Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top
Published in:
Introduction Read chapter Read first chapter

2019 | OriginalPaper | Chapter

4. Cybersecurity and the Evolutions of Healthcare: Challenges and Threats Behind Its Evolution

Author : Enrico Frumento

Published in: m_Health Current and Future Applications

Publisher: Springer International Publishing

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

Healthcare is among the fields that adopted ICT very early to improve physicians’ work. The digital transformation in healthcare started already some years ago, with the computerization of hospitals. Todays’ healthcare is at the forefront again, as one of the most attacked and profitable areas of exploitation for cybercriminals and cyberterrorists. The overabundance of valuable information, its nature of critical infrastructure and its mobile services, are at the centre of cybercriminals attentions. Besides, patients and physicians, both went through a massive digital transformation; nowadays, healthcare operators and users are highly digitalized and mobile. This evolution influences how, respectively, healthcare operators and patients offer and consume services. The present chapter starts from a presentation of how the modern workforces changed their working paradigms and then introduces the concepts of Hospital 2.0 and patient ecosystem. The chapter also explores the cyberterrorism and cybercrime, present and future threats landscapes, including the mobile health example.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

inform now
previous chapter mHealth Market Exploitation Through the Analysis of the Related Intellectual Property Rights
next chapter A Data Protection Perspective on Training in the mHealth Sector
Footnotes
1
A. VV [1].
 
2
Gartner [2].
 
3
For a definition of usability, see Nielsen [3].
 
4
Canina and Bellavitis [4].
 
5
Talk to my shirt blog [5].
 
6
Crunchwear [6].
 
7
Control Your Mobile Phone or Tablet Directly from Your Brain [7].
 
8
Context-Aware Computing: Context-Awareness [8].
 
9
For additional information, see the concept of data context-aware security [9].
 
10
Mayer et al. [10].
 
11
In this context, we do not differentiate trust and confidence. Trust differs from confidence because it requires a previous engagement on a person’s part, recognizing and accepting that risk exists. This is exactly the type of distinction that exists in the cyberattacks because every user knows that the risk of being hacked exists, but often does not recognize it correctly because of his confidence.
 
12
D2.1 The role of Social Engineering in the evolution of attacks [11].
 
13
World Health Organization [12].
 
14
eHealth Task Force [13].
 
16
Connected technologies will accelerate security threats to healthcare industry [14].
 
17
Cybersecurity and resilience for Smart Hospitals [15].
 
18
It is important to distinguish between the Services and the Ecosystems. ‘Ecosystem’ means a network of integrated services that can interact with each other to offer the user a unique and seamless vision. Centering the vision of health services around the patient naturally leads to seamless servicing (the data are elaborated and accessed through different channels—e.g. mobile—without disruption or differences) and to a stronger control of personal data (which may be accessed through a unified ID).
 
19
Healthcare Sector Report [16].
 
20
Bowman [17].
 
21
Frumento et al. [18].
 
22
The type of Deny-of-Service that are life-threatening is not only those that touch the diagnostic systems but also in general, those that slow down operators: for example, not having access to electronic health records obliges physicians to momentarily change their way of working, slowing down their service.
 
23
FBI Malware warning issued over CryptoWall Ransomware [19].
 
24
Why cybercriminals target healthcare data [20].
 
25
The Need for Increased Investment in Medical Device Security [21].
 
26
Healthcare Breach Report 2017 [22].
 
27
HL7 Data Interfaces in Medical Environments [23].
 
28
Chesla [24].
 
29
Vaas [25].
 
30
Security [26].
 
31
Hospitals in UK National Health Service knocked offline by massive ransomware attack [27].
 
32
H2020 [28].
 
33
AA. VV [29].
 
34
Cybercrime as a business: The digital underground economy [30].
 
35
Samani and Paget [31].
 
36
Kurt et al. [32].
 
39
Higgins [33].
 
40
Ariu et al. [34].
 
41
Ibid. See Footnote 12.
 
42
Ibid. See Footnote 17.
 
43
How modern email phishing attacks have Organizations on the hook [35].
 
44
The Human Factor [36].
 
45
2017 Data Breach Investigations Report 10th Edition [37].
 
