*For Educational Purposes Only*

1. Introduction to Cyber Threats
and Opportunities
HCA Week Two

3. Computer Network Attack versus Computer
Network Exploitation
• Computer Network Attack (CNA): using cyber means to attack a
system, essentially sabotaging or destroying that system.
• Computer Network Exploitation (CNE): using cyber as a means for
espionage
The problem is that, from the point of view
of the object of an attack, CNE and CNA look
the same as each other, except for the end
result.

4. Vulnerability versus a Threat
• An unlocked door is a vulnerability, but not a threat if no one wants to
enter.
• Conversely, one vulnerability can lead to many threats; that unlocked
door could lead to terrorists sneaking in a bomb, competitors walking
out with trade secrets, thieves stealing valuable goods, local hooligans
vandalizing property, etc.
The defining aspect of threats is the actor and the consequence.

5. Malware
• Viruses: A computer virus is a type of malware that propagates by inserting a
copy of itself into another program. It spreads from one computer to another,
leaving infections as it travels.
• Worms: Computer worms are similar to viruses in that they replicate functional
copies of themselves and can cause the same type of damage. In contrast to
viruses, which require the spreading of an infected host file, worms are
standalone software and do not require a host program or human help to
propagate.
• Spyware: Software that enables a user to obtain covert information about
another's computer activities by transmitting data covertly from their hard drive.
Spyware is used as a tool for surveillance. It does not typically spread like a virus
or a worm.
• Trojans: A Trojan is a harmful piece of software that looks legitimate. Users are
typically tricked into loading and executing it on their systems. After it is
activated, it can achieve any number of attacks on the host.

6. Trojans are named for the Trojan Horse used in the Greco-Trojan Wars.

7. Malware in Perspective
• Due to information sharing and the ease at which malware
can be adapted into a new variant, there are 100,000-
200,000 pieces of unique malware created every day.
• More than 430 million new unique pieces of malware were
discovered in 2015 by Symantec, up 36 percent from the
year before.

8. Ransomware
Ransomware is a type of malware that prevents or limits users from
accessing their system, either by locking the system's screen or by
locking the users' files unless a ransom is paid.

9. Hospitals as Targets for Ransomware?
• Hospitals are the perfect target for this kind of extortion because they
provide critical care and rely on up-to-date information from patient
records.
• Without quick access to drug histories, surgery directives, and other
information, patient care can get delayed or halted, which makes
hospitals more likely to pay a ransom rather than risk delays that
could result in death and lawsuits.

10. 2016 Hollywood Presbyterian Medical Center
and Ransomware
• On February 5, hackers using malware
infected the institution's computers,
preventing hospital staff from being able to
communicate from those devices.
• Ransomware called Locky. Computers were
offline for more than a week until officials
caved to the extortionists.
• Hospital was forced to pay $17,000 in
bitcoin (40 coins) to attackers.
• The FBI forced to investigate.

11. Bitcoin
• A type of digital currency in
which encryption techniques are
used to regulate the generation of
units of currency and verify the
transfer of funds, operating
independently of a central bank.
• Bitcoins provide a level of
anonymity, which is why it is a
preferred method of currency for
those engaging in nefarious
activities.

12. March 2016 Ransomware Attack Methodist
Hospital in Henderson, Kentucky
• Struck by Locky ransomware.
• Attack prevented healthcare
providers from accessing patient
files.
• The facility declared a “state of
emergency” on a Friday but by
Monday was reporting that its
systems were operational.
• Methodist officials did not pay the
ransomware; administrators in that
case had simply restored the
hospital’s data from backups.

13. March 2016 MedStar Health
• Operates 10 hospitals and more than 250 out-patient clinics in the
Maryland/Washington, DC area.
• Hit by malware that was likely ransomware.
• MedStar wrote in a Facebook post that its network “was affected by a virus
that prevents certain users from logging-in to our system.”
• A number of employees told the Washington Post that they saw a pop-up
screen appear on their computers demanding payment in Bitcoin.
• The organization responded immediately by shutting down large portions
of its network. Employees were unable to access email or a database of
patient records, though clinics and other facilities remained open and
operating.
• FBI forced to investigate.

