Cyberterrorism: Is the U.S. Healthcare System Safe?

What Is Cyberterrorism?

The term “cyberterrorism” has yet to become a well-understood concept in healthcare. It has been defined as:

This definition captures the essence of what a cyberterrorist hopes to accomplish: to cause harm and generate fear. The healthcare industry is not immune from the cyberterrorist and will need to prepare for this daunting challenge, or sooner or later it will become all too aware of what the definition looks like in practice.

The healthcare sector provides a tantalizing opportunity for the cyberterrorist. To appreciate this, one only has to look at the size of the industry. Healthcare in the United States is a $2.5 trillion industry, or 17% of GDP in 2009, ² and consists of about 595,800 establishments. ³ In addition, the distribution and use of information systems by the health sector and healthcare services are extensive. Healthcare entities often have to provide access to many external networks and Web applications so as to stay connected with their patients, employees, insurers, and business partners. As pointed out by Ramsaroop, ⁴ “a large number of applications are used by all types of organizations in support of the logistics and operation of health programs and healthcare provision, in the management of resources, for communication among providers and other stakeholders, to search and retrieve data from knowledge bases, and as a central component of diagnostic and therapeutic interventions.” In this context of widespread utilization and increasing interconnectivity and dependency on information and communication technologies, the health sector offers an attractive target for any would-be attacker. Cyberterrorism has the potential to enable terrorists to attack healthcare facilities with much greater ease than would occur with actual physical attacks. ⁵

What Is the Risk of a Cyber Attack for Healthcare Targets?

The degree to which a certain type of healthcare-related facility is considered a soft/easy target depends on what protective steps it has taken, and quantifying that risk is especially difficult with cyber threats. Cyberterrorism should be considered and integrated as part of the wider risk management process implemented by any information technology (IT), group and some suggested guidelines will be discussed at the end of this article. Given the worldwide nature of the Internet, it is difficult to know where a cyber attack is going to come from and how it's going to come. Although not an exhaustive list of healthcare applications, Table 1 ⁶ shows a variety of possible entry points of an attack. The risk has become more acute in larger healthcare organizations such as hospitals, which have moved away from stand-alone workstations to more tightly integrated platforms that are attached to networks. It is now common for these networks to link a variety of IT workstations such as admissions, clinical laboratory, pharmacy, radiology, and the billing department. Networks also connect the IT systems of an organization's inpatient and outpatient settings as well as a variety of service organizations ranging from acute care to long-term care and home care. These systems also have links to external networks, which connect and share information with patients, employees, insurers, and business partners. If systems are compromised, such a large attack surface provides many opportunities for a cyberterrorist to exploit security holes and seize sensitive data and or disrupt services.

What Would a Cyber Attack Look Like?

In a serious case, a cyber attack may lead to a failure of proper patient care by disabling computer information systems or causing communication networks to experience denial of service. Areas of particular concern to healthcare-related facilities include the potential for cyberterrorism-related events to erase or alter computerized medical, pharmacy, or health insurance records. ⁵ If terrorists were to attack America's healthcare IT systems, it probably would not be through the use of one major assault, but rather via a series of small incursions that are much more difficult to detect. An example of this type of scenario was outlined recently in a cyberterrorism seminar at the University of California, Davis in Sacramento. The scenario began with hackers using “phishing” e-mails to introduce four separate packages of malware into the hospital networks. Once planted, these packages would trigger in sequence a few days or weeks apart. The first would infect patient record databases and alter doctors' orders, medication doses, and other information, spreading confusion and possibly causing illness and deaths. A few days later, the next program would trigger, interfering with portable devices that nurses use to record patient information. The third wave would attack the software in intensive care unit monitors, altering the data display and switching off alarms. The fourth and final wave would infect the software controlling drug infusion pumps and similar devices. After a few weeks of these rapidly changing, and different, attacks, the staff in the hospital would have no trust in any electronic data, and the IT support staff would be totally demoralized.

