Medtech cybersecurity group MedCrypt raises $2m in seed round

Medical device cybersecurity group MedCrypt said today it raised $1.9 million in a seed round of financing to help support its medtech-specific embedded cybersecurity software.

The round was led by Eniac Ventures and joined by Sway Ventures, Nex, Cubed, Oronoco Investments and Friedman BioVentures, the Encinitas, Calif.-based company said.

“Cyber threats are an exponentially increasing problem that is threatening businesses, governments, households and, in healthcare, even lives. MedCrypt has already set itself apart with a seasoned technical team and proprietary technology that is helping the largest medical device makers in the world protect their devices and the underlying users. Our team is excited to support Mike Kijewski and Eric Pancostin continuing to build out MedCrypt as the most comprehensive security layer for healthcare IT,” Eniac Ventures founding general partner Tim Young said in a press release.

MedCrypt is developing cryptographically embedded security software intended to help vendors protect their products from outside assault and monitor the behavior of the devices after they’ve been deployed.

“The FDA is cracking down on medical device cybersecurity by releasing more robust regulations by which medical device vendors and healthcare delivery organizations are required to abide. Our solution lets these organizations protect their devices – and patients – with just a few lines of code. We’re thrilled to gain additional funding and support to help accelerate our technology,” co-founder & CEO Mike Kijewski said in a prepared statement.

The financing brings the total the company has raised to date up to $3 million, MedCrypt said.

The post Medtech cybersecurity group MedCrypt raises $2m in seed round appeared first on MassDevice.

DHS warns of cybersecurity weakness in Medtronic N’Vision neurostim programmer

The Department of Homeland Security this week released a report warning of cybersecurity vulnerabilities in Medtronic‘s (NYSE:MDT) N’Vision clinician programmer designed for use with neurostimulation devices that could allow outside agents to access personal health data.

The DHS said that the vulnerability was originally reported by Whitescope LLC, and requires an individual gain physical access to N’Vision’s 8870 Compact Flash Therapy Application card.

Once access is achieved, extracting personal health information or personal identifying information requires a low skill level, according to the DHS report.

The vulnerability was given a medium-severity classification by the agency, which said that Medtronic has not yet developed an update to address the issue. The DHS said that Medtronic was taking steps to reinforce security reminders and help reduce the risk of the vulnerability.

Medtronic recommended that operators of such devices take extra steps to maintain the security of them, including strict physical control of the Compact Flash card, only using legitimately maintained 8870 cards and returning the cards when they are no longer in use.

Last month, FDA Commissioner Scott Gottlieb released a statement laying out the federal watchdog’s plans for improving medical device regulation, including plans to improve cybersecurity and monitor the total product life cycles of devices.

The post DHS warns of cybersecurity weakness in Medtronic N’Vision neurostim programmer appeared first on MassDevice.

Attivo Networks receives validation from BD for BOTsink cybersecurity solution

Share

[Image courtesy of Blogtrepreneur on Flickr, per Creative Commons 2.0 license]

Attivo Networks recently announced that it has received validation through a BD Product Security Partner Program for its BOTsink cybersecurity deception solution when used with BD devices. The company recently expanded its IOT portfolio and the BD collaboration will allow for improved detection capabilities against cyber threats that impact medical devices.

The deception-based threat detection in the BOTsink features decoys and lures that misdirect potential attackers from production assets. Through the collaboration, BOTsink decoys will provide software on certain BD products that will create mirror-match decoy authenticity. This will create an illusion where a potential attacker will not be able to tell what is real and fake. It will also show what an attacker is doing as they scan systems or try to download malware onto medical devices.

Get the full story on our sister site, Medical Design & Outsourcing.

Cybersecurity: Email is largest source of healthcare data breaches for 2017

Share

Emails are the top source for data breaches so far this year according to the US Department of Health and Human Services, Modern Healthcare reports.

A total of 73 breaches were reported between January 1 and November 30, affecting information related to 573,698 individuals, according to the report.

The threat of email breaches is not unknown among hospital staff, who see it as the most likely source for such an intrusion, according to Modern Healthcare.

A total of four out of five US physicians have experienced such email-based cyberattacks, according to an Accenture survey quoted in the report. A separate survey, performed by Mimecast, suggests that 78% of physicians had reported either a malware or ransomware attack over the last 12 months.

“This study confirms that no healthcare provider is immune to the growing threat of email-related cyberattacks,” HIMSS Analytics senior director Bryan Fiekers said, according to Modern Healthcare.

