Welcome to "Cybersecurity and Health Care: What Hospital Executives Need to Know".
This is Part One of the three part series on cybersecurity.
In this session, we're going to talk about terminologies,
we'll talk about some of the threats and the threat actors and breaches that have been ocurring in heath care,.
In Part Two, we'll look at the trends and the challenges that we face.
And in Part Three, we'll talk about implementing controls, a cybersecurity plan, and how to prepare ourselves for a board presentation.
In this session, as I said, the objectives are to go over the terminologies associated with cybersecurity,
as well as to educate on cyber threats, and cyber agents that are responsible for these breaches.
I'm Tom Walsh, your presenter. I'm a Certified Information Systems Security Professional,
and I've co-authored four books on Health Care Information Security
But, before we go too far into the session, I feel like it's important we take a little bit of time to explain some of the terminologies that are used.
In cybersecurity, the term "breach" has a specific meaning.
IT people think of a breach as some kind of a hacker getting through the perimeter of their network's security.
Actually, there is a well-defined meaning within the HITECH Act that explains
that a breach is "unauthorized access to protected health information" or PHIs.
The term "cyber" we hear often, and it refers to the Internet and computers.
"Hacktivist" is a fairly new term, that we used these days. It's a combination of both "hacker" and "activist".
What it is are folks who are either socially or politically motivated to get their cause out there,
and they're using hacker techniques to get their message across.
You may have heard the term "phishing". Phishing is a form of malware.
What you find is an e-mail that comes to a unsuspecting individual, and it's a form of social engineering.
What they're trying to do is to gain your trust, in having you to do something.
In most cases, they try to get to the click on a link that's imbedded in the e-mail message.
You may have heard of "Ransomware". Ransomware is another form of malicious code that's out there.
What ransomware does is what the name implies:
it kidnaps your data, and holds it for ransom, using some type of encryption to hide the data from you,
then forcing organizations to pay a ransom, either in real dollars or in BitCoins,
in order to get that the decryption key, and get their data back to where it was.
Hacking and cyberattacks are on the rise in Health Care, and we've got to ask ourselves: "What's happening?"
In 2015, we saw a dramatic rise in hacking attempts.
In fact, in the first six months of 2015, we saw a major increase, in particular, to health plans.
I've been tracking the breaches that get reported to the Department of Health and Human Services, on their website.
These are breaches that affect over 500 patients.
What we have found is that, over the years, hacking is always been a pretty low percentage of the breaches that get reported,
and yet the number of patient lives affected has really skyrocketed, and that's highlighted in this table, on this slide.
At the very bottom, you can see that in 2015, the total number of patient lives affected was over 111 million.
That means one out of every three Americans basically had their data hacked, as a result of a breach in Health Care.
This pie chart shows the number of breaches that get reported of by percentages,
that hacking still is one of the lowest on the chart.
But, if we look a little bit closer as to the number of affected lives since we've started tracking this,
when reporting to the Department of Health and Human Services went into effect in 2010,
we find that 75% of all patients who have reported, or have had their data affected by a breach, was caused by hacking.
This slide illustrates the top six health care breaches, to date.
These are breached that all have affected at least one million or more patients.
There are a couple of things I want you to note in this slide: First, all six were reported in 2015.
Another thing to look at is that in five out of the six that were reported,
the breach occured somewhere before 2015, and in some cases, almost a year before it was detected or reported.
So this is very alarming, that these are big breaches that are occurring,
and that it takes a while to not only the detect them, but then to report them as well.
So, what are some of the cyber threats that we need to be aware of?
I've tried to minimize my list down to what I think are the top four primary threat agents that we need to worry about.
The first one is hackers. I call it "Hacker 2.0", and the reason I say that is:
years ago, if you were to ask what the profile of a hacker was, it was pretty simple.
We'd say it was typically it was a young white male in their early twenties,
he probably still lived at home with his parents, socially maladjusted, probably never been on a date.
That was the common profile the hacker. That's what we thought.
But, it has changed.
Hackers are now part of organized crime syndicates.
The Russian Mafia, for example, recruits some of the top programmers to become hackers for them.
Hacking has also moved out to nation-states.
We've seen in the paper there's been reported attacks, traced back to countries like North Korea and the "Lizard Squad", China and Iran.
So, we know that nation-states are looking at cyber security as a tool for warfare. It's getting quite nasty.
I mentioned in the terminologies about "hacktivists".
One of the most well known cases in healthcare occured in March of 2014.
It was a case involving a child that was taken from a mother and placed in the care of a hospital,
because the child needed treatment, but the mother refused to take the child to the hospital. The state then became the guardian of the child.
