TWC: Medium: Digital Healthcare-Associated Infection: Measurement, Defense and Prevention in a Modern Digital Healthcare Ecosystem

随着最近的医疗立法鼓励病历系统的互操作，医院系统的数字化和互联的步伐大大加快。除了普通的业务运营数据外，医院企业网络现在还传输来自治疗系统(例如，核医学、透析临床系统)的患者记录数据和生命关键数据流。不幸的是，这种至关重要的系统相互连接的安全影响在很大程度上还没有得到研究。该项目正在对佛罗里达大学卫生系统进行大规模分析，以检测恶意软件和安全漏洞的存在，并确定安全最佳实践和技术是否足以保护生命关键和隐私敏感的医疗系统。虽然最近的多项研究表明，单个医疗设备容易受到攻击，但没有一项评估跨医疗组织的当前规模的安全状态。该项目正在对佛罗里达大学卫生系统的当前安全态势进行大规模分析，以提供数据驱动的漏洞缓解方法。研究人员首先通过基于网络的恶意软件存在测量(通过域名系统(DNS)解析)和使用适当的加密做法(通过检查X.509证书)来表征系统的安全态势。该项目的下一步是开发动态指纹和限制危险通信模式的技术，并向通信流中注入强大的证书。最后，该项目正在开发预测处于风险中的设备的技术，使用通过接触图检测异常通信模式的算法。

The pace of digitization and interconnection of hospital systems has increased tremendously as recent healthcare legislation has encouraged the interoperation of medical record systems. In addition to ordinary business operations data, hospital enterprise networks now carry patient record data and life-critical data streams from therapy systems (e.g., nuclear medicine, dialysis clinical systems). Unfortunately, the security implications of interconnecting such life-critical systems has been largely unstudied. This project is performing a large-scale analysis of the University of Florida Health System to detect the presence of malware and security weaknesses and determine whether security best-practices and techniques are sufficient to protect life-critical and privacy-sensitive medical systems.While multiple recent studies have shown that individual medical devices are vulnerable to attack, none have assessed the current state of security at scale across medical organizations. This project is conducting a large-scale analysis of the current security posture of the University of Florida Health System to inform a data-driven approach to vulnerability mitigation. The researchers are first characterizing the security posture of the system through network-based measurements of malware presence (via Domain Name System (DNS) resolutions) and use of proper encryption practices (via inspection of X.509 certificates). The project is next developing techniques to dynamically fingerprint and limit risky communications patterns and inject strong certificates into communication flows. Finally, the project is developing techniques to predict devices at risk using algorithms that detect abnormal communication patterns via contact graphs.