I'm Mary Ann Cole-Bazak McGee, Executive Editor at Information Security Media Group, and today I'm speaking with Professor Stanley Mirzwa, Managing Director of the Center for Cybersecurity at Kean University in New Jersey, where he lectures in Foundation in Cybersecurity and Cyber Risk Management Studies in the field of Digital Health, Technology and Cybersecurity, especially in low-resource settings such as public health. Stanley will be discussing the potential cybersecurity and privacy issues, facing public health research and reporting, especially in light of the fast-changing coronavirus situation in the U.S. and globally. So, Stan, the U.S.
and other nations globally are facing a potential pandemic involving coronavirus. There is a great need by public health authorities across the globe to collect, analyze and share data involving patients diagnosed or suspected of having the virus, including perhaps details about where these patients have traveled, whom they've been in contact with potentially and other sorts of details like that. What do you see as some of the potential data security and privacy risks in this situation? Some of the top security and privacy concerns with regard to COVID-19 or the coronavirus that I foresee, especially when it comes to global public health, surround several different segments.
So, the first I'll talk about is clinical trials. In my experience over many years working in technology and cybersecurity in public health, there are activities that take place where one is required in the interest of security and monitoring to introduce something called a site monitor. A site monitor typically in clinical trials and research around issues such as COVID, ensure that a person or team goes out to a site to ensure that standardized operating procedures when it comes to the technology or the trial itself are being followed. There are many, many subtasks that are included in this work, technology as well as items related to security have to take place.
So, with the emergence of coronavirus or COVID-19, it's possible here that there will be less site monitoring visits, which typically, as I said, take place in these trials, and those are performed to eliminate and evaluate proper cybersecurity and technology operations. This could lead to greater cybersecurity vulnerabilities being introduced, not being monitored. So, I would say that right now we're talking about China, there's other countries as well. That is one concern that I would have around these visits that should take place during the site monitoring effort.
The second thing I would also say is there are drug makers today in the US who are involved in clinical trials, some that I'm familiar with, that I've worked with in partnership in other trials related to HIV prevention. They also work on other viral diseases such as Ebola, but they're now embarking on clinical trials to take place primarily in Asian countries and those countries that have high numbers of diagnosed cases. Now, the drug is being tested as we speak in Wuhan, China, the epicenter of the virus, and other companies are actually working on developing vaccines as well. But also from a cybersecurity concern, I would focus a little bit on the data collection in these trials, as I said earlier, around site monitoring and adherence to medication, because that's while you're doing trials, one of the things that are critical is that the participants are adhering to the medication being managed.
And the other thing, which regard to cyber and these trials, I would be a little bit concerned around maintaining confidentiality and integrity of the data collection. For example, is the data and knowledge that is being collected at the trial sites being provided to the drug makers unfettered? If we don't have folks traveling out from, let's say, an organization that's heading up a clinical trial based in the US and they're not going out, are we getting first-hand information? I think that would be a concern.
The third item is the source data. The source data is critical in trials, and where is this source data being saved? Now, the source data could be the data around the trial itself. It could be biomedical data.
It could be adherence and acceptability data. And this is all technical, right? We're saving this. These are technology systems that save the information.
How sure are we that the patient information is being kept private, which is crucial in such a delicate and sensitive issue? So when it comes to this idea around as this evolves, these are some of the current concerns. So, Stan, public health departments always deal with delicate patient information related to contagious diseases and other sensitive health situations. What's different about the coronavirus situation, especially when it comes to privacy and security and data that's being collected, shared, analyzed with public health departments, but then also with the researchers?
It's a little bit different, because in this case, we are tracking, or we're not us, but in country, let's say, in China, they need to track where that is in to travel. Who have they been in contact with? Which buildings they've been in? Which transportation system they've been on.
So, there's lots of different data that's being collected and stored. Now, that is sensitive, private information, certainly probably required in this circumstance, because you need to track in order to make, in this case, they have to make decisions on how to react and manage this crisis I would have some concerns about that sort of data and ensuring that it's being kept private and secure. Should that be leaked or breached somehow? It could be a potential issue for those citizens whose information was captured.
So, on top of those issues, the health care industry is also facing potential challenges involving the supply chain of their systems, their drugs, getting the right drugs, equipment, and other sorts of critical supplies that are needed for this situation quickly. Patients that are sick, people who need tests, people who need medications. With that said, what are some of your top privacy and cybersecurity concerns right now involving the supply chain issues? So, on supply chains, regarding health care in general, if you read the 2019 Verizon Data Breach Report, some of the main concerns brought forward in this report are issues associated with internal actors, right?
These insider threats are their concerns around insider threats. If I think about coronavirus and trust of information, and this could be around supply chain as well, I would have a concern around privilege of use by these internal actors getting access to this information regarding third parties or integrators or supply chain. These are folks that have access already to information and could be manipulated. And I think that is certainly one of the concerns.
I would also bring forward, and this is again from the Data Breach Report. Some of the top concerns around privacy are errors, miscellaneous errors. You know, is this accurately being reported? As I just said, when it comes to privilege use, is there privilege misuse?
Web applications? Are there web applications that are utilized with these third parties or supply chains? And are they being secured and at least monitored? You know, these top three add up to about 81% of the incidents in health IT, miscellaneous errors, privilege, misuse, and web applications.
So, I think I would be concerned about hackers attempting to obtain this data from these health systems, and just try to find perhaps some PII information about those who might be somehow in these systems related to coronavirus. That could certainly create an issue or a motive to approach and maybe make it difficult for the individual. And so, Stan, we've also seen recent ransomware attacks that have been a wake-up call for many healthcare sector entities that are hit by these assaults. Sometimes they've been highly disruptive attacks where organizations haven't been able to access patient records and have had to postpone various patient procedures and just in general have disrupted delivery of patient care.
What are some of the other issues that you see potentially in the coronavirus situation when it comes to business continuity and data? And what should these entities be thinking about right now? You know, you mentioned phishing emails or malware, and let me just start there. The FTC and the SEC here in the U.S.
have put out warnings regarding emails from those claiming to be from the CDC, the Center for Disease Control, or the World Health Organization. There have been emails floating around, and there could be potentially many phishing emails going around. And that is something that I would be concerned about only because some of these emails claim to say they have information that you should be reading and learning about to protect yourself. But when you do open some of these up, got some malware inside.
Some other concerns brought forward around this, you know, when it comes to malware devices, you know, I would foresee ad going around that might be malicious advertisements that you click on that might suggest something around a coronavirus vaccination or a coronavirus email floating around, and I think that could be embedded with some sort of malware. Other things, and this also came from guidelines already set forth, be careful around the requests for donations for the coronavirus efforts, especially if you're being asked to rush some money, gift card, cash. I wouldn't send anything be suspicious of these sorts of claims. And I think I have been doing some research around seniors, elders in our society and how they have been getting targeted with cybersecurity issues or cyber crime.
I would be concerned that they're getting maybe targeted around these as well, because they may, when it comes to coronavirus, if they're immune systems, if it's a press and they're technology users, for example, they're using an iPad or they're on social media, they may click on some of these things a bit more because it's closer to home for them if they have a concern. So it brings forward the fact that, you know, there's ways, very non-technical ways where we can just be aware and alert, situational awareness around coronavirus and cyber is important for many of us and for those around us. Thanks, Stan. I've been speaking to Professor Stan Mirzwap.
I'm Marianne Kolbasak-Migee, the Information Security Media Group. Thanks for listening.