Security and resilience for Smart Hospitals Key findings Dimitra Liveri, Ilias Bakatsis, Athanasios Drougkas| ENISA 2nd eHealth Security Workshop| Vienna | 23rd November

2016: ENISA work to secure Smart Hospitals Objectives Improve security and resilience of hospitals information systems Identify common cyber security threats and challenges and, Present mitigation measures to address them Support pilots in hospitals across the EU Secure devices and systems to improve patients’ safety

Study Overview Scope Target Audience Methodology Smart hospitals value and offerings built on top of traditional hospitals Smart Hospitals assets identification Vulnerabilities and threats presentation Attack scenarios analysis Good practices and recommendations Target Audience Healthcare Providers / Hospitals – CIOs/CISOs etc. Industry stakeholders Policy Makers Methodology Desktop research Interviews with hospitals’ CISOs Online survey Responders : Hospital CISO/CIO (“user side”) Industry representatives Policy makers

Towards a definition A smart hospital is a hospital that relies on optimised and automated processes built on an ICT environment of interconnected assets, particularly based on Internet of things (IoT), to improve existing patient care procedures and introduce new capabilities

Why Hospitals are becoming “Smart”

Threats based approach Assets Vulnerabilities Threats Attack scenarios Good practices Initial findings Recommendations

Identification of Smart Assets in Hospitals

Assessing the criticality of smart assets

Vulnerabilities of Smart Hospitals Interconnection between devices/systems, some times even automatic Communication between devices and legacy systems creates gaps Physical security impossible for all components Impossible to virtually patch all devices Life span of medical devices Little malware detection or prevention capabilities No clear way to alert the user when a security problem arises Access control difficult to implement Usability issues cause circumventions of set policies Use of personal devices non compliant to security policies Lack of compliance with organisational or industry standards Users behaviour Lack of proper configuration management process

Threats mind map Report also includes threat modelling identifying attack actors and attack vectors, asset exposure mapping threats to assets and finally assessing criticality.

Attack scenarios 1. Social engineering attack 2. Medical device tampering 3. Theft of Hospital equipment 4. Ransomware attack on Hospital Information System 5. DDoS on Hospital servers Per scenario: Description Assets affected Criticality Likelihood Cascading effects Estimated recovery time Good practices Challenges and gaps

Good practices Mapping good practices to meeting threats (good practices are organised in categories)

Open Issues Gap 1 - Lack of bring your own device controls Gap 2 - Need of automated asset inventory discovery tool Gap 3 - Lack of application whitelisting technology Gap 4 - Need to ensure secure configurations Gap 5 - Need of client certificates to validate and authenticate systems Gap 6 - Lack of training and awareness-raising programs Gap 7- Remote administration of servers, workstations, network devices, etc. over secure channels Gap 8 - Pace of standardisation versus IT technology Gap 9 – Cost benefit breakdown is critical

Recommendations for Hospitals Establish effective enterprise governance for cyber security Implement state-of-the-art security measures Provide specific IT security requirements for IoT components in the hospital Invest on NIS products Establish an information security sharing mechanism Conduct risk assessment and vulnerability assessment Perform pen g and auditing Support multi-stakeholder communication platforms (ISACs)

Recommendations for Industry Incorporate security into existing quality assurance systems Involve third parties (healthcare organisations) in testing activities Consider applying medical device regulation to critical infrastructure components Support the adaptation of information security standards to healthcare

Thank you eHealthSecurity@enisa.europa.eu https://www.enisa.europa.eu/scada