TWC: Medium: Digital Healthcare-Associated Infection: Measurement, Defense and Prevention in a Modern Digital Healthcare Ecosystem

随着最近的医疗立法鼓励医疗记录系统的互操作性，医院系统的数字化和互连步伐大大加快。 除了普通的业务操作数据之外，医院企业网络现在还承载来自治疗系统的患者记录数据和生命关键数据流（例如，核医学、透析临床系统）。不幸的是，互连这些生命攸关的系统的安全影响在很大程度上尚未得到研究。该项目正在对佛罗里达大学卫生系统进行大规模分析，以检测恶意软件和安全漏洞的存在，并确定安全最佳实践和技术是否足以保护生命攸关和隐私敏感的医疗系统。虽然最近的多项研究表明，个别医疗设备容易受到攻击，没有一家机构对医疗机构的安全现状进行过大规模评估。该项目正在对佛罗里达大学卫生系统的当前安全态势进行大规模分析，以提供数据驱动的漏洞缓解方法。 研究人员首先通过基于网络的恶意软件存在测量（通过域名系统（DNS）解析）和使用适当的加密实践（通过检查X.509证书）来表征系统的安全态势。 该项目的下一步是开发技术，以动态识别和限制危险的通信模式，并将强证书注入通信流。 最后，该项目正在开发技术，使用通过接触图检测异常通信模式的算法来预测存在风险的设备。

The pace of digitization and interconnection of hospital systems has increased tremendously as recent healthcare legislation has encouraged the interoperation of medical record systems. In addition to ordinary business operations data, hospital enterprise networks now carry patient record data and life-critical data streams from therapy systems (e.g., nuclear medicine, dialysis clinical systems). Unfortunately, the security implications of interconnecting such life-critical systems has been largely unstudied. This project is performing a large-scale analysis of the University of Florida Health System to detect the presence of malware and security weaknesses and determine whether security best-practices and techniques are sufficient to protect life-critical and privacy-sensitive medical systems.While multiple recent studies have shown that individual medical devices are vulnerable to attack, none have assessed the current state of security at scale across medical organizations. This project is conducting a large-scale analysis of the current security posture of the University of Florida Health System to inform a data-driven approach to vulnerability mitigation. The researchers are first characterizing the security posture of the system through network-based measurements of malware presence (via Domain Name System (DNS) resolutions) and use of proper encryption practices (via inspection of X.509 certificates). The project is next developing techniques to dynamically fingerprint and limit risky communications patterns and inject strong certificates into communication flows. Finally, the project is developing techniques to predict devices at risk using algorithms that detect abnormal communication patterns via contact graphs.