Cybersecurity is again in the headlines as a result of the most recent global-spanning cyberattack named Petya and its multiple variants. This was not a typical ransomware attack, but disguised to hide its true purpose of data destruction—hence referred to as wiperware. The attack utilized sophisticated techniques to spread built-in system tools to gain credentials. After gaining users credentials, the wiperware targeted other network devices to spread and encrypt them, making them unusable. There was a unique delivery mechanism used for delivery which included infecting an accounting company’s update servers to allow rapid propagation to its clients. There are multiple lessons learned here, including improving patch management, having a good backup and retention program, securing and locking down network devices, and controlling access privileges to built-in tools.
This, and the other recent cyber incidents, have highlighted the importance of increased engagement and need for cybersecurity threat information-sharing amongst various organization’s and stakeholders in healthcare. The community engagement will not only help increase awareness, but also help prevent the spread and impact of such attacks in the future. Since cybersecurity is a shared responsibility between multiple organizations, the engagement needs to involve a multitude of stakeholders, ranging from both the public and private sector. Some of the stakeholder organizations include government entities like the Food and Drug Administration (FDA), Department of Health and Human Services (HHS), and the Department of Homeland Security, as well as information security organizations, vendors (including medical device manufacturers), non-profit associations like ABC and AABB, and, most importantly, the healthcare delivery organizations and their information security practitioners. Government organizations, such as HHS and FDA, have already started engaging with our industry through various mediums, including workshops and guidance on medical device security, conference calls during threat events, as well as collaboration through the National Health Information Sharing & Analysis Center. It is time for blood centers to utilize these forums to demonstrate our engagement by actively participating and sharing our unique challenges and limitations. As mentioned previously, blood centers play a critical role in healthcare industry by maintaining the blood products supply chain in the country and it is time for us to embrace and engage in cybersecurity discussions as part of critical infrastructure.
Along with information sharing, there is also a need amongst the blood industry to share knowledge regarding cybersecurity best practices including tools, techniques, and programs that help maintain solid information security posture at the blood centers. Keeping this in mind the ABC planning committees have decided to make cybersecurity a critical topic of discussion at the joint ABC Finance & IT Workshop to be held in Houston, Texas, on September 27 to 28. Since cybersecurity is everyone’s responsibility and knowledge is power, we welcome our fellow IT and security practitioners to share and attend the event.
Sameer Ughade; Director, Information Technology & Business Intelligence