46
As an example, see: Frumento [38].
 
47
One recent opportunistic attack that hardly hit the healthcare world was WannaCry. Its incidence was higher than other sectors due to the high number of unpatched machines in hospitals. See for example Mullen [39].
 
48
Defray—New Ransomware Targeting Education and Healthcare Verticals [40].
 
49
The unlocked backdoor to healthcare data [41].
 
50
Damage Control: The Cost of Security Breaches [42].
 
51
Hiltzik and Times [43].
 
52
Anatomy of a healthcare data breach [44].
 
53
Koroneos [45].
 
54
Barney [46].
 
55
A possible definition of Digital Shadow is: ‘A digital shadow, a subset of a digital footprint, consists of exposed personal, technical or organizational information that is often highly confidential, sensitive or proprietary. As well as damaging the brand, a digital shadow can leave your organization vulnerable to corporate espionage and competitive intelligence. Worse still, criminals and hostile groups can exploit a digital shadow to find your organization’s vulnerabilities and launch targeted cyberattacks against them’, see ‘Cyber Situational awareness’, Digital Shadows, 2015. [Online]. Available: http://​bit.​ly/​2wyLMhk.
 
56
Cook [47].
 
57
Federation of European Risk Management Associations (FERMA), ‘Response to the European Commission consultation on the public–private partnership on cybersecurity and possible accompanying measures’, FERMA, 2016 [48].
 
58
Ossola [49].
 
59
Peachey [50].
 
60
Sjouwerman [51].
 
61
See Frumento [52].
 
62
Alton [53].
 
63
Newman [54].
 
64
E.g. Mearian [55].
 
65
As an example, U.K. Hospitals Hit in Widespread Ransomware Attack [56] and Bisson [57].
 
66
As an example, Carpenter [58].
 
67
Technically speaking, the humans are the so-called kill switch of an attack, meaning that without ‘breaking’ of the human layer of security the attack would not spread into the organization.
 
69
Ibid. See Footnote 12.
 
70
Social Engineering 2.0 is the evolution of Social Engineering and its transformation from a limited threat to a crucial threat for the computer security.
 
71
Nadeau [59].
 
72
Korolov [60].
 
73
Allen [61].
 
74
Healthcare security $65 billion market [62].
 
75
For a complete and recent overview look the ‘Report on improving cybersecurity in the healthcare industry’ published by the Healthcare Industry Cybersecurity Task Force, Available: https://​www.​phe.​gov/​preparedness/​planning/​cybertf/​documents/​report2017.​pdf.
 
76
For example see MUSES 7th FWP EU Project (Multiplatform Usable Endpoint Security)–, www.​muses-project.​de.
 
77
NIST published guidance around risks and best practices associated with accessing EHRs via mobile devices in NIST Special Publication 1800-1e DRAFT.
 
78
Catalano [63].
 
79
More than 75 percent of U.S. Adults express concern about security of healthcare data, reveals University of Phoenix survey [64].
 
80
Small healthcare facilities unprepared for a data breach [65].
 
81
See for example the HCISPP (Healthcare Information Security and Privacy Practitioner) [65].
 
82
Immersion effect: ‘a generic telemedicine application should create the user‘s immersion effect that means the physician should only think of his diagnosis without worrying about particular informatics operations that could divert his attention’. Source: Committee on Evaluating Clinical Applications in Medicine. Telemedicine: A guide to assessing Telecommunications in Health Care. Marilyn J Field Editor, Division of Health Care Services.
 
83
The unlocked backdoor to healthcare data [41].
 
84
Security risks of networked medical devices [66].
 
85
Dawson and Omar [67].
 
86
Harrison and White [68].
 
87
Veerasamy et al. [69].
 
88
Several countries created specific departments exclusively dedicated to combat cyberterrorism (e.g. the Cyberterrorism Defense Analysis Center-CDAC—within the US Department of Defense Cyber Command-USCYBERCOM). For a discussion on the state of cyberterrorism refer to the project www.​cyberroad-project.​eu especially the deliverables from D6.1 to D6.6.
 
