Cisco today released it’s 2018 Annual Cybersecurity Report providing a freshly updated view into the current techniques that adversaries use to elude defenses and evade detection, along with insights and recommendations designed to help organizations and users defend against attacks.
The report is based upon a study conducted by Cisco of 3600 Chief Information Security Officers (CISOs) and security industry leaders from 26 countries.
This year’s report findings show a maturing, more sophisticated tradecraft by attackers. Case in point: adversaries are increasingly embracing encryption – meant to enhance security – to conceal command-and-control activity. The Cisco Talos threat research team reports that 50 percent of global web traffic was encrypted as of October 2017, a 12 percent volume increase from November 2016. Cisco also observed a more than threefold increase in encrypted network communication used by inspected malware samples during that time. As the volume of encrypted global web traffic grows, adversaries are broadening their use of encryption as a way to mask command-and-control activity, providing them more time to operate and inflict damage sight-unseen.
The evolution of ransomware was another of the most significant threat developments in 2017. By introducing network-based ransomware worms, attackers have eliminated the need for human interaction in launching ransomware campaigns. They also changed the game from pursuing ransom to the outright destruction of systems, data and operations. We all saw these rapid-moving, network-based attacks with WannaCry and Nyetya, and Cisco expects more automated crypto-worm activity in the year ahead.
The report report spotlights how adversaries are evolving their approaches to exploit new technology security gaps, particularly in IoT devices which are often exposed because they were deployed improperly or left open intentionally for convenience. This includes the growing number of medical devices in hospitals and other healthcare delivery sites, which are often not patched or maintained once purchased.
See the full report for additional perspectives and what defenders can do to to set the security bar higher.
New Zealand Healthcare – Just keeping its head above water. Photo: Hamish Clark.
Securing the delivery of healthcare services in New Zealand faces many of the same challenges as in other mixed public / private health systems. Chronic under-funding of the public health system by government austerity measures is putting pressure on a system already overloaded. Net immigration to New Zealand is combining with a rapidly aging population that is living longer, and contributing to increased patient numbers and demand for services. Hospital administrators have been forced to make tough decisions to prioritize what little resources are available to only the most critical of patients. The result is that many elective surgeries especially for the elderly are in decline and little funding remains to secure and defend hospitals from cyber attack.
As a result of the crisis in the public health system and waitlists approaching a year for patients requiring surgery, those who can afford it, are switching to private healthcare delivery and health insurance. The overall percentage of healthcare services delivered via the New Zealand public system has consequently dropped to roughly 75%. A growth in private care is picking up the rest.
Could New Zealand’s Health System come crashing down? Photo: Lindsey Costa.
New Zealand spends roughly a third of the per-capita expenditure on health compared with the United States. Despite this, healthcare in the country is still quite inefficient and heavily reliant upon legacy models of care, including more expensive hospital treatment. A fragmented and decentralized system of twenty District Health Boards results in repetition and duplication with wasted spending on “unique solutions to common problems”, disparate “stovepipe systems”, and “widely different care paths for common conditions” according to a report by Deloitte.
A lack of national uniform IT and security strategy combines with moribund health IT computer systems across DHBs, and manual labour-intensive work practices by doctors and nurses to compound inefficiencies.
The reality is that much of the national health budget appears to be squandered on administrative overhead. In fact, according to the Deloitte study, “some OECD researchers have estimated that well over 2% of New Zealand’s GDP is wasted on administrative inefficiencies.”
With budget deficits and almost no money to spend on security, an increasing number of people are concerned that the whole system could come crashing down. Cyber attacks on hospitals and primary care facilities in other countries have massively damaged already fragile health systems. Attacks have caused further delays to patients awaiting treatment and life sustaining operations. If nothing changes, then the same fate may befall New Zealand one day soon.
But the security problem is not just one of sufficient funding, its also a one of prioritization and implementation of recommendations. The British National Health Service has many similarities to the New Zealand health model and is also chronically starved of resources. Out of date and out of support computer systems, combine with fragmented NHS Trusts to result in security vulnerabilities left unremediated, leaving much of the system open to attack when WannaCry struck in May last year.
According to the UK National Audit Office (NAO) more than a third of trusts in England were disrupted by the WannaCry ransomware, and at least 6,900 NHS appointments were cancelled as a result of the attack, 139 of which were considered urgent. NHS England data shows that at least 80 out of 236 trusts were affected – with 34 infected and locked out of devices. A further 603 primary care and other NHS organizations were infected by WannaCry, including 8 per cent of GP practices (595 out of 7,454). No information has been published on the larger impact of the NHS outage including reduced patient outcomes or increased mortality, but one can only surmise that despite the best efforts of care givers, some patients were significantly impacted by the NHS’s lack of security preparations.
The attack breached NHS Digital via open SMB holes in NHS firewalls and then spread quickly through thousands of un-patched Windows machines. Most infected systems ran Windows 7, but some 18% of systems were still running the no-longer supported Windows XP operating system, which went End of Life in April 2014, some 3 years earlier!
Securing healthcare delivery is not something that can be left on the side lines till next year, to a new budget, or a new administration. The potential impact on the population of a major cyber attack is too great. With the British NHS debacle as a recent example of what can happen if security is ignored, the New Zealand Ministry of Health needs to act now – before its too late!
New Zealand Healthcare steams forward with minimal security. Photo: Stephen Crowley.
