TWC: Medium: Digital Healthcare-Associated Infection: Measurement, Defense and Prevention in a Modern Digital Healthcare Ecosystem

随着最近的医疗保健立法鼓励医疗记录系统的互操作，医院系统的数字化和互连的步伐大大增加。除了普通的业务操作数据外，医院企业网络现在还携带来自治疗系统（例如核医学、透析临床系统）的患者记录数据和生命关键数据流。不幸的是，互连这些生命关键系统的安全含义在很大程度上尚未得到研究。该项目正在对佛罗里达大学卫生系统进行大规模分析，以检测恶意软件和安全漏洞的存在，并确定安全最佳实践和技术是否足以保护生命攸关和隐私敏感的医疗系统。虽然最近的多项研究表明，单个医疗设备容易受到攻击，但没有一项研究评估了整个医疗机构的安全现状。该项目正在对佛罗里达大学卫生系统当前的安全状况进行大规模分析，以告知数据驱动的脆弱性缓解方法。研究人员首先通过基于网络的恶意软件存在测量（通过域名系统（DNS）解析）和使用适当的加密实践（通过检查X.509证书）来表征系统的安全状态。该项目的下一个目标是开发动态识别和限制有风险的通信模式的技术，并在通信流中注入强证书。最后，该项目正在开发技术，利用通过接触图检测异常通信模式的算法来预测处于危险中的设备。

The pace of digitization and interconnection of hospital systems has increased tremendously as recent healthcare legislation has encouraged the interoperation of medical record systems. In addition to ordinary business operations data, hospital enterprise networks now carry patient record data and life-critical data streams from therapy systems (e.g., nuclear medicine, dialysis clinical systems). Unfortunately, the security implications of interconnecting such life-critical systems has been largely unstudied. This project is performing a large-scale analysis of the University of Florida Health System to detect the presence of malware and security weaknesses and determine whether security best-practices and techniques are sufficient to protect life-critical and privacy-sensitive medical systems.While multiple recent studies have shown that individual medical devices are vulnerable to attack, none have assessed the current state of security at scale across medical organizations. This project is conducting a large-scale analysis of the current security posture of the University of Florida Health System to inform a data-driven approach to vulnerability mitigation. The researchers are first characterizing the security posture of the system through network-based measurements of malware presence (via Domain Name System (DNS) resolutions) and use of proper encryption practices (via inspection of X.509 certificates). The project is next developing techniques to dynamically fingerprint and limit risky communications patterns and inject strong certificates into communication flows. Finally, the project is developing techniques to predict devices at risk using algorithms that detect abnormal communication patterns via contact graphs.