89
Knudson [70].
 
91
G. V. P. Company [71].
 
92
Peachey [72].
 
93
For example, look the text of the call SU-TDS-02-2018 for project proposals, available at https://​goo.​gl/​xPVKLV.
 
96
Harries and Yellowlees [73].
 
97
ISE [74].
 
98
Franken [75].
 
99
Healthcare industry: Attacks outpacing investments in personnel, education and resources [76].
 
100
Cook and Wall [77].
 
101
For the same discussion, we do not differentiate trust and confidence. Trust differs from confidence because it requires a previous engagement on a person’s part, recognizing and accepting that risk exists. This is exactly the type of distinction that exists in the cyberattacks because every user knows that the risk of being hacked exists, but often does not recognize it correctly because of his confidence.
 
102
Hadnagy [78].
 
103
Gilbert-Lurie [79].
 
104
Chang [80].
 
105
Dachis [81].
 
106
The Human Factor 2018 [82].
 
107
Frumento et al. [83].
 
108
Clayton et al. [84].
 
109
Harley et al. [85].
 
110
See Is cybersecurity awareness a waste of time? [86] and Qin and Burgoon [87].
 
111
Kirlappos and Sasse [88].
 
112
Sjouwerman [89].
 
113
Ibid. Reference in Footnote 106.
 
115
Kerber and Jessop [90].
 
116
Riddle et al. [91].
 
117
Langner [92].
 
118
Crowdturfing is a combination of ‘crowdsourcing’, meaning recruiting large numbers of people to contribute a small effort each towards a big task (like labelling photos), and ‘astroturfing,’ meaning false grassroots support (in the form of bogus reviews or comments, for example. Automated crowdturfing attacks involves many AI-operated profiles, whose intention is to damage the reputation of a brand or person.
 
