Cybercriminals have stepped up their game during the pandemic, launching ransomware attacks at a frenzied pace. In 2020, more than 90 U.S. healthcare organizations reported ransomware attacks, which affected over 600 separate clinics, hospitals and organizations and 18 million-plus patient records.

Ransomware attacks typically happen when hackers gain access to secure systems and encrypt files using malware, locking out the rightful owner. Access can be obtained using something as simple as an innocent-looking link in an email or by leaving a password in the wrong place. The cybercriminals will demand money to decrypt the files and also to prevent publication of sensitive data.

Hospitals that lose access to their databases will find themselves in a bind. They might have to   turn away patients needing care, or delay treatment. If hospitals lose access to lifesaving devices like ventilators and dialysis machines, particularly while in use, the consequences can be deadly.

Businesses without adequate disaster recovery and backup plans are effectively forced to pay the ransom.

The threat to the healthcare and public health sector is so great that in October 2020, the Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, and the Department of Health and Human Services (HHS) jointly released an advisory describing the “tactics, techniques, and procedures” cybercriminals use against targets in this sector to infect systems with ransomware for financial gain.¹

The FDA has taken notice also, appointing an acting director of cybersecurity to enhance supervision of approvals for medical devices – essential as modern medical devices running complex software can be used as entry points into hospital networks. As other ways to infiltrate systems close down, cybercriminals look for easier ways to gain access.

Hospitals are appealing targets
Though ransomware attacks have been a threat to businesses and government agencies for many years, prior to 2016 healthcare organizations were not considered primary targets.² But that has certainly changed. Attacks targeting healthcare systems escalated during the pandemic because hospitals in particular have become easy targets. One key reason relates to hospitals’ rapid adoption of information technology. That would seem like a positive – better technology can improve care. But, most healthcare organizations have expanded their reliance on IT without also expanding their IT support staff.

(This expansion happened largely in response to Meaningful Use program incentives, which encouraged healthcare organizations to use EHR, or electronic health records. In 2008, EHR utilization was just 9.4%. By 2016 it was 96.9%.)³

© ICS | https://www.ics.com/

What can healthcare organizations do to protect EHR Data and safeguard patients?
Train people
Focus on educating your entire workforce about the risks. Any email from an unknown source, promising financial windfalls or warning the user about negative consequences needs to trigger a warning signal for your people. Never click on a link unless you can see where that link goes. Never download and run software from a link unless you know exactly what it does and where it came from. Many organizations use fake spam emails to test people’s willingness to click on suspect links.

Limit access
Hospitals require many people and systems to operate, all of whom need some degree of access to its network. Still, you can ensure that everyone who needs to enter your network has a level of access that is appropriate. A very common tactic used by attackers is privilege escalation whereby they obtain access to one user’s data and then figure out how to leverage this data to get access to a higher privilege level.

Update software
Not only must you update EHR system software, you also need to update and maintain the software controlling every MRI machine, insulin pump, cardiopulmonary bypass machine and all the other medical devices used to treat patients. This can be difficult because not only must you regularly install updates and security patches, you first need to ensure that the updates are compatible with older equipment, or risk rendering those machines useless. More than half of rural hospitals fail to regularly patch their networks, leading to the influx in cyberattacks that are now specifically targeting them.

Older software such as Windows 7 may be difficult to remove entirely due to compatibility issues with legacy devices and systems. However, steps can be taken to isolate older systems and ensure that they cannot be used as entry points into the core network.⁴

Monitor assets
Unusual patterns in usage of your assets should trigger warnings. Many Intrusion Detection Systems (IDS) can provide early warning that general probing of your network could be turning into something more serious. By monitoring who is logging in and when, you may identify something unexpected. Most software-based medical devices will provide a means to understand what is going on with respect to security (e.g. a security log). Actually parsing this and looking for unusual activity can be the difference between catching an attack early and being too late to avoid very expensive remediation.

Update firewall
Firewalls may offer the illusion of protection, but older firewalls are easily hacked allowing cybercriminals to penetrate -- and ransom -- your entire network. Firewall rules should be constantly updated to ensure that they are covering new threats. Firewalls should be monitored to understand who has access to your network and if there are any unusual patterns in traffic that is coming onto your network.

Back up data often
This is one of the most important things to do. According to the HHS, HIPAA compliance may help hospitals recover from ransomware attacks because HIPAA specifically mandates frequent data backups. If you’re hit by a ransomware attack, a recent backup might be all the information you have access to for patient care.

Be aware, however, that malware may also infiltrate a backup, compromising and encrypting the backup's data. Consider having different levels of backup ongoing, either by simply storing more backups going further into the past or separating frequency of backup into two streams. One backup job can run on a less-frequent basis and the other can run at higher frequency, providing a way to get a snapshot of the system before infection without significantly adding to storage requirements.

