Archive for category: healthcare

When Security is a Question of Life or Death

But even those of us who are a bit jaded by technological advances have to admit that the idea of telesurgery — surgery performed by a physician using a remote-controlled robot over the Internet — is pretty cool.

And yet, it’s not really new: The first successful telesurgery took place in 2001, when a surgeon in New York removed the gallbladder of his 68-year-old patient in Strasbourg, France. “Operation Lindbergh,” as it came to be known, could have been the triumphant start of a global health innovation — but, in the years since, telesurgery has been hampered by slow advances in robotics and communication networks.

Today, doctors typically use robots to operate on a patient in the same room — and they do so using a secure, hardwired connection. Next-gen robots need to work on open networks — in war zones, at disaster sites, and on-call at other remote locations — but network and connectivity issues have been severely limiting. Until now.

The emergence of 5G has been a game changer for the field: Medical teams have an extremely fast network connection at their disposal — but this major advance brings with it major exposure, and now the threats posed by cyber attacks loom large.

Think about it: Assuming everything else in a procedure goes smoothly — the robot works as designed, the surgeon is confident and well-rested, and local staff are standing by — the network connection is a potential vulnerability. A cybercriminal infiltrating the software could dictate the robot’s movements — a breach with potentially fatal consequences. Incorporating security measures is critical to making telesurgery safe — and to promoting its widespread adoption.

To see just how precarious a telesurgery could be, engineers at the University of Washington (UW) tested an open source teleoperated robot, the Raven II. One group (the “surgeons”) set up the Raven II on a table and directed it to pick up and move blocks around while their colleagues (the “attackers”) used common cyberattack methods to disrupt the process.

The attackers were able to override or alter commands from the surgeons, making it difficult for the robot to perform simple actions like grasping the blocks. They also flooded the Raven II with trash data in a denial-of-service attack, resulting in jerky movements. In a real surgery where precision can mean life or death, this simulation exposed a serious risk factor. Finally, the offensive team triggered the robot’s emergency stop mechanism, halting the simulated surgery altogether.

The best way to guard against such attacks is to only perform a telesurgery across a completely secured private network — which, one could argue, minimizes the value of the invention. To address this, the team at UW is working on using machine learning to authenticate a user — the robot would be able to analyze the user’s interactions and create a unique “operator signature.” Along with human monitoring, we may yet be able to create a safeguard in which a surgery can at least be halted before an attacker can do fatal harm.

For the time being, researchers will continue testing and developing telesurgery until its safety measures are as robust and secure as a local procedure would be. In a world where everyone and everything is connected, technology advances are only as valuable as they are secure.

What to Do After a Ransomware Attack

2020 and 2021 created a veritable gauntlet of misfortune for hospitals — overworked staff in overcrowded facilities working desperately to contain a highly contagious virus. Other viruses crept in, too: Ransomware infiltrated hospital networks across the U.S. in record numbers, profiting from internal chaos and adding havoc to already overtaxed systems. Even worse, cybercriminals show no signs of slowing down in 2022.

Operating at a Loss

Hospitals aren’t known for having robust cybersecurity defenses. They typically don’t have the budget, personnel, or bandwidth for modern security systems. But their internal systems are crucial to providing care: In a perfect world, they should experience 100% uptime — no system errors, no downtime — and be impenetrable. The risks are hard to overstate: Attackers with network access have the power to block access to vital patient data, disable life-saving alerts, trigger false alarms, halt procedures, and cause any number of otherwise avoidable disasters. Even a small network downtime is a crushing weight on already overburdened hospital staff.

Ransom: To Pay or Not to Pay

When it comes to the question of meeting the demands of ransomware, conventional wisdom lands on the side of “hard no”. Often, the argument is a variation of, “We shouldn’t negotiate with terrorists!” Most authorities, including the FBI, advise against paying a ransom. There is no guarantee that an attacker will keep their end of the bargain and return stolen data or give back system access. Some groups are also known to extort their victims for double or triple payments. But for hospitals, the stakes are undeniably higher than they are with a financial institution. Losing a client’s bank account credentials is one thing — losing a patient is another.

$50,000,000 Gone

In the fall of 2020, malware on an employee’s computer at the University of Vermont Medical Center (UVMC) led to a full-on cyber attack. The attackers included a file with information on how to contact them (a step UVMC opted not to take, assuming that further contact would only result in a ransom demand) in exchange for the tool to decrypt their infected files. The incident was estimated to have cost UVMC $50 million, mostly in lost revenue, and IT staff worked around the clock for a month to scrub their network systems. And this was a non-threatening attack, which only interfered with health records and payroll. Would it have been worthwhile to pay the ransom? Considering what’s at stake, what can a hospital do?

The Price of Paying

Over the last decade, some hospitals have opted to pay ransoms at an average of $131,000 in 2021. Obviously, this is much lower than the $50 million UVMC lost, but paying “reasonable” ransoms has led to another cost altogether: Now groups like FIN12 are attacking healthcare institutions more often, taking advantage of outdated security systems and threatening patients’ lives.

Though it may seem less costly and time-consuming on paper, giving in to an attacker’s demands is usually not the best method for dealing with ransomware. Authorities may advise a hospital to pay the ransom initially to spare patients at risk, but such a decision is not taken lightly and should not be made without guidance.

Ransomware Attack Next Steps

Step 1: Get help, fast, from an expert. Do not immediately pay the ransom or trust the cybercriminals.

Step 2: Isolate devices from the network, secure backups, and identify the source and goals of the attack to contain and minimize affected data.

Step 3: Report the attack to the FBI, state and local law enforcement, the Secret Service’s Electronic Crimes Task Force, the Internet Complaint Center, and the Federal Trade Commission. If your institution has cyber liability insurance, contact your insurance carrier.

Step 4: Though authorities may advise a hospital to pay the ransom to save a patient’s life, giving in to a cybercriminal’s demands does not guarantee decryption. Moreover, an attack’s success can lead to more incidents in the future. Follow your organization’s incident response plan — and weigh your options.

Be Proactive: Prepare For Future Attacks.

1. Always make backups of important documents, keep them off the network, and test your processes for restoring backups.

2. Assign staff to a cybersecurity response team.

3. Create and update an incident plan detailing what signs to watch for and how to react.