Former CIA head: health care industry must quickly confront cybersecurity issues

The health sector's continued expansion of network-connected technology will force greater cyber security efforts than ever before.

Cybersecurity within the health care sector will only become a more dire issue for politicians and doctors alike as connected technology continues to expand, a panel of experts speaking at the Bipartisan Policy Center agreed Wednesday.

Former acting CIA Director Michael Morrell and former Homeland Security Secretary Michael Chertoff pointed to the rapid integration of smart technology into U.S. health care system since 2008, and they noted the sector’s exposure to ransomware, data theft and disruption of connected devices.

Devices such as network-connected pacemakers are vulnerable to hackers in three ways, Morrell said: through a vulnerable internet-connected network; by infiltration of the supply chain from manufacturers to hospitals; or through insider manipulation at health care facilities. The insider threat is the most direct and therefore more potentially devastating one, he said.

Expanding the conversation, he said cybersecurity across all sectors “is the second-biggest threat facing the U.S. after international terrorism, and it’s the fastest-growing threat — and the Internet of Things is contributing to that.”

While the panel acknowledged that there has yet to be a real-world case of a hacker successfully targeting a specific IoT health care device like a pacemaker, a lack of existing cybersecurity standards within the American health care system may ultimately provide the window a hacker needs to do so.

Morrell offered an example from his counterintelligence days to illustrate this point: “If I learned that an ISIS leader had a pacemaker, I’d be asking my guys how to get to it,” he said. Morrell was deputy director of the CIA from 2010-13, and that service included two separate stints as acting director. 

The health care industry has been rocked by data breaches over the last few years, and 2017 provided no refuge for hospitals or insurance providers.

The ransomware virus known as Wannacry had a devastating impact on hospitals across Europe, shutting down operations completely if ransom was not paid. WannaCry also provided a test for the Health and Human Service’s new cybersecurity center in early 2017.

Despite the potential risks attached to integrating network-connected technology into health care, the panelists agreed that innovative health care solutions are necessary. 

“Digital health and health tech are the answer to providing better health care globally,” said panelist Leslie Saxon, chief of the cardiovascular division at the University of Southern California’s Keck School of Medicine.

Patients should be aware of the cybersecurity risks affecting connected devices, and both hospitals and manufacturers must consider what the core function of any connected device actually is, Chertoff said. The priority needs to be on minimizing the threat of a potential breach, according to Chertoff, and one solution is a development cycle that focuses on security early on in the process. 

Morrell urged senior board members in the private sector to proactively learn about cyberthreats and also to understand the severity of consequences when critical software vulnerabilities are left open. 

Increased collaboration between health care device manufacturers will also be important in improving the hospital network security, said Medical Device Innovation Consortium CEO William Murray. By sharing cyberthreat intelligence, companies that are typically competitors can help improve digital security writ large, he said.

Because the government can’t be solely relied upon to develop policy that keeps pace with technological advancements, the private sector must develop a robust set of security practices, Murray said. 

How HHS has strengthened cybersecurity of hospitals and health care systems

The agency has embraced performance goals, provided resources to small systems and improved coordination, its deputy secretary writes.

Senate bill eyes minimum cybersecurity standards for health care industry

CISA turns to security experts with street cred to protect health sector

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure