Protecting medical equipment and clinical data: Cyber Considerations for 2022

Cybersecurity challenges in NHS 2022

Complexity in NHS IT

IT networks are notoriously complex, especially at a health trust. Complexity introduces a range of challenges, including application performance, network performance, root cause analysis and difficulty in monitoring. On top of this is the added challenge of having to secure everything, including every endpoint, many of which will be scattered far and wide.

The more complex a network is, the more ‘things’ there are to secure, introducing more potential avenues that can be compromised. NHS networks are built for a purpose, which is to share patient data and resources to medical and support staff, whilst underpinning all the various medical devices and systems that sit within.

As the NHS network has grown over time to support new systems, adapt to new technology, pivot to accommodate remote working etc., there is still a reliance on legacy systems. These are older parts of the network that aren’t able to be upgraded or moved, and through this combination of new and old, blind spots, back doors and vulnerabilities thrive.

Tooling overlap

We’ve seen examples in a number of NHS trusts where multiple solutions are in place that actually achieve similar or the same outcomes.

Why does this occur and why is it a problem?

This can occur when procurement decision-makers are put in the ‘use it or lose it’ scenario and if their budget isn’t spent, it’s lost. That’s fine, the budget is there to be spent. The problem is that there isn’t a clear roadmap of where money needs to be spent and why. This opens the door to the opportunistic salesman to shoehorn his solution into whatever problem a Trust tells him they’re trying to solve.

Why is this a problem? - Numerous reasons, firstly, it’s a waste of budget, given that money could be desperately needed elsewhere. Secondly, overlapping solutions, systems, applications, etc., just adds to the complexity. Another concern is that you widen your vendor portfolio and therefore the risk of a supply-chain attack.

Whether it’s financial, operational or a security threat that concerns you, tooling overlap is an often unnecessary problem.

Lack of visibility

As the well-used expression goes - you can’t protect what you can’t see.

If you consider how IT is used in 2022, people access data, systems and resources from multiple locations, including from their own homes. This access no longer requires a visit through a central hub with security solutions protecting these resources, they can be accessed from anywhere, at any time via cloud services.

If you add this distributed manner of IT usage to the general complexity we have previously discussed and also consider unmanaged devices and medical equipment connecting to the network, you can begin to see the amount of potential ingress paths and vulnerabilities present at any one point in time.

Without deep visibility into this connectivity and activity across the network, what hope can there be to secure such an operation? Of course critical systems and their access need securing first, but outside of that, the importance surely needs to be knowing what the priorities are. The only way to do that is to gain visibility into the situation as a whole.

Unmanaged IoT and Medical devices

IoT is associated with an increased cyber risk due to an increased attack surface which is susceptible to brute force attacks and can be compromised through default passwords or vulnerabilities and used as a backdoor into the network.

Looking more closely at medical devices or Operational Technology (OT) that are unmanaged, at least from a security perspective, which are built for their medical purposes and not predominantly with security in mind. What would happen if one of them was to get compromised? Would anyone know? Also, they tend to fall outside of normal jurisdiction, so if a CT scanner was infected with malware who’s responsibility is that?

These types of devices tend to sit outside of traditional security solutions or monitoring solutions in general, therefore uncharacteristic or unusual behaviour is rarely picked up, providing the perfect environment for malicious activity to fester.

The risk? If Malware were to infect a medical device, it could stop working - preventing a patient from receiving treatment. The device might also allow the malware to spread - impacting more patients.

Threat of ransomware

Ransomware in the NHS has already made headlines with the WannaCry attack devastating health systems in 2017 and that wasn’t even targeted.

So, why was the NHS so vulnerable to ransomware?

As we now know, it came down to an exploitation of a Microsoft vulnerability, for which a patch had been released, so why did it wreak havoc?

A quick look at some of the points mentioned earlier in this list will answer this question.- The complexity, difficulty to isolate, lack of visibility into device status/behaviour - all of these are likely to have been contributing factors. It’s also worth considering the pressure that IT teams are under due to the issues mentioned in this article, and how much employee burnout plays a part. Tired, under-resourced teams aren’t going to perform at the top of their game and mistakes will be made - it’s a human condition and it’s a vicious cycle.