Feature | Cybersecurity | May 06, 2019| Maxim Chernyak

How to Protect Health Data With Security Testing Automation

According to the National Association of County and City Health Officials, only 33 percent of the organizations plan against cybersecurity threats and initiate patient identity protection protocols.

According to the National Association of County and City Health Officials, only 33 percent of the organizations plan against cybersecurity threats and initiate patient identity protection protocols. 

As the National Association of County and City Health Officials state, healthcare breaches remained to be costly and disastrous for the organizations in 2018. Each patient record exposure can cost up to $400, and hackers always try to access the medical information of hundreds of thousands of patients at once. Meanwhile, the National Association also notes that only 33 percent of the organizations plan against cybersecurity threats and initiate patient identity protection protocols. 

 

Cybersecuity Threats Rolling Over Into 2019

Certainly, 2019 will only add fuel to the fire. Some of the most expected healthcare cybersecurity threats for this year are associated with increased personalization and selectivity, as well as social engineering. In particular, the trends lean toward malicious actors exploiting increasingly blurred boundaries between professional and personal activities. When people use their work accounts for accessing personal resources or follow the bring-your-own-device (BYOD) policy without precautions, it may lead to accidental data exposure or offer hackers a gateway into the individual’s workplace network.

Additionally, phishing is expected to become an even more advanced hacking approach, with scammers tuning up their emails and messages with the person’s information available from ad preferences and social media presence. We also should not forget about the ever-rising tide of identity thefts, when hackers access social security numbers and credit card data of their victims. 

This increased focus on personalization in healthcare cybersecurity threats puts the majority of healthcare organizations in even higher danger. Apart from the direct and blunt software attacks, hackers will target the human factor as well, trying to violate data from the inside. If the providers are unable to defend themselves even at a basic level, they will not be able to allocate resources for further planning and mitigation of emerging threats. 

So, the first step towards avoiding patient data breaches and cutting on settlement fines should be eliminating the known threats and system vulnerabilities regularly with the help of security testing automation. Testing automation brings in a major advantage for ensuring a provider’s infrastructure security. It tackles the basics, defining the most probable bottlenecks in different components of a single system as well as detecting integration loopholes between disparate applications and platforms.

Testing automation does not offer a silver bullet for the healthcare system security assurance and should go together with other testing techniques for more efficiency. However, it can cross out the known vulnerabilities to spare security testers’ time on exploratory testing and mitigating up-and-coming threats. 

Below is an example of a roadmap for successful security testing automation. It shows possible applications, limitations, and processes beyond automated security tests.

 

Starting From a Thorough Health IT Asset Survey

Healthcare organizations’ internal IT infrastructures are systems with many elements, and each should be identified prior to testing automation. This inventory includes not only PCs, storage, servers, and installed software, but also corporate (or personal in case of BYOD) mobile devices, and medical devices too. 
Mapping and understanding these physical assets, their location, purpose, and applications they run, security specialists can evaluate the risks and prioritize their testing activities. 
Each asset’s risk can fall into one of the categories: 
   • Components (OS, firmware, patches, external applications) 
   • System-wide changes
   • New software configuration errors 

Risk categorization allows organizations both to find and focus on the most pressing vulnerabilities. It also helps to navigate across more common problems in healthcare software security, such as unpatched OS, poor authentication, inadequate security protocols, weak passwords and more.
Although quite trivial, these vulnerabilities might be the first target for hackers. Knowing that healthcare organizations can lack strong security policies in place, cybercriminals can resort to simpler attacks and still succeed in unauthorized data access. On the other hand, security testing specialists can automate continuous scanning and even eliminate such vulnerabilities. 

 

Automating Cyber Security Tests

Based on the defined risks, security testing specialists can then segment the tasks for testing automation into functional, non-functional, application and infrastructure security scanning, as well as application logic testing groups. The testing teams can also define the success criteria to ensure that critical vulnerabilities are addressed in a way that benefits the organization in question.

One of the best practices implies that each application assigned for testing automation can be broken down into functions. This approach offers substantial application test coverage and helps to identify different vulnerabilities more effectively. Furthermore, security testing specialists can range the found vulnerabilities according to their severity and plan for fixes accordingly, either in a single upgrade or through multiple patches.

Launching Mock Cyber Attacks

While the series of automated tests helps to reveal vulnerabilities in certain system components, it still cannot ensure that the whole system will withstand a possible breach. To make sure that malignant activities do not lead to data exposure or theft, security testing specialists should initiate a mock-attack. It often focuses on such security basics as SQL injections, URL redirects, and open ports in the firewall.

Security testing teams should also identify sensitive systems, which can disrupt care delivery in case of an attack. Such systems can be devices related to acute patient care or surgery, for example, anesthesia monitors or dialysis machines. Depending on their sensitivity, such applications or physical assets should be accessed with limitations, or should not be targeted during the mock-attack at all to ensure patient safety.

Mock-attacks should be repeated from time to time to cover emerging vulnerabilities with system updates, new applications and devices. Certainly, they should be automated to save time and effort. This way, security testing specialists will be able to create a case scenario and then just tweak it to cover more variables instead of manually repeating the full processes. 