Conduct risk assessment
Identify major risks, such as system outages or data theft, and evaluate how staff can impact those risks. An ongoing plan for minimising risk is an essential tool in your armory. The field of cybersecurity is continually evolving with new threats being identified all the time. Membership of an ISAO as recommended by the FDA will help you to be aware of developments. Entry points in recent major attacks should be known and understood – even if older unpatched systems are involved (as they often are) - maybe you can isolate/firewall these systems and understand how they can be used as an entry point that could compromise the whole of your network.

And explore the level of staff awareness of the measures the institution has implemented to safeguard sensitive records. Hospital staffers work at a frenetic pace and are typically focused on minute-by-minute needs – productivity over long-term planning. If staffers don’t truly understand the risks on both a macro and micro level, they will not understand what specific precautions are necessary to keep cybercriminals out of your network – and what role each individual must play.

Audit equipment
Hospitals should regularly audit their medical devices and other machines and segment their networks. This way, the entire network is not compromised if one piece of the network is infected.

Strengthening porous cybersecurity should top your to-do list
The pandemic has accelerated the widespread adoption of telemedicine. Even though society is regaining a sense of normalcy and people are fast returning to in-person activities, remote and online medicine is here to stay. That means, hospitals are more vulnerable than ever to cyberattacks.

To survive, all healthcare systems are urged to immediately (and continuously) address their cyber shortcomings and bolster protections to prevent their services from being interrupted by malware and protect sensitive patient data from being stolen. As the Institute for Security and Technology reminds us, "A cybercriminal only has to be lucky once, while a defender has to be lucky every minute of every day.” 

Shane Keating is cybersecurity engineering and project manager at Integrated Computer Solutions (ICS), especially focused on medical device projects. Prior to joining ICS, Shane worked on receiver authentication of GNSS signals for the European Space Agency, and cryptographic acceleration technologies for Intel's Data Center Group in Ireland. 

Stephanie Van Ness is assoc. director of marketing at ICS and Boston UX. She writes about user experience (UX) design and innovations in technology, from gesture-controlled medical devices to self-driving vehicles.

Sources:

¹https://perspectives.ahima.org/ransomwareinhealthcarefacilities/

^2,3https://www.nytimes.com/2020/10/17/opinion/hospital-internet-security-ransomware.html

⁴https://us-cert.cisa.gov/ncas/alerts/aa20-302a

Methods Machine Tools Inc., the foremost supplier of high-quality CNC machine tools in North America, is hosting a grand opening at its new Chicago Technical Center at 70 Prairie Parkway, Gilberts, IL. The open house is scheduled for August 26-27, 2021 from 10am to 6pm.

Methods’ Chicago staff moved to the new technical center earlier this year to give Midwest customers faster installations, more capabilities, and more responsive service calls.

To register for the grand opening, please click here.

“Now that the dust has settled on our move, we’re excited to open up our doors and show the Midwest what we can do and our new capabilities,” says Don Miller, general manager of Methods’ Chicago Technical Center. “We’re excited to show everyone how our time-tested, industry-trusted knowledge can make machine shops more productive.”

The grand opening will feature live CNC machine demonstrations to give visitors a broad but detailed overview of Methods' application engineering for turnkeys and world-class technology. The company will serve lunch and refreshments on both days.

“No matter what industry you support or the size of your shop, we’ll have something for you to sink your teeth into,” adds Zac Borost, Methods' sales manager for Illinois and Wisconsin.

Brands and machines featured during the grand opening include:

• Nakamura-Tome: SC 300II, WY-150, NTY3-150, and NTY3-250.

• FANUC: six RoboDrills of various sizes with various several, including the Plus-K automation cell, as well as the newest wire EDM machines, the α-CiC400 and α-CiC600.

• YASDA: PX30i, equipped with 306 tools and an APC with 33 pallets for lights-out manufacturing.

• Methods Machining Centers: One vertical machining center, the MV 1100H, and a five-axis machining center, the MB 650U.

• KIWA: The company’s newest horizontal machining centers, the KH-4100kai and KH-4500kai.

• OKK: VC-X350, a 5-axis machining center

• Beamer: Laser-marking machines.

• Ocean Technologies: EDM hole popper.

The grand opening is a part of Methods’ commitment to customers in the Midwest. Long-term goals include adding a parts depot to the existing facility, which will provide parts to many regional customers within four hours.

Autocam Medical, a global contract manufacturer of precision, surgical and medical components and devices, announced that it is investing $60 million through 2024 to expand its manufacturing footprint and capability in West Michigan. This new facility will continue to serve its customers by making products that improve people’s health.