Other data from the Mimecast survey indicated that nearly 25% of surveyed individuals said they’d had 16 or more malware or ransomware attacks over a year, and that nearly 75% of the individuals surveyed saw their email as “mission critical,” according to the report.

“It’s really a business issue to keep it up and running,” Mimecast cyber-resilience strategist David Hood said, according to Modern Healthcare.

Healthcare practices are taking steps to reduce such intrusions, according to data from the Mimecast survey. Results indicated that nearly 75% of those surveyed sad their organizations were taking steps to secure their emails, and 91% said they are training employees on secure practices to prevent and reduce malware and ransomware attacks.

Large organizations were putting in the most effort to prevent such attacks, according to the report.

“But you also have to recognize that no matter how much training you do, you can’t solve for every problem with human beings in the chain and being involved in the decision to open the email and click on something,” Hood said, according to Modern Healthcare.

In November, the US House Energy and Commerce committee said it was looking to the Department of Health and Human Services to shore up medical device cybersecurity.

UK’s National Health Service to tap “ethical hackers” in $27m cybersecurity push

Share

The UK’s NHS is looking to spend $26.7 million (GBP £20 million) to reinforce its central cybersecurity unit with “ethical hackers”, as it aims to bolster its protection from future attacks on its health services systems, according to a The Times UK report.

The new additions will reportedly monitor for emerging threats and work alongside a reinforced security team to protect hospitals from possible future attacks, instead of focusing on repairing previously attacked systems, according to the report.

The UK’s NHS is looking to avoid a repeat of the Wannacry attack in May which shut down a number of healthcare systems in the country, according to the Times UK report.

The NHS’s Digital Health Service computing agency is looking to spend $26.7 million to create a security operations center to protect from such attacks in the future, according to the report. The offer is the largest NHS cybersecurity contract to date.

“The partnership will provide access to extra specialist resources during peak periods and enable the team to proactively monitor the web for security threats and emerging vulnerabilities. It will also allow us to improve our capabilities in ethical hacking, vulnerability testing and the forensic analysis of malicious software and will improve our ability to anticipate future vulnerabilities while supporting health and care in remediating known threats,” NHS Digital said, according to The Times UK.

The new “ethical hackers” will seek to break and exploit vulnerabilities in the NHS’s systems, but without malicious intentions, instead seeking to bring such issues to light so they can be corrected.

In July, a group of UK hospitals received $27.3 million (£21 million) to improve their cybersecurity in the wake of the WannaCry ransomware attack.

House committee urges HHS to improve med device cybersecurity

Share

The US House Energy and Commerce committee is looking to the Department of Health and Human Services to shore up medical device cybersecurity, according to a report from The Hill.

Committee Chair Greg Walden (R-Ore.) sent a letter to the HHS asking it to require device makers to provide a listed bill of materials, including third-party software components, used in each of its products, according to the report.

“Stakeholders do not know, and often have no way of knowing, exactly what software or hardware exist within the technologies on which they rely to provide vital medical care. This lack of visibility directly affects the ability of these stakeholders to assess their levels of risk and adjust their strategies appropriately,” Walden wrote in the letter, according to The Hill.

Due to the modular nature of electronic development, both software and hardware components often feature modular designs that require updates and support from third parties outside the company that assembles devices, according to the report.

Security exploits and vulnerabilities are normally patched by manufacturers and not the original component developers. Due to the oft-long periods between manufacturing and sales of devices, problems can manifest themselves quickly upon release, according to The Hill.

In the letter, Walden references bills of materials as an important recommendation of the Health Care Industry Cybersecurity Task Force established by the HHS last year, according to the report.

“It helps solve two questions: Am I affected and where am I affected,”task force member and I Am The Cavalry device security advocacy group co-founder Josh Corman told The Hill. “This is a problem we know how to solve.”

The letter requests the HHS begin developing a plan to form a framework which would allow coordination between stakeholders in medical devices by December 15.

IBM X-Force: Number of compromised healthcare records drops 88 percent in 2016

Which industry do you think experienced the most cyberattacks in 2016? If you guessed healthcare, think again.

New data from the 2017 IBM X-Force Threat Intelligence Index shows that although the healthcare industry was most frequently targeted by cyberattacks in 2015, the financial services industry took the cake in 2016.