 

Beyond Security Testing Automation 

Once they are done with infrastructure security testing automation, security testers will get a whole knowledge base of the organization’s vulnerabilities, their range and severity. This information can be used as a foundation for further automation, such as for:

   • Security workflows
   • Continuous security monitoring tools   

   • Threat detection for preventing breaches

   • Threat response

Best practices of care delivery keep changing, so health IT systems support flexible updates and upgrades by default. Yet, each new component in such a system creates both a promise and a potential vulnerability. Therefore, security testing should be considered an ongoing process to be enhanced, tweaked and repeated regularly. 

Certainly, providers should consider using manual testing tools to explore upcoming threats and complement their automated testing results, occasionally shifting their focus between different activities. Only by staying flexible can healthcare organizations protect themselves both from basic and more advanced threats. 

 

Editor’s note: The author, Maxim Chernyak, is a head of test automation and performance testing lab at A1QA, an expert in test automation methodologies and tools for functional and nonfunctional testing. Accountable for the education and adoption of state-of-the-art quality engineering practices by QA teams.

Related Content

An example of a coronary computed tomography angiography (CCTA) exam. The CIAO study looked at patients who have a problem of blood flow limitation and chest pain symptoms in the absence of a 50 percent or more artery narrowing, known as ischemia with no obstructive CAD, or INOCA.

An example of a coronary computed tomography angiography (CCTA) exam. The CIAO study looked at patients who have a problem of blood flow limitation and chest pain symptoms in the absence of a 50 percent or more artery narrowing, known as ischemia with no obstructive CAD, or INOCA.

News | Cardiac Imaging | April 03, 2020
April 3, 2020 — Patients who experience chest pain and have abnormal results on a cardiac stress test but who do not
Schematic depiction of the automated process for assessing fat, muscle, liver, aortic calcification, and bone from original abdominal CT scan data

Figure 1: Depiction of the fully automated CT biomarkers tools used in this study. (A) Schematic depiction of the automated process for assessing fat, muscle, liver, aortic calcification, and bone from original abdominal CT scan data. (B) Case example in an asymptomatic 52-year-old man undergoing CT for colorectal cancer screening. At the time of CT screening, he had a body-mass index of 27·3 and Framingham risk score of 5% (low risk). However, several CT-based metabolic markers were indicative of underlying disease. Multivariate Cox model prediction based on these three CT-based results put the risk of cardiovascular event at 19% within 2 years, at 40% within 5 years, and at 67% within 10 years, and the risk of death at 4% within 2 years, 11% within 5 years, and 27% within 10 years. At longitudinal clinical follow-up, the patient suffered an acute myocardial infarction 3 years after this initial CT and died 12 years after CT at the age of 64 years. (C) Contrast-enhanced CT performed 7 months before death for minor trauma was interpreted as negative but does show significant progression of vascular calcification, visceral fat, and hepatic steatosis. HU=Hounsfield units.

News | Cardiac Imaging | March 06, 2020
March 6, 2020 — Researchers at the National Institutes of Health a
ASNC Announces Multisocietal Cardiac Amyloidosis Imaging Consensus
News | Cardiac Imaging | September 09, 2019
The American Society of Nuclear Cardiology (ASNC) published a new expert consensus document along with eight other...
Philips Debuts Cardiac Ultrasound and Enterprise Informatics Offerings at ESC 2019
News | Cardiac Imaging | August 30, 2019
Philips will showcase its latest cardiac care innovations at the European Society of Cardiology (ESC) Congress 2019,...
A high-fidelity 3-D tractography of the left ventricle heart muscle fibers of a mouse

Figure 1. A high-fidelity 3-D tractography of the left ventricle heart muscle fibers of a mouse from Amsterdam Ph.D. researcher Gustav Strijkers.

News | Cardiac Imaging | June 07, 2019
The Amsterdam University Medical Center has won MR Solutions’ Image of the Year 2019 award for the best molecular...
At #ACC.19, Siemens unveiled a version of its go.Top platform optimized for cardiovascular imaging. The newly packaged scanner can generate the data needed to do CT-based FFR (fractional flow reserve).

At #ACC.19, Siemens unveiled a version of its go.Top platform optimized for cardiovascular imaging. The newly packaged scanner can generate the data needed to do CT-based FFR (fractional flow reserve). Photo by Greg Freiherr

Feature | Cardiac Imaging | March 22, 2019 | By Greg Freiherr
Reflecting a trend toward the increased use of ...
SyncVision iFR Co-registration from Philips Healthcare maps iFR pressure readings onto angiogram.

SyncVision iFR Co-registration from Philips Healthcare maps iFR pressure readings onto angiogram. Results from an international study presented at #ACC19 show that pressure readings in coronary arteries may identify locations of stenoses remaining after cardiac cath interventions.

Feature | Cardiac Imaging | March 18, 2019 | By Greg Freiherr
As many as one in four patients who undergo cath lab interventions can benefit from a technology that identifies the