About the Author |
|
xiii | |
About the Technical Reviewer |
|
xv | |
Preface |
|
xvii | |
Introduction |
|
xix | |
|
Chapter 1 Hacker Reconnaissance of a Hospital Network |
|
|
1 | (8) |
|
|
2 | (2) |
|
|
4 | (2) |
|
|
6 | (1) |
|
|
7 | (1) |
|
|
8 | (1) |
|
Chapter 2 How Hackers Gain Access to a Healthcare Facility or Hospital Network |
|
|
9 | (10) |
|
|
9 | (1) |
|
|
10 | (1) |
|
Man-in-The-Middle Attacks |
|
|
10 | (2) |
|
|
12 | (1) |
|
|
12 | (1) |
|
|
12 | (1) |
|
|
12 | (2) |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
15 | (1) |
|
|
15 | (1) |
|
Unpatched Vulnerabilities |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
18 | (1) |
|
Chapter 3 Active Medical Device Cyber-Attacks |
|
|
19 | (20) |
|
Magnetic Resonance Imaging (MRI) |
|
|
20 | (1) |
|
|
21 | (1) |
|
|
22 | (3) |
|
Positron Emission Tomography (PET) Scanner |
|
|
25 | (1) |
|
X-ray Computed Tomography (CT) Scanner |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
28 | (1) |
|
Extracorporeal Membrane Oxygenation (ECMO) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
30 | (1) |
|
Medical Device Data Systems (MDDS) |
|
|
31 | (1) |
|
Active Patient Monitoring Devices |
|
|
32 | (1) |
|
Interoperable Medical Devices |
|
|
33 | (1) |
|
Medical Image Storage Devices |
|
|
33 | (1) |
|
Medical Image Communications Devices |
|
|
34 | (1) |
|
|
34 | (1) |
|
Electronic Health Records (EHR) |
|
|
35 | (1) |
|
|
36 | (3) |
|
Chapter 4 Medical Facility Cyber-Physical Attacks |
|
|
39 | (8) |
|
|
39 | (1) |
|
Facility Equipment Controlled by the BCS |
|
|
40 | (1) |
|
BCS Network Vulnerabilities |
|
|
41 | (1) |
|
Preventing Hospital Building Equipment Damage |
|
|
42 | (1) |
|
Facility Equipment Cyber-Physical Attacks |
|
|
43 | (1) |
|
|
43 | (1) |
|
Boiler Sequence Controller Hack |
|
|
44 | (1) |
|
Hot Water Heater Explosion |
|
|
44 | (1) |
|
|
44 | (1) |
|
|
44 | (1) |
|
|
45 | (2) |
|
Chapter 5 Hospital Insider Threat |
|
|
47 | (6) |
|
|
47 | (3) |
|
Types of Insider Cyber-Attacks |
|
|
50 | (1) |
|
|
51 | (2) |
|
|
51 | (1) |
|
|
51 | (2) |
|
Chapter 6 Detection of Cyber-Attacks |
|
|
53 | (8) |
|
Indicators of a Possible Cyber-Attack |
|
|
53 | (1) |
|
Cyber-Attack Detection Tools |
|
|
54 | (1) |
|
Intrusion Detection Systems |
|
|
55 | (2) |
|
Intrusion Detection System Alarms |
|
|
57 | (1) |
|
Intrusion Prevention System |
|
|
57 | (2) |
|
|
58 | (1) |
|
|
58 | (1) |
|
Forensic Evidence of a Cyber-Attack |
|
|
59 | (2) |
|
|
59 | (1) |
|
Run Intrusion Detection System |
|
|
60 | (1) |
|
Chapter 7 Preventing Cyber-Attacks |
|
|
61 | (14) |
|
|
61 | (4) |
|
Step 1 Physical Access to Equipment and Workplace |
|
|
61 | (1) |
|
Step 2 Eliminate Common MGN Vulnerabilities |
|
|
62 | (1) |
|
Step 3 Monitor Access to the MGN |
|
|
63 | (2) |
|
Network Procurement Documentation |
|
|
65 | (3) |
|
Discontinue Remote Connections to the Medical Equipment Network |
|
|
68 | (1) |
|
Implement Application Whitelisting |
|
|
68 | (1) |
|
Systematic Patch Management Regimen |
|
|
68 | (1) |
|
Reduce the Attack Surface |
|
|
69 | (1) |
|
Build a Defendable Network Environment |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
69 | (1) |
|
Do Not Use Medical Equipment Networks for Anything Else |
|
|
69 | (1) |
|
Cybersecurity Analysis Tools |
|
|
69 | (3) |
|
How to Avoid Phishing Scams |
|
|
72 | (3) |
|
Chapter 8 Cyber-Attack Response and Recovery Planning |
|
|
75 | (4) |
|
Developing a Response and Recovery Plan |
|
|
75 | (1) |
|
|
76 | (1) |
|
|
77 | (1) |
|
|
77 | (1) |
|
|
77 | (1) |
|
|
78 | (1) |
|
|
78 | (1) |
|
Chapter 9 Appendix. Cyber-Attack Response Procedures Template |
|
|
79 | (46) |
|
Hospital Cyber-Attack Response Procedures |
|
|
81 | (1) |
|
Intrusion Detection System Alerts |
|
|
81 | (2) |
|
|
83 | (1) |
|
Cybersecurity Breach Reporting Form -- Page 1 |
|
|
84 | (1) |
|
Cybersecurity Breach Reporting Form -- Page 2 |
|
|
85 | (1) |
|
Incident Response Team Strategy Meeting Form |
|
|
86 | (1) |
|
Cyber-Event Diagnostics Table |
|
|
87 | (2) |
|
|
89 | (1) |
|
Hospital Building Inspection -- Page 1 |
|
|
90 | (1) |
|
Hospital Building Inspection -- Page 2 |
|
|
91 | (3) |
|
Other Hospital Equipment to Be Checked |
|
|
92 | (2) |
|
|
94 | (2) |
|
Equipment or Service Failure Report |
|
|
96 | (3) |
|
Hospital Incident Response Team Member Listing |
|
|
99 | (1) |
|
Repair Work Order Listing |
|
|
100 | (1) |
|
Recovery and Device Reintegration |
|
|
101 | (2) |
|
Building Controls System Recovery and Reintegration |
|
|
103 | (2) |
|
Building Controls System Field Test |
|
|
105 | (1) |
|
|
106 | (1) |
|
Medical Network Recovery and Device Reintegration |
|
|
107 | (2) |
|
Hospital Data Network Information |
|
|
109 | (3) |
|
Building Controls System Network Information |
|
|
112 | (3) |
|
Medical Device and Equipment Vendor Contact List |
|
|
115 | (2) |
|
List of Authorized Maintenance Laptop Computers |
|
|
116 | (1) |
|
Vulnerability Assessments History |
|
|
117 | (1) |
|
Types of Internal and External Vulnerability Tests |
|
|
117 | (1) |
|
Vulnerabilities Notifications Reports |
|
|
118 | (1) |
|
Hospital Data Network Vulnerabilities Notifications Report |
|
|
119 | (2) |
|
Hospital Data Network Software Management Report |
|
|
120 | (1) |
|
Building Controls System Network Vulnerabilities Notifications Report |
|
|
121 | (2) |
|
Building Controls System Network Software Management Report |
|
|
122 | (1) |
|
Medical Device Data System Vulnerabilities Notifications Report |
|
|
123 | (1) |
|
Medical Device Data System Software Management Report |
|
|
124 | (1) |
Index |
|
125 | |