Cyber-Security Issues in Healthcare Information Technology

Abstract

In 1999–2003, SIIM (then SCAR) sponsored the creation of several special topic Primers, one of which was concerned with computer security. About the same time, a multi-society collaboration authored an ACR Guideline with a similar plot; the latter has recently been updated. The motivation for these efforts was the launch of Health Information Portability and Accountability Act (HIPAA). That legislation directed care providers to enable the portability of patient medical records across authorized medical centers, while simultaneously protecting patient confidentiality among unauthorized agents. These policy requirements resulted in the creation of numerous technical solutions which the above documents described. While the mathematical concepts and algorithms in those papers are as valid today as they were then, recent increases in the complexity of computer criminal applications (and defensive countermeasures) and the pervasiveness of Internet connected devices have raised the bar. This work examines how a medical center can adapt to these evolving threats.

Appendix A

To preserve readability, the body of this paper glossed over many details; for those inclined, this Appendix (and the following Glossary) address some of them. For a solid grounding on the topic of cryptography and encryption, the reader is directed to [26]. As mentioned in the section on “White Hat—Motivations” there are six goals the White Hat has to address. Of those, three are fully addressed by encryption and hashing: Authentication, Data Privacy, and Data Integrity. The other three areas (audits, authorization and reliability, and performance) will be addressed in turn.

Audits

As mentioned previously, auditing involves several categories of things to audit. Auditing devices means knowing what devices are on the network, what they do, and who they talk to. These points can be solved with numerous tools [27]. Auditing Users typically means looking at a time window of applications and data they used, and this is typically addressed by looking at HIPAA audit logs. Auditing of cyber-security policies and procedures should be done at least annually to see what is working, what is not, and with an eye to close that gap. Finally, network auditing should be done continuously and automatically to restrict network access to known agents (e.g., Cisco Firepower and ISE, Cisco Systems Inc, San Jose, CA).

Authorization

Authorization relies on tying a User or group of Users to a role, and defining access privileges for resources to that role. For example, members of the Finance Department would have access to the finance folder on the network, but other Users would not. As such, authorization depends critically on accurate authentication. In modern computing systems (i.e., Microsoft environments, Microsoft Corporation Redmond WA), the two areas are linked using a protocol based on LDAP (Lightweight Directory Access Protocol) [28].

Reliability and Performance

As mentioned before, not all service failures are due to Black Hats. The White Hats are also expected to maintain service uptime, at acceptable performance, in the face of hardware, software, and Acts of God failures. The methods for maintaining application uptime are referred to High Availability and are aimed at avoiding single points of failure. The methods to assure that data are never lost are referred to Disaster Recovery. The combination of methods to maintain both application and data availability are referred to as Business Continuity [29].

Authentication, Data Privacy, and Data Integrity

Encryption helps:

authentication, data privacy, and data integrity (non-repudiation)

First consider data confidentiality. The goal is to transfer the “clear text” of the message (say “Patient Name Richard Nixon”) to some cipher-text like “sgsgsdfWE%#%@#$F.” The exact mechanics of the encryption process vary from algorithm to algorithm, but the bottom line is that without the right key(s), non-authorized Users cannot read the message. Tools exist to perform such encryption over the Internet as data is transferred [30]. They also exist to encrypt data at rest on a server [31]. Authentication and non-repudiation make use of both encryption and “hashing” as we will now see.

Hashing helps:

authentication and data integrity (digital signing and non-repudiation)

A reversible encryption algorithm can be used to secure a message from prying eyes. However, the recipient of the message has no way of knowing the absolute identity of the person who sent a message or that the message arrived uncorrupted. With a combination of public key encryption and a process known as “hashing,” all these ends can be achieved.

A hash is a one-way, irreversible process guaranteed to generate a unique number for a unique data input. The importance of this process is that any change to the text document will result in a new value from the hashing algorithm. The two different values (called message digests “MDs”) indicate that the input text has been changed. However, even this is not enough. If an enterprising Black Hat can intercept a message, they may well recompute the MD themselves and send it along with a modified document to the intended User. The User checks the sent MD against the MD they compute from the received message, finds that the numbers match, and has no way of detecting the modification.

This is where digital signing enters the picture. The real author computes the MD and encrypts it (in effect signing it) with their private key. If an intermediate Black Hat intercepts the message, throws out the real MD, falsifies the message, and supplies their own MD, the recipient will not be able to decode the MD with the public key from the presumed author. If the intended recipient User has faith that their public key is correct for the intended author, they will know that something is wrong (see Fig. 1). A side benefit of digital signing is that a document, once digitally signed, can only be repudiated by the signer by claiming one of two things: either that their private key has been stolen or that the public key claimed to be theirs has been forged by Black Hats. The latter argument is mitigated by the existence of trusted third-party PKI certifying authorities (e.g., Entrust DataCard, Entrust Inc., Minneapolis, MN).

Fig. 1

(A) X sends a message, and it is altered by M. Y cannot discern the alteration. (B) X computes the document’s message digest (MD) and sends its value (1003) with the document. M alters the message. Y recomputes the MD of the message and detects an alteration, because the MDs do not match (957 ≠ 1003). (C) This time, M recomputes the MD and sends it with the altered message. Now when Y recomputes the MD and checks against the sent MD, the two match, and Y is fooled. (D) X digitally signs the MD, and M cannot reproduce X’s signature without X’s private key. Nevertheless, M alters the message. When Y decodes the MD signed by X and compares it with the recomputed MD of the altered message, Y detects the substitution (957 ≠ 1003)

Glossary

Authentication

Is the agent who they claim to be

Authorization

Does the agent have rights to the resource

Confidentiality (data)

Is data secure from the eyes of unintended agents

Cyphertext

The encrypted version of an unencoded “clear” text

Denial of service

An attack that incapacitates a service running on a computer

Encryption

A reversible process to converts a clear text message that can be read by anyone into a cipher-text message that can be read by no one, unless they possess the decryption key(s).

Firewall

A device that contains two network cards on two different networks, and uses a rule base to select what data is passed through and in what direction

Hashing

An algorithm to generate a unique value from a unique text input

Integrity (Data)

Is data unaltered from its original sent state

Internet

The big “I” internet is the world wide network connecting the millions of private local area networks.

Local Area Network

Generally applied to a local Ethernet subnet where all computers have the same address suffix (i.e. xxx.corporationX.com)

Non-repudiation

Can an agent send/alter a message, then later deny having sent/altered it

One/two-factor authentication

One factor authentication may require only one piece of data, perhaps a password. Two factor methods use an additional item, perhaps a biometric (fingerprint, voice, etc.) to perform authentication.

Public Key Infrastructure

A trusted means of distributing individual’s public keys. Required in a large scale implementation of a public key encryption system.

Reliability

Is a service or system available and accurate when needed

Sniffing

Using a network interface card in a promiscuous mode to capture all data on the network, even if it is not meant for the local machine

Spoofing

Faking the Internet address of packets emanating from one’s computer so as to assume the identity of another computer and hide one’s true identity

Switched networks

As opposed to shared networks (which act like a party line in the telephone world), switched networks create private links momentarily between computers

Tripwire

A program that can detect intruder’s changes to a computer system’s critical files

Trojan Horse

A program that masquerades as something benign but actually contains Malware.

Virtual Private Network

A method of encrypting data passed on the open Internet so it is as if the users share a private link