The mother thought that the state had "kidnapped" her child, so she turned to social media for help.
This group called "Anonymous" took up her cause.
What they did was they began a Directed Denial of Service attack against Boston Children's Hospital, and all of its affiliates.
The attack was so bad, the Boston Children's Hospital had to unplug from the Internet for almost two days.
What an impact that was on not only the hospital, but all of its affiliates.
So, we can see that through the power of social media,
people who have a cause that they think is worthy can gather a group of strangers to help organize, and launch an attack.
What's particularly interesting about this one was that it raged on for a good week, until somebody in the group posted and said,
"What are we doing? This is a children's hospital. Children's lives are at stake. Is that what were about?"
I think that message resonated with the rest of them, because soon after that was posted, the the denial of service attack stopped.
We have our own employees, malicious insiders.
It's not that uncommon that we find that some individuals are taking patient information for their own personal use and gain.
In fact, one of the major breaches that occured in 2015 was a health plan,
were one of their employees was stealing members' information, and then using that information to file false tax claims.
The last area that we need to be concerned about is our own business partners, or what we call them in healthcare, "business associates".
Business associates are responsible for anywhere between 20 to 30% of all the reported
breaches to the Department of Health and Human Services.
This is an alarming number, and I say it varies, because every quarter I'd go to the Department of Health and Human Services web site,
where these breaches that affect over 500 patients are reported. They call it "the Wall of Shame".
So, I've been gathering the statistics.
It varies, but it's at least a 25% chance that one of your business associates could be responsible for a breach.
So, we need to consider that as well.
What are the threats, as far as cyber threats, that we need to worry about?
As I mentioned, business associates are responsible for at least 25% of reported breaches.
As of December 31, here are the statistics: it was at 21% during that quarter,
but you can see there were close to 27 million lives affected by breaches caused by our business associates.
For most healthcare organizations, the cyber insurance you have does not cover business associates.
So, what are some of the targets of the cyber criminals? What are they looking for?
If you had asked me this a few years ago, I would have had a different list, in a different order.
But today, the number one things they're going for are user IDs and passwords.
That may seem kind of that would be the first thing they would go for, but more and more organizations are encrypting their data.
The way you need to get to that data is you have to be an authorized user.
If you can present a proper user ID and password, the data will then be unencrypted.
So, encrypted data is no good to a hacker. They need to get it in a plain text format, so that's why they're going after user credentials.
Many times, they start with a simple user, and then try to elevate their privileges to something like a system administrator.
Once they're in, their target is pretty clear: they want protected health information.
The FBI has put out statistics about what the value of credit card information that's stolen is worth on the black market,
versus the worth of a medical record, on the black market.
Estimates range from about $1.00 to $1.25 for a stolen credit card,
and that's because the credit card companies have perfected their anti-fraud systems.
They really can crack down, when somebody steals a credit card.
But, not so much on protected health information.
We don't have that sophistication. We can't quickly detect when there's fraud going on. Therefore, the value of this is very high.
In fact, if you get somebody's medical record, you get a lot about that person.
You can get their Social Security Number, their address, and a lot of other good information.
So, it's no surprise
that a medical records sells on the black market anywhere between $50.00 and $60.00 per record. That's a lot.
And of course, I mentioned credit cards and banking information. Those have always been a target.
But, as I said, banks and credit card companies are much better at detecting fraud.
Social Security Numbers are important, and in particular, Social Security Numbers of children.
IRS rules changed back in the 1980s, requiring all children to get Social Security Numbers.
Consequently there's a lot of young people with Social Security Numbers who don't have a bad track record, when it comes to credit.
So, that's why the Social Security Numbers of young people are prime targets for hackers.
We also have to look at research data. Health Care generates a lot of research.
Why would a company or a nation state invest millions or even billions of dollars into research,
when you can just come in and steal it from the United States?
Smart phones are easy targets, and I'll talk a little bit more about this in another session, and biomedical devices as well.
We have a lot of biomedical devices today that run on wireless networks, and they're accessible to the Internet.
So, these are just some of the prime targets that we have of cyber criminals today.
In this first part, what we did was we cover some information about the terminology used in cyber security;
I tried to explain to you why healthcare data has become such a target now, for hackers;
we talked about some of the cyber threats, the threat agents, and the targets that are looking for;
And as I mentioned, Protected Health Information within health care has becoming very valuable as well.
In Part Two, we're going to go a little bit deeper into explaining some of the trends and threats that we have.
And finally, in Part Three, we'll talk about a plan of attack, and how to prepare for a board presentation on cyber security.
I want to take this time to say "thank you" to all of you who are attending and listening to this session. Thank you, very much.