Online health records at risk from malware

It's the same problems as banking, but different, says AusCERT

Comments

AusCERT general manager Graham Ingram has questioned the wisdom of Australia's National E-Health Strategy plans to make medical records available online, pointing to the difficulty of securing end-users' computers.

"I do not believe that personal health records should be available over the internet to end machines until they can secure them," Ingram told the Security 2011 Expo and Conference in Sydney this week.

"If I had a machine in a Medicare office that I could go into that was dedicated to that function, I'd be happy with that. But popping on my home machine or the Qantas lounge and looking at my health records is not something that I am going to be ecstatic about."

Online banking led to phishing attacks, says Ingram, and that led in turn to more sophisticated malware that relied on social engineering techniques and thence to advanced persistent threats (APTs) or, as Ingram prefers to call them, covert enterprise intrusions (CEIs). He envisages the same evolution playing out in attacks on health records.

One scenario could be noting that someone was allergic to peanuts, and changing that.

"Maybe that's on the paranoia end, and maybe I've no reason to have that paranoia," Ingram said, but nevertheless he is concerned that it would be possible to view someone's health records through simple attacks.

"The e-health people say, 'No, our databases are secure.' That's not what I'm talking about. They don't seem to get that," Ingram said. "They seem to think that if we can secure the back-end databases they've secured the system. No you haven't."

According to Ingram banks now assume that transactions might be compromised, and employ sophisticated algorithms to help detect and prevent fraud. This can include introducing delays in processing to allow time for investigation. That might not be as easy to do with health records that might be acted upon in real-time emergencies with potentially fatal consequences if mistakes are made.

"The successful attack is now almost guaranteed," Ingram said. "How do you then start to say, 'How can I reduce the damage from a successful attack? How can I detect it and mitigate it?"