[Cybersecurity and use of ICT in the health sector]

Cybercrime in the health sector is a growing threat in the digital age. With computerization of medical records and telemedicine on the rise, cyberattacks can have devastating consequences. Leaking sensitive data or hijacking systems can compromise patient's privacy and jeopardize healthcare. To counter this threat, robust cybersecurity measures are required as a protective measure. This article aims to expose the main dangers and threats faced by ICT, as well as present cybersecurity with its bioethical implications and, finally, the ideal scheme for it in the health sector in order to create a safer and more efficient environment. This article aims to address these issues and provide a comprehensive view of how cybersecurity and ICT can coexist safely and effectively in the healthcare field.

Investigating the role of Cybersecurity's perceived threats in the adoption of health information systems

Information technology is one of the most rapidly growing technologies globally. Over the last decade, its usage in healthcare has been remarkable. Over the last decade, its usage in healthcare has been remarkable. The study examines the impact of various factors as barriers to adopting the information system in healthcare. These factors are categorized into three major types: external attacks, which include phishing attacks and ransomware; employee factors, including lack of skills and the issue of information misuse; and technological factors, including complexity and vulnerability. The findings show that external attacks and technological factors are the main barriers to adopting information systems, while employee factors have no significant impact on the adoption of information systems in the healthcare industry of Pakistan. The study provides implications for healthcare policy makers, professionals and organziations regarding the successful adoption of health information system.

The crippling effects of a cyberattack at an academic level 1 trauma center: An orthopedic perspective

INTRODUCTION

Malicious cyberattacks are increasing in frequency and severity with healthcare institutions spending an average of over 10 million dollars to resolve the consequences of healthcare data breaches. This cost does not include the effect of a downtime event should a healthcare system electronic medical record (EMR) lose functionality. An Academic Level 1 trauma center suffered a cyberattack resulting in a total EMR downtime of 25 days. Orthopedic operative time was used as a surrogate for OR functionality during the event and a framework with specific examples is presented to promote rapid adaptation during downtime events.

METHODS

Operative time losses were identified by calculating a running average of weekday total in room operative time during a total downtime event secondary to a cyberattack. This data was compared to week-of-the-year matched data from the year prior and the year after the attack. A framework for creating adaptations to a total downtime event was created by repeatedly interviewing different provider groups and identifying how they adjusted care to the challenges faced.

RESULTS

Total weekday in room operative time during the attack decreased by 53.4% ± 12.2% and 53.2% ± 14.9% when comparing the matched period one year prior and one year after, respectively. Immediate challenges to patient care were identified by small groups of highly motivated individuals, with self-assigned agile teams formed. These teams sequenced system processes, identified failure points, and created real-time solutions. A frequently updated EMR backup mirror and hospital disaster insurance were crucial for mitigating the impact of the cyberattack.

CONCLUSIONS

Cyberattacks are expensive and their downstream effects, including downtime events, can be crippling. Agile team formation, process sequencing, and understanding EMR backup times are tactics used to combat the challenges of a prolonged total downtime event.

LEVEL OF EVIDENCE

Level III retrospective cohort.

An ontology-driven framework for knowledge representation of digital extortion attacks

With the COVID-19 pandemic and the growing influence of the Internet in critical sectors of industry and society, cyberattacks have not only not declined, but have risen sharply. In the meantime, ransomware is at the forefront of the most devastating threats that have launched the lucrative illegal business. Due to the proliferation and variety of ransomware forays, there is a need for a new theory of categories. The intricacy and multiplicity of components involved in digital extortions entails the construction of a knowledge representation system that is able to organize large volumes of information from heterogeneous sources in a formal structured format and infer new knowledge from it. This paper suggests and develops a dedicated ontology of digital blackmails, called Rantology, with a particular focus on ransomware assaults. The logic coded in this ontology allows to assess the maliciousness of programs based on various factors, including called API functions and their behaviors. The proposed framework can be used to facilitate interoperability between cybersecurity experts and knowledge-based systems, and identify sensitive points for surveillance. The evaluation results based on several criteria confirm the adequacy of the suggested ontology in terms of clarity, modularity, consistency, coverage and inheritance richness.

Ransomware and the Robin Hood effect?: Experimental evidence on Americans' willingness to support cyber-extortion

Objectives

Ransomware attacks have become a critical security threat worldwide. However, existing research on ransomware has largely ignored public opinion. This initial study identifies patterns in the American public's support for the use of ransomware, specifically when it is framed to provide benefits to others (i.e., in-group members). Drawing on the Robin Hood decision-making literature and Moral Foundations Theory, we offer theoretical predictions regarding ransomware support.

Methods

In a survey of 1013 Americans, we embedded a split-ballot experiment in which respondents were randomly assigned to indicate their level of support or opposition to one of two sets of six ransomware scenarios. We manipulated the nationality, authority level, and political affiliation of the actors.

Results

We find that people are more supportive of ransomware use when the actors are from their own in-group, and the outcomes benefit their in-group members. Also, the more strongly participants endorsed the moral foundations of authority and harm/care, the more supportive they were of the use of ransomware that may benefit others from their in-group.

Conclusions

These findings suggest political actors may be able to generate public support for morally questionable actions by emphasizing in-group benefits and the Robin Hood nature of an attack (e.g., outcome-based morality).