The possible threats can also extend beyond specific electronic applications to infrastructure or utility targets. Again, it is not possible to provide a definitive list of possibilities, but a few examples have been suggested. For instance, cyber attacks on water, electricity, or telecommunications systems would quickly put hospitals in difficulty. ⁷ Attacks against the telecommunications system in particular could not only have the potential to disrupt the flow of health information, but also the multiple logistical systems upon which the operations of healthcare facilities depend, for example, the acquisition of supplies. ⁵

Despite the development of scenarios such as that outlined above, there has been no published evidence showing a widespread focus by cyberterrorists on attacking American healthcare facilities, although the Federal Bureau of Investigation has been called in to investigate several hospital-related cyberterrorist incidents (personal communication from anonymous FBI officers). Cyberterrorism is certainly not mere fiction. Other examples already exist of individuals successfully targeting important infrastructure and causing harm as a result. In 2008, a system administrator who had been employed by the city of San Francisco took control of the city's computer system and prevented others from accessing a variety of software applications. According to Ellsmore and Raghu, ⁸ “While this attack did not cause violence to the public, it provides a tangible proof of concept of remote interference with critical infrastructure systems, and systems responsible for human welfare or protection.”

What Is the Extent of the Cyberterrorism Threat Today?

Analysts have concluded that following past trends, where hackers and cybercriminals have taken advantage of easy vulnerabilities, we may gradually see new instances where cyberterrorists target vulnerabilities in critical infrastructure. ⁹ This notion that the cyber threat is a real and growing one does have some credence. In one survey, ¹⁰ 71% of senior IT executives believed that cyberterrorism is on the rise and that this trend posed a very serious threat to America's critical infrastructure. According to the non-profit information security organization Open Security Foundation, 12% of all information breaches in the United States were facilitated by hackers in 2010 ¹¹ (Fig. 1 gives the complete breakdown), but unfortunately no information is available on the healthcare sector specifically on this group's Web site.

OPEN IN VIEWER

Fig. 1.

Incidents by breach type.

There are reports, however, suggesting that healthcare institutions are increasingly being targeted with theft or manipulation of electronic data as well as malicious attacks that disrupt computer systems. One U.S. information security service vendor has noticed an upswing in attacks launched at its healthcare clients involving malware. ¹² If a computer is infected with malware, it can be used to steal data stored by the victim's browser (including passwords), launch distributed denial of service attacks, spread via USB devices or peer to peer, and download additional malware onto the infected computer.

Why Is Healthcare a Cyberterrorism Target?

As with other sectors of the U.S. economy, the 9/11 terrorist attacks in particular provided justification for the insertion and large scale investment of the security industry into healthcare delivery. ¹³ This influx of money and resources has not proven to be a sure fix in addressing security vulnerabilities. Ellsmore and Raghu ⁸ commented that despite this increase in IT budgets, ”only a fraction of it is allocated to securing systems within the healthcare industry, so it is to be expected that information systems within the industry are vulnerable to attack.” Indeed, one of the top security breach “trends” in the healthcare industry is a susceptibility to new hacking technologies because organizations have simply delayed investment in upgrading their older systems. SQL Injection attacks in particular are on the rise. This is a case whereby a hacker executes a SQL enquiry from the Internet to perform an operation on the recipient's database to transfer data back to themselves. ¹⁴

How Are We Currently Protecting Ourselves?

The healthcare industry has proven to be particularly difficult to fortify against cyber attack in terms of coordinating and implementing “best practice” cyber security policies and procedures. Much of this stems from the fact that the industry is not a single homogeneous entity but, rather, consists of decentralized and loosely coupled organizations, both public and private, most of which are small compared with those found in such sectors as financial services. ¹⁵ In response to this situation the Federal Government has taken the lead, through the Department of Homeland Security, to prevent and respond to cyber attacks on the nation's critical infrastructures by establishing a “National Infrastructure Protection Plan.” A subset of this plan includes the “Healthcare and Public Health Plan,” which describes how the infrastructure protection risk management framework is being implemented and integrated within the health sector. One of the key aims of these plans is to improve sharing of information between the public and private sectors about physical and cyber security threats and vulnerabilities. ³

Another development on the healthcare front has seen the establishment of the National Health Information Sharing and Analysis Center. Its mission is to advance the integrity and cyber security protection of the nation's healthcare and public health critical infrastructure from threats and vulnerabilities and to foster the availability of best practices, countermeasure solutions, security awareness, and workforce education. ¹⁶ The Government has also been proactive in other areas. For example, in recognition of the fact that electronic health records are being increasingly adopted by many medical practices, the Office of the National Coordinator for Health Information Technology has provided a cyber-security checklist for the small healthcare environment. ¹⁷

