1,506 IT security officers from the United States, United Kingdom, Germany, France, Benelux and Australia and explored the rapidly growing risk of ransomware attacks.

Venafi said ransomware attacks increased by 93% in the first half of 2021 and by the end of the year ransomware attacks were being conducted globally at a rate of one every 11 seconds. 67% of companies with 500 or more employees said they had experienced a ransomware attack in the past 12 months, and 83% of ransomware attacks involved double or triple extortion tactics, where sensitive files are stolen and payment is required to decrypt files, prevent the publication of data, and prevent attacks on customers and suppliers.

According to the survey, 38% of attacks involved threats to extort victims’ customers using stolen data, 35% involved threats to expose stolen data on the dark web, and 32% involved threats to inform customers that their data had been stolen.

16% of customers who did not pay the ransom had their data exposed on the dark web. 35% of victims said they paid the ransom but were still unable to recover their data, and 18% of victims said they paid the ransom to prevent the exposure of stolen data, but the information was still exposed on the dark web. 8% said they refused to pay the ransom and then the attackers attempted to extort their customers.

Many ransomware gangs now operate under the ransomware-as-a-service (RaaS) model, where affiliates are recruited to conduct attacks for a cut of any ransoms they generate. While the RaaS operators often provide playbooks and issue guidelines for conducting attacks, there is little enforcement of compliance. Ransomware gangs often operate for short periods and try to extort as much money as possible from victims before shutting down their operations and rebranding and starting again. There have also been cases of ransomware gangs providing stolen data and access to networks to other cybercriminal groups regardless of if the ransom is paid, showing quite clearly that ransomware gangs cannot be trusted. Some ransomware gangs have taken over negotiations with victims from their affiliates and have cut the affiliates out and have not issued payment, showing there is also no honor among thieves.

“Organizations are unprepared to defend against ransomware that exfiltrates data, so they pay the ransom, but this only motivates attackers to seek more,” said Venafi vice president, Kevin Bocek. “The bad news is that attackers are following through on extortion threats, even after the ransom has been paid!”

The post Paying a Ransom Doesn’t Put an End to the Extortion appeared first on HIPAA Journal.