This investment includes a new 100,000ft² manufacturing facility and global headquarters located on Broadmoor and 36th Street in Kentwood, which will house state-of-the-art equipment and technology built to Autocam Medical specifications and proprietary processes.  The new plant expansion is expected to create 250 jobs in West Michigan, and they’ve already started hiring and expect to increase their hiring efforts significantly over the next year.

Autocam Medical has grown dramatically in West Michigan over the last five years, doubling its revenue and employment in the Kentwood location. The company made the choice to continue expanding in West Michigan because of the availability of a skilled workforce.

Autocam Medical’s President and CEO, John C. Kennedy, cited the availability of highly qualified candidates as a critical factor in the decision to stay in West Michigan. “We decided to locate this new plant in West Michigan because even in a tight labor market, we have been able to find highly qualified team members. We believe the workforce here has allowed us to develop advanced technology that brings cost effective solutions to our customers, therefore enabling us to be among the best medical device contract manufacturers in the world,” Kennedy says. 

The company plans to add skilled machinists, engineers, and technicians. Most of these positions will be hourly, and the company provides training opportunities to all associates. The average hourly associate at Autocam Medical earns nearly $58,000 annually plus benefits, including quarterly incentives, a generous 401K match of $3,000, and a premium-free health plan that rewards employees for positive lifestyle choices.  Additionally, employees can expect a pristine, air-conditioned environment outfitted with leading-edge equipment, as well as a culture that trusts and respects every individual. 

“We have built the company around the value of investing in our people and their growth.  The company’s success is due to the knowledge that the employees bring to Autocam Medical every day,” Kennedy says.

In addition to the comprehensive compensation package offered by the company, employees are encouraged to continue their education and training with Autocam Medical’s training partners, Grand Rapids Community College, Grand Valley State University, Ferris State University, and Western Michigan University.

“We are excited about our expansion here in West Michigan and appreciate our partnership with the City of Kentwood in making Kentwood attractive for this investment,” Kennedy says. The new facility will be ready for occupancy in January of 2022.  The company will continue to operate its existing manufacturing facility in Kentwood and plans to use its current headquarters for Area Improvement Team (AIT) activities that focus on continuous improvement.

North Kingstown, Rhode Island – Hexagon’s Manufacturing Intelligence division will host a Smart Manufacturing Virtual Open House from June 14 – 16, 2021. The jam-packed agenda includes 20 sessions presented by 14 Hexagon speakers covering hot topics from additive manufacturing to reverse engineering to the latest in non-contact measurement. Attendees will learn how data can be harnessed for agile smart manufacturing processes leading to the ultimate form of data leverage – autonomous manufacturing, intelligent machine control, predictive maintenance and more. An interactive showroom will be open from 10 a.m. – 3 p.m. featuring the latest Hexagon technologies supported by local subject matter experts (SMEs) ready to answer user questions. While Hexagon’s offices are safely open for business, the company chose to make this online 3D immersive experience widely available based on the high level of community engagement sparked by their first virtual PC-DMIS user group series. The full agenda and registration to obtain a complimentary ticket can be found here. The press is cordially invited to attend, and should RSVP in advance by responding here.

On Monday, June 14, at 10a.m., Keith Perrin and Sachin Mathur will officially launch the event with a keynote presentation entitled Empowering Smart Manufacturing through Connecting the Virtual and Physical Worlds. Keith Perrin currently leads Hexagon’s Smart Manufacturing initiative. Sachin Mathur was recently named one of the 25 leaders transforming manufacturing by the Society of Manufacturing Engineers (SME). They will delve into the power of connecting data from all functional touchpoints and departments throughout the product lifecycle.

"Our Smart Manufacturing Virtual Open House provides a timely juncture for users and managers to rethink and refresh their approach to smart manufacturing from the comfort of their home or office,” stated Keith Perrin, Industry Director at Hexagon. “This informational event demonstrates Hexagon’s continuous support for customers already on the innovation frontlines and for those ready to pursue the continuous improvements found in a closed-loop system across design, production and inspection. We are excited to provide a virtual space for users who share our same vision and drive for smart manufacturing. This three-day event offers an unparalleled speaker line-up and educational content to help attendees spot the entry points for smart manufacturing in their factories and seize the opportunity to improve their workflow.”

From Monday through Wednesday, Hexagon’s Smart Manufacturing Open House series will cover a broad range of trending industry topics including workflow automation, smart additive manufacturing, evolving measurement standards, next-generation non-contact scanning, reverse engineering, and production optimization with prediction. Also on the agenda are application-specific sessions such as sheet metal solutions, advanced machining toolpath strategies, and virtual simulation technology for assembly. Users will also get a sneak peek of new releases of software for design and engineering, production and quality inspection. During the open house, attendees will have the chance to interact with Hexagon SMEs and discuss pressing challenges standing in the way of digital transformation.