14. Ransomware Hostage Manual
• Victims should disconnect infected systems from the network and disable
Wi-Fi and Bluetooth to prevent the malware from spreading.
• Victims should also remove any USB sticks or external hard drives
connected to an infected computer to prevent those from being locked as
well.
• ALWAYS BACK UP YOUR FILES!!! That way if your files are held hostage,
you can restore them with your back up without paying a ransom.
• For more information, see the ransomware manual:
https://www.wired.com/wp-
content/uploads/2016/03/RansomwareManual-1.pdf

15. Botnet
• A malicious bot is self-propagating malware designed to infect a host
and connect back to a central server or servers that act as a command
and control (C&C) center for an entire network of compromised
devices, or "botnet." With a botnet, attackers can launch broad-
based, "remote-control," flood-type attacks against their target(s).

16. Most Infected Countries

17. Distributed Denial of Service (DDoS) Attacks
A distributed denial-of-service attack (DoS attack is
a cyber attack where the perpetrator seeks to
make a machine or network resource unavailable
to its intended users by temporarily or indefinitely
disrupting services of a host connected to
the Internet. DDoS attacks are typically
accomplished by flooding the targeted machine or
resource with superfluous requests in an attempt
to overload systems and prevent some or all
legitimate requests from being fulfilled. A DDoS
attack is analogous to a group of people crowding
the entry door or gate to a shop or business, and
not letting legitimate parties enter into the shop or
business, disrupting normal operations.

18. DDoS Attack Boston Children’s Hospital
• In 2014, Boston Children's Hospital became the first health care
organization to be targeted by DDoS attacks from a hacktivist group.
• The hospital uses the same Internet Service Provider (ISP) as seven
other area health care institutions. The DDoS attacks had the
potential to bring down multiple pieces of Boston's critical health care
infrastructure.
• With health care now highly dependent on digital records and
network connectivity, inability to access information systems could
have far-reaching impacts beyond dollars spent. Patient and staff
safety could be compromised. Lives could be lost.

19. • Phishing is the fraudulent
practice of sending emails
purporting to be from
reputable companies in
order to induce individuals
to reveal personal
information, such as
passwords and credit card
numbers.
• Phishing attacks are
normally done in mass
with the hopes that
someone will fall for the
attack.

21. Spear Phishing
Spear phishing is the fraudulent practice of sending emails ostensibly
from a known or trusted sender in order to induce targeted individuals
to reveal confidential information.

23. Anthem Data Breach

25. 96 percent of healthcare providers had at least
one data breach in the past two years, with
patient billing data and medical records
representing some of the most vulnerable data
types.

26. In 2015, nearly 100 million records from
four health insurers– Anthem, Excellus
BlueCross BlueShield, Premera Blue Cross
and CareFirst Blue Cross Blue – were
stolen by hackers.

27. Whaling is a type of fraud that targets high-
profile end users such as C-suite level
corporate executives, politicians and
celebrities. Whaling emails and websites are
highly customized and personalized, often
incorporating the target's name, job title or
other relevant information gleaned from a
variety of sources.

28. Watering hole is a
computer attack strategy, in
which the victim is a particular
group (organization, industry, or
region). In this attack, the
attacker guesses or observes
which websites the group often
uses and infects one or more of
them with malware. Eventually,
some member of the targeted
group gets infected.

29. https://www.virustotal.com/en/
One way to protect yourself against phishing or spear phishing:
You can upload attachments prior to executing them to see if they may have malware on them. So long as you
do not execute the file, it will not run on the computer.

30. Common Targets
• Attackers prey on systems that have ignored basic precautions, such
as products that have:
• Default login names and passwords
• Most home wireless routers have default passwords that a lot of users leave
in place
• Not patched products
• Microsoft Patch Tuesdays
• Computers without an anti-virus system

31. Zero Days
A zero day vulnerability refers to
a hole in software that is
unknown to the vendor. This
security hole is then exploited
by hackers before the vendor
becomes aware and hurries to
fix it—this exploit is called a zero
day attack.

32. Advanced Persistent Threat (APT)

33. APT: Healthcare Under Attack!
• The healthcare and pharmaceutical industry are under attack from
APTs:
• APT groups are aiming to steal intellectual property and proprietary
information capable of benefitting domestic industries and assisting
the government in achieving its strategic healthcare goals.
• APT groups in pursuit of patients’ personally identifiable information.
• APT attacks as “proof of concept” in the healthcare industry before
attacking other sectors.

