Healthcare Security Incident Response Strategy - A Proactive Incident Response (IR) Procedure

Ying He,Cunjin Luo,Leandros Maglaras,Aliyu Aliyu

doi:10.1155/2022/2775249

Abstract

The healthcare information system (HIS) has become a victim of cyberattacks. Traditional ways to handle cyber incidents in healthcare organizations follow a predefined incident response (IR) procedure. However, this procedure is usually reactive, missing the opportunities to foresee danger on the horizon. Cyber threat intelligence (CTI) contains information on emerging attacks and should be ideally utilized to inform the IR procedure. However, current research shows that the IR has not been effectively informed by CTI, especially in healthcare organizations. This paper fills in this gap by proposing a proactive IR response procedure based on the National Institute of Standards and Technology (NIST) IR methodology. This paper then presents the NHS WannaCry case study to demonstrate the use of the proposed IR methodology. We collate cyber security advisories from different CTI sources such as US/UK CERT to protect interconnected systems and devices from Ransomware attacks. This research provides novel insights into the IR in healthcare through embedding CTI advisories into IR processes and concludes that our proposed IR procedure can be used to counteract WannaCry Ransomware using CTI advisories. It has the significance of transforming the way of IR from reactive to proactive using the CTI in healthcare.

Highlights

Cyber security attacks such as Ransomware [1] have caused major incidents to the Critical National Infrastructure (CNI) within various industries, especially in healthcare [2]
We propose the proactive incident response (IR) methodology by mapping the National Institute of Standards and Technology (NIST) IR methodology [12,13] to the extracted Cyber reat Intelligence (CTI) advisories from different sources including US CERT [35,36,37]. and industrial best practices. rough embedding CTI into the IR lifecycle, organisations can benefit from an informed IR with the CTI advisories from different sources. organisations should be able to take this information and map it to their own IR processes to enhance their networks, systems and applications security against potential attacks
CTI contains knowledge of impending attacks, such as threat vectors, threat actors, victims profiles, courses of action, etc. and is shared via different CTI platforms such as UK/US Cert, Microsoft, MISP, and MITRE, with the intention to create a proactive line of cyber defense and should be ideally used to inform incident response, there is limited research in applying CTI into IR especially in healthcare

Summary

Introduction

Cyber security attacks such as Ransomware [1] have caused major incidents to the Critical National Infrastructure (CNI) within various industries, especially in healthcare [2]. Traditional ways to handle adverse events in healthcare organizations follow a predefined incident response (IR) procedure, which includes preparation, detection and analysis, containment, eradication, and recovery, and postincident activities [12,13,14]. 2. RELATED WORK is session introduces related work in cyber threat intelligence (CTI), security incident response (IR), and Ransomware. Tactical reat Intelligence provides details on the threat actors, their tools, and methodologies, which is known as the Tactics, Techniques, and Procedures (TTPs) [27] It is consumed by architects, internet administrators, security analysts, etc. It sets about creating encrypted copies of files on the victim’s computer, and deleting the originals, leaving the victim with only the encrypted copies, which cannot be accessed without a decryption key

Proactive IR Methodology

Findings

Conclusions