Исследование критической уязвимости сервиса аутентификации и последствий для медицинских учреждений, относящихся к субъектам критической информационной инфраструктуры

Abstract

Relevance. The functionality of malware has grown exponentially in recent years. There are more and more ways in which attackers can gain access to secret or personal data, as well as information stored in critical information infrastructure, including those related to the healthcare sector, but the consequences of attacks on such objects lead to serious consequences. A striking example is the leak of data to the public from the database of the unified dispatch service of the Lipetsk Region, which contained a lot of information about the patient, including their full name and address. Purpose. Investigation of the vulnerability BDU:2022-05212, which allows an attacker to gain full rights to the infrastructure. On the basis of the research done, to study the principles of operation of this vulnerability, as well as classify it and identify the consequences for CII objects. Make a list of measures necessary to ensure security against attacks of this kind. Material and methods. This article describes how to gain unauthorized access through the CAS administrative interface by calling the URL on the page that is used to install the default on the server and create the first administrator user. As well as an experimental study of this vulnerability, methods for its detection and consequences for CII subjects was carried out. Results. In accordance with the Federal Law of July 26, 2017 Nо. 187-FZ, definitions are considered that allow classifying information systems in the field of health care as CII and consider an actual example of data leakage in this area due to the vulnerability of the CAS server at the network level. The article also discusses the basics of the CAS server, compiled a vulnerability classification table BDU:2022-05212, and indicated the basic vulnerability vector metric according to the FSTEC standards. The conclusion in this article is based on how to protect against this vulnerability, as well as recommendations for resolving the problem if the attack has already been committed before. The results of the study will improve the level of authentication security in web applications and sites using CAS server technologies, organizations operating in the banking sector, as well as in the healthcare sector related to CII. Conclusion. The article puts the key – the security of the infrastructure of subjects of critical information infrastructure in the field of healthcare. This article will be useful for employees of the information security department working with CII objects, especially those operating in healthcare, banking, and other areas of the financial market. Keywords:critical information infrastructure protection, information security, healthcare industry, vulnerabilities, infotelecommunications