34. Insider Threats

35. Insider Threats in the Medical Field
• In a rare criminal case involving a HIPPA violation, a former
respiratory therapist was convicted of wrongly obtaining individually
identifiable health information.
• Therapist was using the information for seeking, obtaining, or using
intravenous drugs.
• From May 10, 2013, to about March 25, 2014, Knapp wrongfully
obtained computerized protected health information of
approximately 596 ProMedica patients without authorization

36. Unintentional Insider Threats

37. Hardware Threats

38. Cyber Man-in-the-Middle Attack
• An attack where the attacker secretly relays and possibly alters the
communication between two parties who believe they are directly
communicating with each other.

39. ?
The IoT is the interconnection via
the Internet of computing devices
embedded in everyday objects,
enabling them to send and receive
data.

40. The IoT and Healthcare: Opportunities
• In the USA there are 25 online devices per 100 inhabitants, and that is
just the beginning.
• The healthcare segment of the Internet of things is poised to grow to
$117 billion by 2020.
• Goldman Sachs estimates that IoT technology can save patients,
providers, and payers billions of dollars for asthma care alone.

41. Sensors and the IoT: Healthcare Opportunities
• Hospitals can use RFID chips to increase accountability and efficiency.
• Patients can be tracked through RFID equipped wristbands, similar to
those currently used at Disneyland. Wristbands could be used to
streamline visit to ensure consistency and allocate greater time to
patient care.
• Hospitals tend to overstock certain medication to prevent running out
during an emergency. RFID sensors can provide an accurate inventory
of supplies at a moment’s notice to improve the hospital’s resource
management.
• In short, sensors can be applied to physical health records or
medication to prevent breaches of confidentiality or data integrity.

42. IoT and Healthcare: Threats
• Researchers have found potentially deadly vulnerabilities in dozens of
medical devices such as insulin pumps, x-ray systems, CT-scanners,
medical refrigerators, and implantable defibrillators.

43. Telehealth: Healthcare Opportunities
• Telehealth is the practice of delivering healthcare through a remote
telecommunication platform, such as mobile phone, video
conferencing, or email.
• Telehealth covers a broad range of fields and applications such as:
dentistry, counselling and mental health, physical and occupational
therapy, healthcare for homebound patients, monitoring and
management of chronic diseases, disaster management, and
consumer and professional management to name a few.

44. Remote Monitoring: Healthcare Opportunities
• One facet of the telehealth market is dedicated to remote monitoring
systems that enable the elderly and homebound patients to remain at
home.
• Remote patient monitoring is driven by innovation in healthcare
reimbursement models that recognizes the value in preventing
hospitalization and readmission by promoting population health
management and proactive intervention.

45. Remote Monitoring: Healthcare Potential
Threats
• Remote monitoring devices could enable attackers to track the
activity and health information of individuals over time. This
possibility could impose a chilling effect on some patients.

46. Behavior Modification Devices: Opportunities
• Behavior modification devices encourage patients to adopt healthier
lifestyles through the use of appealing technology, social pressure,
and exercise gamification.
• As a result, patients are healthier and hospitals treat fewer patients
for the trivial health conditions that result from inactivity (sprained
wrist, poor diet, lethargy, etc.).

47. Embedded Devices: Opportunities
• Embedded devices, software driven physical devices that are
surgically implanted into a patient’s body, deliver medication, monitor
body functions, or support specific organs.
• The majority of embedded devices connect through Wi-Fi or
Bluetooth to an application on the patient’s smartphone. Common
embedded devices are pacemakers, insulin pumps, and medicine
administration devices.
• One emerging variants is a blood monitoring implant developed at
Ecole Polytechnique Federale de Lausanne (EPFL) in Switzerland, that
can notify a patient and their doctor before a heart attack occurs.

48. Mobile Applications: Opportunities and
Threats
• Mobile healthcare applications precede many of the other healthcare
technologies previously discussed. Mobile applications are the
support for some telehealth platforms, most remote monitoring
devices, practically every behavior adjustment device, embedded
devices, and the cloud.
• Mobile applications in any sector are notoriously insecure because
the application market demands rapid development at minimal cost
in order to churn a profit.