Lukas - Ancaman E-Health Security


Published on

Lukas - Ancaman E-Health Security

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Lukas - Ancaman E-Health Security

  1. 1. Ancaman-ancaman TerhadapKeamanan InformasiPada eHealth(Security Threats in eHealth)Lukas & Hadi
  2. 2. Honeynet missionTo learn the tools, tactics and motives involved incomputer and network attacks, and share thelessons learned.Outline:eHealth attack: motives, tacticts, tools.
  3. 3. What is eHealth? is the transfer of health resources and health care byelectronic means. It encompasses three main areas:The delivery of health information, for health professionals andhealth consumers, through the Internet andtelecommunications.Using the power of IT and e-commerce to improve public healthservices, e.g. through the education and training of healthworkers.The use of e-commerce and e-business practices in healthsystems management.
  4. 4. 4(#total)eHealth - The Future of HealthcareThe banking metaphorMost transactions carried outby the customerCentralisation of specialistservicesDecentralisation of non-specialist services
  5. 5. 5(#tExisting Health on the WebEstimated to be ~20,000 health websitesUsed by 98 million adults75% of people who have web accessaverage of 3.3 times per monthMore than consult doctors each day37M e-patients/day on the net; 2-3M patients see a doctor
  6. 6. 6(#tExisting Health on the WebAccess to accurate information can lead tomore knowledgable, empowered, less anxiouspatientsmore participatory health decisionsbetter care as patient and doctor becomepartnersMis-information can lead toconfused and angry patientsbad decisions, mis-placed hope, worse care,harmPrivacy violations can cause emotional andeconomic damage
  7. 7. 7(#total)eHealth“Healthcare which is supported by electronicprocesses”Other terms:– Healthcare informatics or Health InformationTechnology (HIT)– Medical Information Systems (MIS)– Biomedical informatics (also includes Bioinformatics:gene sequencing etc.)
  8. 8. 8(#total)eHealth includes:Electronic Medical Records: easy communication of patient data between differenthealthcare professionals (GPs, specialists, care team, pharmacy)Telemedicine: do not require a patient and specialist in same physical location.Decision support systems in healthcareData can be analysed to provide alerts, reminders and real-time decision aidsEvidence Based Medicine:The application of the scientific method to medical practiceCheck if diagnosis is in line with scientific research.Data can be kept up-to-date.Citizen-oriented Information Provision: for both healthy individuals and patientsSpecialist-oriented Information Provision: best practice guidelines from latestmedical journals.Virtual healthcare teams: collaborate and share information on patients throughdigital equipment (for transmural care).
  9. 9. 9(#total)Transmural CareTransmural: Care should not stop at the walls of the hospital– Both intra- and extra-mural, thus ‘transmural care’.– Care before, during and after the hospital stay.– Cooperation and coordination among local practitioner,hospital, home care and rehabilitation centres– Patient part of an agreed programme - protocols andstandards.
  10. 10. 10(#total)Medical ErrorsHuman Errors:IOM Report, 199944,000 to 98,000 die in US annually from medicalerrorsat 44,000, would rank as 8th leading cause ofdeathcar accidents: 43,458breast cancer: 42,297AIDS: 16,5167000 deaths from medication errors alone
  11. 11.
  12. 12. Data Breaches by Sector in 2012Symantec: Internet Security Threat Report2013 :: Volume 18
  13. 13. Ancaman-ancaman (Threats)Pihak manajemen rumah sakit (CEO) tidaksepenuhnya mengerti tentang resiko keamananinformasi dan cara mengelola dan menanganinya.Sulit mencari professional yang berbakat di bidangkeamanan informasi.Orang dalam (insiders) yang sengaja atau tidaksengaja membocorkan informasi personal danrahasia.
  14. 14. HacktivistsCrime as a Service (CaaS)Kebocoran informasi (Information leaks)BYOD (bring your own device)BYOC (bring your own cloud)Regulasi (regulation) dari pemerintah tentangkeamanan informasi rumah sakitBig DataAncaman-ancaman (threats) - lanjutan
  15. 15. ImpactPasienKeluargaReputasi (reputation) rumah sakit
  16. 16. Motives1. Personal financial gainBlackmail, competitive advantage, lawsuit, career advancement,corruption of clinical trials or research results, divert valuable assets2. RevengeDenied advancement, perceived wrong, ideological redress (commonoccurrences from a potentially disgruntled employee; higher probabilitythen most other sources of threat to an agencies information,information technology infrastructure, and/or physical facilities)3. Curiosity and thrill seekingNon-malicious hacker, desire to be an insider, “how does it work”reasons, gain access4. Intellectual challenge, learning, need for acceptance and respectMalicious and non-malicious hackers, destroy data bases, take control5. Personal evidenceCover a crime, cover a mistake, insider and external informationdestruction
  17. 17. Motives6. Institutional evidenceCover crime, cover bad decisions, cover misadventures, change clinicaltrials or research results, intimidate personnel7. Perceived moral or idealism purposeReligious, cultural and philosophical radicals, demonstrate ideological orreligious causes, labor unrest, domestic and foreign cultural agitation,“Robin Hood” motives8. Military and national intelligenceInformation on readiness, composition and disposition of units, statusand intent of forces, impact readiness through destruction of capability9. Political and economic intelligenceGain information on individuals, gain advantage in internationalnegotiations, obtain research and other valuable technical informationthat would be too expensive to develop by oneself or in failing block,keys, etc.
  18. 18. Motives10. Business intelligenceCompetitive advantage, trade secrets entrusted to government, illegallyobtain product specifications or research content and results, illegallyobtain data to conduct research11. TerrorCreate life threatening situations, destroy care capability, weakenculture and values12. IgnoranceIntruders may be unaware that actions are illegal and punishable,consultants obtaining unauthorized password block, keys, etc.
  19. 19. Solusi (rekomendasi)Teknologi (technology)Proses (process)Orang (people)Kepatuhan (compliance)Resiko (risk)Tata kelola keamanan informasi (informationsecurity governance)
  20. 20. TacticsStolen devices (laptop, flashdisk, harddisk, etc)Sniffing the networkSocial engineeringTrojan Horse: A program that, unknown to the user,contains instructions that exploit a known vulnerability insome software.Back Doors: In case the original entry point has beendetected, having a few hidden ways back makes reentryeasy and difficult to detect.Malicious Applets: Tiny programs, sometimes written in thepopular java computer language, that misuse yourcomputers resources, modify files on the hard disk, sendfake E-mail, or steal passwords.
  21. 21. Pentingnya Melakukan Security ReviewSecurity requirement analysisThreat modelingIT infrastructure architecture analysisCode reviewPenetration testingCompliance auditSecurity maturity
  22. 22. ConclusionTo secure eHealth:a raised level of awareness,shared responsibility, constant risk assessment andtesting procedures,the management of identified risks,and finally the most difficult issue of implementing trulycomprehensive and steadfast legal and enforcingmechanismsIt is important to apply Cyber Hygiene for allemployees and medical staffs in the hospital
  23. 23. Q & AHealth IT