Private healthcare organizations are also stepping up efforts to protect themselves in areas such as electronic patient information as they witness increased attacks against hospital networks, mindful how a data breach could hurt patients and their own reputations. ¹⁸ Some hospitals such as Northwestern Memorial have even started taking preventive measures by using a cyber-specific response plan that mirrors the color-coded national alert system used by the Department of Homeland Security; as alert levels change, the hospital responds by turning off certain services, thereby eliminating access to potential attackers. ⁷

Despite the initiatives launched by the Federal Government and the changes to the security and privacy landscape (e.g., HIPPA), a 2009 survey published by the Healthcare Information and Management Systems Society found that a large number of healthcare practices and hospital systems do not perform security risk analyses and therefore do not understand their vulnerability to cyber attack. Other key findings of this survey indicated that budgets dedicated to security remain low, and many organizations still do not have a formally designated Chief Information Security Officer or Chief Security Officer to provide the needed organizational leadership to focus on cyber security. In addition, many organizations are not using available technologies to secure data, such as encryption of computer hard drives. Although almost two-thirds of responding organizations do secure data under transmission, fewer than half encrypt stored data. Also, organizations often do not have a plan for responding to threats or incidents relating to a security breach. ¹⁹

So we have a mixed picture at best, with some healthcare organizations making strides to protect themselves, but a large proportion still vulnerable to attack. What should the organizations in the latter category be doing? Up-to-date computer security systems and firewalls, personal vigilance, and adherence to “best practice” guidelines are essential in maintaining the security of computer systems. ²⁰ Organizations must evolve their methodologies to address these changes and provide information assurance that is effective, consistent, and continuous. Because of this, organizations must develop security policies and guidelines for their information assets that apply to all systems and that actively support the need for greater awareness and understanding of security issues with the goal of developing a “culture of security.” ⁴

What Should We Be Doing to Protect Ourselves Better in the Future?

In order for healthcare organizations to effectively protect their sensitive patient data, they should consider using a defense-in-depth strategy, as part of their overall information technology risk management strategy. This approach involves implementing multiple layers of protection to shield the organization from current and emerging threats. A provider of information security services to 82 healthcare clients in the United States offered up six key guidelines for the healthcare industry to follow:

1. Perform regular security risk assessments that will look at the controls the organization has in place compared with regulatory requirements and help determine if there are any gaps.

One final guideline to consider is how to handle the “internal” threat from disgruntled employees or ex-employees. These are people who are able to carry out attacks because of privileges assigned as part of their job function. This accounts for 70% of computer-related criminal activity. ²¹ Protecting an organization from this threat will require action on several fronts in addition to securing software applications. It could mean creating greater cyber awareness to sensitize employees to the problem to disabling access immediately during employee terminations. ²²

Cunningham ²³ concluded that effective protection from cyberterrorism comes down to three main ingredients: the right combination of people, processes, and technology. IT staff and employees need to be educated about security and their roles in enforcing it. “Best practice” security processes need to be carefully followed and implemented, and the right technology should be deployed to assist all of these efforts and shore up vulnerabilities that may exist. If the Healthcare Information and Management Systems Society survey from 2009 ¹⁹ is anything to go by, this more holistic approach to tackling cyber security and by extension cyberterrorism is not being adopted by many U.S. healthcare organizations and certainly not with the urgency that is needed.

Cyberterrorism may not be the current “weapon of choice” for terrorist groups, but it does remain a real and growing threat to the U.S. healthcare system. Terrorists are looking at ways of striking from a distance in order to reduce the chances of being captured while still creating panic and fear within the target community. Cyberterrorism fulfills these requirements, and healthcare is becoming more vulnerable and more threatened every day because of the fact it has become dependent on computer-based technologies and the Internet. It is clear that many U.S. healthcare organizations are not prepared or equipped to handle a serious cyberterrorist attack despite the best efforts of the Federal Government to address this. The stakes are high. The ability to deliver healthcare would be crippled if terrorists disabled crucial parts of the nation's IT system using cyber methods to alter, delete, or steal vital health information. Healthcare organizations should therefore prepare themselves by ensuring they have appropriate measures in place to secure important systems that could be potential targets for terrorists. Protective measures are available today, but many organizations are simply not resourcing and managing their security initiatives appropriately in relation to the size of the threat that they face. They do so at their peril because the future terrorists of the world are growing up in a more technologically advanced society than their parents and will have at their disposal cyber assets that could disrupt the healthcare system. The risk to the U.S. healthcare system and the future of health on the Internet unfortunately shows no signs of diminishing in the 21st century.