The headlines read like a hit report. Cyberattacks targeting hospitals and health systems are becoming almost daily events with 9 out of 10 providers providers indicating that they have been the victim of an attack in the past two years. Healthcare finds itself between the crosshairs due to what the The Washington Post noted as having “lucrative personal information and insurance records for criminals”.
While attacks have increased, security has not kept pace. Recent breaches that have spread globally should be a wake-up call. Consider the damage caused by NotPetya and WannaCry just this past year. Major health systems were disabled, forcing them to postpone patient procedures and leaving them with little to no access to critical information.
Exposing the weak links
Although security can never be 100% foolproof, it’s important that those involved understand where the greatest vulnerabilities exist, and pinpoint likely targets for future attacks.
One such area that requires careful scrutiny is the growing and diverse pool of healthcare applications. The race to glean more insight from medical data has led to fever-pitched release cycles for apps. In haste, security is often an afterthought, resulting in backdoor access points for hackers.
“malware also preys on older devices and software with easily exploitable flaws…”
– 2016 SecurityScorecard Annual Report
But security is not just a problem for new applications. As SecurityScorecard’s 2016 annual report points out, “malware also preys on older devices and software with easily exploitable flaws.” Well-established healthcare organizations, especially those with legacy systems, are at risk. Even many EMR platforms fall short. In fact, a recent CHIME/KLAS benchmarking report shows that security is not a high priority for many EMR vendors, most of whom focus more on compliance with federal regulations than on needed built-in security measures. In fact, many security professionals are “underwhelmed by their EMR (electronic medical record) vendors’ focus and strategy around security.”
Health IT needs support
According to the Health Care Industry Cybersecurity Task Force, healthcare’s security posture needs to change. Beyond an industry-wide approach where vendors, regulatory agencies and providers work together to distribute risk, it is also critical that there be a change in how security is handled from an operational standpoint.
The onus to fill all these gaps is falling on an already taxed health IT department—one that is also having to deal with limited manpower, budget cuts, and an exponentially growing landscape of connected devices, apps and systems. In short, healthcare IT can’t keep up with security while also keeping everything else in the organization running properly.
Likewise, healthcare organizations can’t afford to hire enough IT security specialists to address threats manually. Imagine trying to keep a vigilant eye on all the apps (old and new) used in healthcare today.
IT needs help in being able to effectively conduct detection and response control.
Sharing the responsibility using intent-based application security
Enter in intent-based application security. Starting in application development, an automated security system could monitor apps and defend against threats without needlessly taxing IT staff. App security can happen behind the scenes so that the IT department can work without getting bogged down with searching for threats.
Instead of looking specifically for known threats or suspicious behavior that might indicate a threat, intent-based application security focuses on understanding the intended state of an application and looking for unauthorized changes to that state. Think of this process as a form of whitelisting but with more intelligence and context.
When malware compromises an app, the app’s operational state changes. While the developer who built the application could possibly identify the changed state, IT would be hard-pressed to do the same. But by building a bridge between application development and security, apps can be profiled so that their intended states are known. Any deviation would make them suspicious to the security system, which could then take action to protect the healthcare network. This kind of automated app security would also increase the visibility of app states so that the IT department can better understand what is happening within the organization’s network.
Keep application security front of mind, all the time
VMware is developing a new type of intent-based detection and response to protect applications running in virtualized and cloud environments. App development and security teams will be able to build a deeper level of least privilege across the data center, making security an inherent part of the applications that drive innovation. By injecting security into the application development lifecycle, security is no longer an afterthought. Automated detection and response will expand on the preventative model of Zero Trust by addressing potentially compromised workloads immediately when paired with VMware NSX. Fewer alerts and more actionable context will help IT’s ability to focus on better prevention and streamlined remediation.
Ultimately, intent-based security promises to improve IT’s operational efficiency and consequently its ability to support healthcare. Hackers aren’t giving up, so let’s start using the best weapons we have in this fight.
Christopher Logan serves as Senior Healthcare Strategist for VMware.
