I'm Mary-Ann Kobasek McGee, Executive Editor at Information Security Media Group. Today I'm speaking with Faroos Rufik, a cyber risk consultant at Security Consulting and Research firm, Embersek. Faroos will be discussing some of the top cybersecurity challenges involving healthcare IT, operational technology, and supply chains in the face of the COVID-19 pandemic. So, Faroos, for starters, how and why are manufacturing facilities and hospitals vulnerable to attacks on operational technology, networks consisting of physical access control systems, lighting and HVAC, what kinds of equipment and data is most at risk at these facilities these days?
Well, Mary-Ann, hospitals and manufacturing facilities, they have a lot of systems that are in common. They have general business systems, they have mission critical systems, and they also have a lot of the underlying operational technology systems that the entire facility relies on. And a cyber attack on the business systems or the operational technology systems can be devastating or can bring business to a standstill. And especially in the current situation, the global ongoing pandemic, this can easily and quickly result into casualties for patients that are relying on these facilities.
And just to give you an idea, we've had several attacks that have been recorded in the past. Just in March of this year, a hospital in the Czech Republic suffered a cyber attack, a ransomware outbreak actually, and it took a lot of their IT systems offline and impacted their COVID-19 response capabilities, and they even had to move patients to other hospitals as a result. In the past, we've also had pharmaceutical manufacturing facilities fall prey to ransomware, and they've had adverse results such as causing downtime in the manufacturing process, which easily results into a loss of revenue. And as you can imagine, manufacturing facilities coming to a standstill can get very expensive, very fast.
So for us, with that said, where are the weak points parts of these networks that the hackers are taking advantage of? Well, when it comes to critical infrastructure, the threat actors typically rely within the nation's state level and organized crime level actors. And a lot of the recent cases that we've been seeing, whether they're hospitals, whether they're manufacturing facilities, we are seeing an outbreak of ransomware. And most often, the ransomware will typically source from a phishing attempt, an email phishing attempt, that unsuspecting workers will open up, and they'll view and open up emails that masquerade themselves as legitimate emails from legitimate organizations that you and I are well familiar with, and also perhaps trust, for example, the Red Cross, for example, the CDC or the Health and Human Services.
And so these spear phishing emails are accidentally or perhaps, unsurprisingly, opened up by a lot of the healthcare workers, a lot of the workers at these manufacturing facilities, and they will perhaps download a file or perhaps be redirected to a malicious website. And this has been the primary source of attacks and cyber attacks for at least the last two to three years. So malware outbreaks would be one of the top sources of cyber attacks recently. So Farus, what about the security of embedded systems in medical equipment and supplies, you know, especially some of these supplies and equipment that are in high demand, but in short supply, such as ventilators?
So this is actually a very interesting case. So just due to the pandemic situation globally, as we're all aware, a lot of manufacturing facilities that were previously manufacturing components for cars and manufacturing cars themselves are switching over to manufacturing and helping out a lot of the healthcare and hospitals needs. So they're manufacturing a lot of medical devices. And oftentimes, a lot of medical devices nowadays are no longer just mechanical machines.
They oftentimes will have embedded systems engineered into the system itself. These embedded systems also pose their unique challenges. So case in point, in October of last year, a security company by the name Armus, they actually publicized some research and they titled their research, Urgent 11, pretty well known. And it was quite well publicized and still very much so visible in the security community.
The Urgent 11 vulnerabilities found a lot of vulnerabilities affecting embedded systems and operating systems that actually powered the embedded systems themselves. And the byproduct of a lot of the vulnerabilities that were found on a lot of these embedded systems were affecting imaging systems, infusion pumps, and station machines, for example. And the vulnerabilities, the underlying vulnerabilities that were found would allow an attacker remote access, modification of functions, and denial of service on the medical device themselves. There has been some pretty interesting guidance that have been released by this for securing wires and fusion pumps that can be found online.
But just imagine if a lot of these systems are being rushed to be deployed to hospitals and they rush the manufacturing process themselves, the question that we should be asking is are they performing the adequate level of security testing that ought to be expected in these devices since they are, after all, supporting human life themselves. And the answer to that is most likely not. So for us medical devices, IT systems, patient monitoring systems, they're all connected to the hospital network. What is your advice for both during the security of the network and these devices?
What are some of the key mistakes that organizations need to avoid, especially right now with all the chaos? A lot of times, one of the key challenges is to have a well-staff team of cybersecurity consultants or cybersecurity personnel on staff that are solely responsible for going after remediating a lot of the risks facing these environments. So for a lot of companies and organizations, it may be a great idea, especially in these times, to find a partner that can provide them guidance as it pertains to their IT systems, mission critical business systems as they pertain to patient care and also the supply chain at large, the manufacturing facilities providing them medical devices or even the medication themselves and the manufacturing process underlying it. So partnering with a well-established team of cyber consultants or experts would be a great step considering the shortage of cybersecurity personnel globally.
Second, referencing a lot of the guidance and directives that are available that have been published by the FDA as they pertain to cybersecurity for medical devices, referencing a lot of NIST guidance for securing ICS and OT systems and also primarily a well-referenced guidance document is the IEC 62443 which is well-referenced for OT cybersecurity. And for RUS, there are also temporary health care facilities that are being set up, including tent hospitals and parks, makeshift hospitals and convention centers. What are some of the key cybersecurity concerns that you see potentially with these temporary health care facilities being set up compared to what a traditional healthcare setting would be like to care for these COVID patients? One of the key challenges in a lot of the mobile field hospitals that are being deployed to counter the result of the pandemic, you can almost certainly be sure that the network itself, as it's being configured and deployed for operations, the primary concern here is the operational feasibility of the technology that's deployed within the patient monitoring systems, the ventilators, some of the other perhaps mobile patient monitoring medical equipment, medical devices that are being used in a lot of these field hospitals.
So a lot of times from our past observation, we've seen that a lot of networks, whether they're in these hospital IT networks or the hospital's OT networks, or even the manufacturing facility's ITN OT networks, a common finding across the board is that the network is not hardened, so they will be flat networks that lack a segmentation and so as a result in these field hospitals when they're being deployed, they will most certainly carry over those same characteristics that I just mentioned of deploying a flat network and not really ensuring any of the hardening recommendations that we find in some more mature organizations. Thanks for Ruse, I've been speaking with Varuse Rafiq, I'm Mary Ann Kolbasak-McGhee of Information Security Media Group. Thanks for listening.