Anatomy of a Cyberattack

OBJECTIVES

Our institution was subject to a multi-institutional, systemwide cyberattack that led to a complete shutdown of multiple major patient care, operational, and communication systems for more than 25 days. The electronic health record computer system was taken offline, as was the hospital email and authentication systems, internet access, and the laboratory information system. The impact on the hospital and patient care was substantial, and our laboratories were crippled.

METHODS

Our laboratory endured challenges in communication because of the loss of connectivity and difficulties in laboratory management, and we recognized a need to restructure leadership to maintain operations during the crisis. As an academic institution, residents and trainees were also significantly affected by the disaster.

RESULTS

We developed an incident command team (ICT), alternative methods of communication, and innovative management strategies to remain operational. Trainees were incorporated into the disaster-relief efforts, with negative impacts on resident education.

CONCLUSIONS

This paper focuses on the challenges in communication and lab management as well as the need for an alternative leadership structure during the crisis. We also highlight the unique experience of our trainees during this prolonged downtime, underscoring the importance of incorporating resident trainees into the daily ICT's administrative activities as an invaluable lab management experience.

Ransomware: Recent advances, analysis, challenges and future research directions

The COVID-19 pandemic has witnessed a huge surge in the number of ransomware attacks. Different institutions such as healthcare, financial, and government have been targeted. There can be numerous reasons for such a sudden rise in attacks, but it appears working remotely in home-based environments (which is less secure compared to traditional institutional networks) could be one of the reasons. Cybercriminals are constantly exploring different approaches like social engineering attacks, such as phishing attacks, to spread ransomware. Hence, in this paper, we explored recent advances in ransomware prevention and detection and highlighted future research challenges and directions. We also carried out an analysis of a few popular ransomware samples and developed our own experimental ransomware, AESthetic, that was able to evade detection against eight popular antivirus programs.

Ransomware Recovery and Imaging Operations: Lessons Learned and Planning Considerations

In this era, almost all healthcare workflows are digital and rely on robust institutional networks; a ransomware attack in a healthcare system can have catastrophic patient care consequences. The usual downtime processes in an institution might not address the breadth of this disruption and timelines for recovery. This article shares our lessons learned from ransomware recovery. From this experience, a four-phase recovery planning framework has been developed. The primary focus is on acute patient care, incident communication, and emergency imaging operations in the initial phase. In the next phase, continued digital asset unavailability necessitates a transition to long-term analog workflows. In the infrastructure recovery and reconciliation phases, each taking weeks or months, the emphasis is on rebuilding a ransomware-free environment and reconciling the data accrued during extended downtime. In preparation for future events, we have initiated a continuous readiness process. A response task force has been formed to guide physicians, technologists, nurses, and informatics units on recovery workflows appropriate for extended downtime and keeping these procedures updated. Incident command structure has been discussed for communications and resource allocation during a ransomware attack, possibly in the context of a multi-incident scenario such as that involving concurrent staffing shortage amidst a pandemic. Finally, we discuss considerations for tabletop simulation, which may be valuable to the planning process.

On the classification of Microsoft-Windows ransomware using hardware profile

Due to the expeditious inclination of online services usage, the incidents of ransomware proliferation being reported are on the rise. Ransomware is a more hazardous threat than other malware as the victim of ransomware cannot regain access to the hijacked device until some form of compensation is paid. In the literature, several dynamic analysis techniques have been employed for the detection of malware including ransomware; however, to the best of our knowledge, hardware execution profile for ransomware analysis has not been investigated for this purpose, as of today. In this study, we show that the true execution picture obtained via a hardware execution profile is beneficial to identify the obfuscated ransomware too. We evaluate the features obtained from hardware performance counters to classify malicious applications into ransomware and non-ransomware categories using several machine learning algorithms such as Random Forest, Decision Tree, Gradient Boosting, and Extreme Gradient Boosting. The employed data set comprises 80 ransomware and 80 non-ransomware applications, which are collected using the VirusShare platform. The results revealed that extracted hardware features play a substantial part in the identification and detection of ransomware with F-measure score of 0.97 achieved by Random Forest and Extreme Gradient Boosting.

Impact of Trauma Hospital Ransomware Attack on Surgical Residency Training

BACKGROUND

A recent ransomware attack led to the shutdown of the electronic health information system (HIS) at our trauma center for 2 mo. We investigated its impact on residency training during the downtime.

MATERIAL AND METHODS

General and orthopedic surgical residents who rotated at the hospital were invited to participate in a survey regarding their patient care and residency training experiences during the downtime. Attending surgeons from both the specialties were invited to participate in a semistructured interview regarding their attitude toward residency training during the downtime.

RESULTS

Twenty-nine residents responded to the survey with a response rate of 78.4%. Residents acknowledged significant increases in face-to-face communication and decreases in use of online educational resources during the downtime (P < 0.01). Residents were significantly stressed by the dearth of online resources (P < 0.0001) and by paper-based orders and outpatient clinic (P < 0.05). A multivariate analysis demonstrated an inverse relationship between postgraduate year and stress from paper orders (P = 0.003). Attending surgeon's interviews revealed that they recognized residents' unpreparedness and strove harder to teach more effectively.

CONCLUSIONS

Our study demonstrated that an unexpected shutdown of the hospital HIS imposed significant stress upon surgical residents providing trauma patient care and made attending surgeons take greater efforts to be more effective teachers. Residents who are digital natives lack adaptability to handle a paper-based workflow. With cyber security threats increasing in health care, preparedness should be included in the graduate medical education curriculum.