119
Nakamura [93].
 
120
Bounfour [94].
 
Literature
1.
2.
3.
4.
Canina, M., Bellavitis, A.D.: IndossaMe: il design e le tecnologie indossabili. FrancoAngeli, Milano (2010). (in Italian)
5.
6.
7.
8.
9.
10.
Mayer, R.C., Davis, J.H., Schoorman, F.D.: An Integrative model of organizational trust. Acad Manag Rev 20(3), 709–734 (1995)CrossRef
11.
12.
World Health Organization.: Active Ageing: A Policy Framework. Geneva (2002)
13.
eHealth Health Task Force. Redesigning Health in Europe for 2020. European Union 2012
14.
15.
16.
“Health Care Sector Report. Cyber security for the health care sector”, ECSO, WG3 I Sectoral Demand, March 2018
17.
18.
19.
20.
21.
22.
“Health care Breach Report 2017”, Bitglass
23.
24.
25.
26.
27.
28.
29.
30.
31.
Samani, R., Paget, F.: Cybercrime Exposed—Cybercrime as a Service. McAfee (2014)
32.
33.
Higgins, K.J.: No, The Mafia Doesn’t Own Cybercrime: Study (2018)
34.
Ariu, D., Frumento, E., Fumera, G.: Social engineering 2.0: a foundational work: Invited Paper. In: Proceedings of the computing frontiers conference—CF’17, pp. 319–325 (2017)
35.
36.
37.
38.
Frumento, E.: CopyPhish: a recent case of a successful contextualized phishing attack which resulted in stealing the entire IP of a SME and damaged also their reputation. DOGANA Project (2017). Available http://​bit.​ly/​2wyjF2b [Online]
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
Federation of European Risk Management Associations (FERMA), “Response to the European Commission consultation on the public-private partnership on cybersecurity and possible accompanying measures”, FERMA, 2016
49.
50.
51.
52.
53.
54.
55.
56.
U.K. Hospitals Hit in Widespread Ransomware Attack. Krebs on Security (2018)
57.
Bisson, D.: WannaCryptor Ransomware Strikes NHS Hospitals, Telefonica, and Others. The State of Security (2018)
58.
Carpenter, P.: Chief Strategy Officer at Knowbe4 reported: “Until we harden our people and our systems sufficiently, ransomware will continue to prove successful and gain more momentum. The vector they will continue to use is the human that will click on something or download something”
59.
Nadeau, M.: 5 biggest health care security threats for 2018 (2018). CSO Online [Online]
60.
Korolov, M.: 10 companies that can help you fight phishing. CSO Online (2018)
61.
62.
63.
64.
65.
66.
67.
Dawson, M., Omar, M.: New threats and countermeasures in digital crime and cyber terrorism, 1st edn. IGI Global (2015)
68.
69.
70.
71.
72.
73.
Harries, D., Yellowlees, P.M.: Cyberterrorism: is the U.S. Health care system safe? Telemedicine e-Health 19(1), 61–66 (2013)CrossRef
74.
75.
76.
Health care industry: Attacks outpacing investments in personnel, education and resources. Help Net Security (2018) [Online]
77.
Cook, J., Wall, T.: New work attitude measures of trust, organizational commitment and personal need non-fulfilment. J. Occup. Psychol. 53(1), 39–52 (1980)CrossRef
78.
Hadnagy, C.: Unmasking the social engineer: the human element of security, P. K. F, Ed. Wiley, United States (2014)
79.
Gilbert-Lurie, M.: Are you in a codependent relationship with your phone? Science says the struggle is definitely real. Bustle [Online]
80.
Chang, L.: FOMO is a real thing, and it’s adversely affecting teens on social media. Social Media, Digital Trends (2015)
81.
Dachis, A.: How to plant ideas in someone’s mind. LifeHacker (2014)
82.
83.
Frumento, E., Lucchiari, C., Valori, A., Pravettoni, G.: Cognitive approach for social engineering. DeepSec (2010)
84.
Clayton, R.B., Leshner, G., Almond, A.: The extended iSelf: the impact of iPhone separation on Cognition, emotion, and physiology. J Comput Mediated Commun 20(2), 119–135 (2015)CrossRef
85.
Harley, D., Willems, E., Harley, J.: Teach your children well. ICT Security and the Young Generation. In: Proceedings of virus bulletin conference (2005)
86.
Is cybersecurity awareness a waste of time? New Zealand Reseller News (2018)
87.
Qin T., Burgoon, J.K.: An investigation of Heuristics of human judgment in detecting deception and potential implications in countering social engineering. IEEE Intelligence and Security Informatics (2007)
88.
Kirlappos, I., Sasse, M.A.: Security education against phishing: a modest proposal for a major rethink. IEEE Sec Priv Mag 10(2), 24–32 (2012)CrossRef
89.
Sjouwerman, S.: KnowBe4 reveals industries most at risk of phishing attacks. Blog Knowbe4 (2018)
90.
91.
Riddle, B., Nyman, S., Rees, J.: Estimating the costs of a data breach: an exercise at the new Hampshire state cancer registry (2011)
92.
Langner, R.: To kill a centrifuge. A technical analysis of what Stuxnet’s creators tried to achieve the Langner group. Langner (2013)
93.
Nakamura, L.: A trillion dollars a year in intangible investment and the new economy. In: J.R.M. Hand, B. Lev (eds) Intangible Assets. Oxford University Pres, Oxford (2003)
94.
Bounfour, A.: The Management of Intangibles: The Organisation’s Most Valuable Assets. Routledge, United Kingdom (2003)
Metadata
Title
Cybersecurity and the Evolutions of Healthcare: Challenges and Threats Behind Its Evolution
Author
Enrico Frumento
Copyright Year
2019
Book
m_Health Current and Future Applications

Print ISBN: 978-3-030-02181-8

Electronic ISBN: 978-3-030-02182-5

Copyright Year: 2019

DOI
https://doi.org/10.1007/978-3-030-02182-5_4