The healthcare industry also fell off the map in terms of the number of records compromised. Healthcare saw a whopping number — nearly 100 million records — leaked in 2015, compared to only 12 million records in 2016, resulting in an 88 percent drop.

Advertisement

The IBM X-Force Threat Intelligence Index includes data gathered between January 1, 2016, and December 31, 2016. Each year, IBM Security Services keeps track of incidents from over 8,000 devices in more than 100 countries. IBM X-Force not only runs spam traps across the globe but also analyzes over 37 billion websites.

Despite the lower number of compromised healthcare records, the report found the number of records leaked across all industries grew at an astounding rate: 566 percent. While there were 600 million records compromised overall in 2015, there were more than 4 billion compromised in 2016.

And it’s not just the number of compromised records that changed. Cybercriminals started rethinking their game plans in 2016. The report noted cybercriminals increasingly started to go after unstructured data, including business documents and email archives.

“Cybercriminals continued to innovate in 2016 as we saw techniques like ransomware move from a nuisance to an epidemic,” Caleb Barlow, IBM Security’s president of threat intelligence, said in a statement. “While the volume of records compromised last year reached historic highs, we see this shift to unstructured data as a seminal movement. Unstructured data is big-game hunting for hackers and we expect to see them monetize it this year in new ways.”

Ransomware is indeed becoming an epidemic across every industry. As the report notes, ransomware “continues to be one of the most profitable forms of malware in terms of effort versus earnings.” The report specifically points to the February 2016 case of Los Angeles-based Hollywood Presbyterian Medical Center as an example of the growing threat of ransomware. Ransomware is typically distributed via attachments in spam emails. As such, 2016 saw a fourfold increase in spam compared to 2015. About 44 percent of spam included dangerous attachments, and 85 percent of those attachments included ransomware.

Moving forward, organizations — whether in healthcare or not — must put an increased emphasis on security. They must also be open to collaborating with other organizations and individuals to learn best practices. “The faster they react to cybercrime findings and share their experiences across the security community, the less time each malware variant can live and/or see successful fraud attacks,” the report concludes. “As a result, cybercrime can become much less financially viable for attackers, as exposure can weed out large numbers of fraudsters who abandon their criminal pursuit for lack of profit.”

Photo: HYWARDS, Getty Images

FBI cautions healthcare organizations of cyberattacks

If you think you’re free from cyberattacks, the FBI has news for you.

The Federal Bureau of Investigation has issued a private industry notification to medical and dental facilities regarding the looming dangers of cyberattacks.

The notification points out that cybercriminals have been targeting File Transfer Protocol servers to gain access to patients’ protected health information and personally identifiable information. The criminals access FTP servers operating in “anonymous” mode and use the information gained to “intimidate, harass and blackmail business owners,” according to the FBI.

Advertisement

“Cybercriminals could also use an FTP server in anonymous mode and configured to allow ‘write’ access to store malicious tools or launch targeted cyberattacks,” the FBI notification said.

FTP servers are commonly used to transfer data between network hosts. A 2015 study out of the University of Michigan in Ann Arbor noted FTP has mostly been replaced by HTTP, SCP and BitTorrent. However, the study also found about 1.1 million extant FTP servers allow anonymous access. “These anonymous FTP servers leak sensitive information, such as tax documents and cryptographic secrets,” the study said. “More than 20,000 FTP servers allow public write access, which has facilitated malicious actors’ use of free storage as well as malware deployment and click-fraud attacks.”

To combat this growing threat, the FBI suggests healthcare organizations double-check their networks to ensure FTP servers aren’t running in anonymous mode. If organizations must use anonymous mode, the FBI recommends administrators refrain from storing PHI and PII on the FTP server.

This isn’t the first time the FBI has spoken out about the issue of cybersecurity. Earlier this month, FBI Director James Comey gave the keynote speech at the Boston Conference on Cyber Security. During his address, Comey said cyberthreats are “too fast, too big and too widespread for any of us to address them alone.”

He noted that cybercriminals come from all over and use various means to gain what they want. “And we’re not only worried about loss of data, but corruption of that data and lack of access to our own information,” Comey said.

When asked to elaborate on the number one cyberthreat to healthcare providers, Comey replied with one word: ransomware, according to The National Law Review. On that front, Comey advised healthcare leaders not to pay ransom and to maintain backup systems to protect valuable data. Additionally, Comey urged healthcare organizations to collaborate and work with the FBI in situations involving a cyberattack.

Photo: Epoxydude, Getty Images