EP65 Is Your Healthcare Security Healthy? Mandiant Incident Response Insights

Security.

Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and esteemed member of our cloud security team here at Google. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we are having a super fun conversation today about kind of a very serious topic. We're back into the field of security for healthcare.

Correct. But we're also We're going to be talking about incidents, and we're going to talk about, like, real incident data from investigating incidents because we're going to have a guest from a very well-known incident response company.

Oh, well, you shouldn't give away who that will be.

Okay, well, fine. Let's hide it for another minute.

That's good. So what do we learn in today's episode? What's exciting about this one?

Actually, one of the interesting things that I learned is that I should not make too many snide remarks when we are talking about ransomware incidents in healthcare, because we are actually pretty close to people actually being harmed. And I don't mean IT systems or servers, but actual human people.

Wait, by pretty close, you mean we are actually seeing people be harmed by this? I think we're well beyond pretty close and into, oh my God, this is an actual problem affecting actual people.

Correct, people's health, not just people's IT.

That's right.

I think that to me, the biggest lesson from today's discussion is that I've long visualized this kind of bridge from the IT realm to like a normal life realm. And this is where the IT realm comes the closest to the normal human beings' daily lives.

I think this episode has a lot in common with the Matty episode that way, where we have real-world, real impact of the decisions we're making, which often feel so abstract, but here really, really matter. So perhaps with that, let's welcome today's guests. And with that, I'm delighted to introduce today's guests. We have joining us for the first time, and hopefully not the last, Charles Carmichael, the CTO at Mandiant, and returning guest Taylor Lehman, Director at Office of the CISO, Google Cloud. Charles, I want to start off by talking about what are the current popular incidents at healthcare providers that you have handled? We're really interested in helping users understand in practice, what does this look like? today we're talking about healthcare. So what are some healthcare incidents that you've worked on, and do they involve cloud?

Yeah, absolutely. So look, I don't know that any incident is popular. Incidents are frustrating to many of us, especially those that are impacted. But when I think about healthcare threats, I think back to October 2020, and I think about an assault against a number of US-based hospitals by an organized criminal group that essentially Decided that they would go to no end to come up with ways to extort and disrupt business operations at healthcare organizations in order to make money. And so when I think about that, I think about dozens of intrusions at healthcare providers that essentially dealt with a highly disruptive attack that occurred over the course of a few days, where threat actors typically phished their way into the organization, found ways to escalate privileges, move laterally across the environment, Delete backups where they could, and then deploy ransomware encryptors across healthcare organizations. And when you think about the impact of ransomware at healthcare organizations, I mean, some of these hospitals, they were diverting patients to emergency departments at other hospitals. And so just think about the end user or somebody that ended up going to a hospital and ended up getting rerouted to another hospital. You know, it's just, it's a really terrible situation. When I think back to the incidents in October of 2020, I don't recall seeing cloud assets being impacted. I think it was mostly on-prem intrusions and impacts.

So while we are thinking about it, I guess that does make sense to me. So maybe it's a question to both of you, Taylor and Charles. So do healthcare CISOs nowadays have time for anything but ransomware? Because even in Charles's response, the highlight was, of course, on ransomware because it's an availability attack. The attackers likely take the data with them too. So is there anything else Is there anything else that's keeping healthcare CISOs up at night?

From my perspective, having been a CISO in healthcare, I think some of what Charles was talking about really highlighted a major and important shift in where healthcare CISOs need to be focused. Pandemic, tons of stress on the healthcare system to deliver, to stay running. The bad guys knew it. And instead of saying, all right, well, we're going to go take this like sort of difficult to monetize PHI focus that we've had over the years and instead shift it to disrupting something that we think we can get paid for, i.e., shutting the systems down. They demonstrated that there was this shift in focus and that that shift in focus had some substantial value attached to it. Now, what does that mean with respect to your question about having time for things other than ransomware? I mean, if they don't have time for things other than ransomware, they need to have, or they need to find time to deal with things other than ransomware. And that's putting the controls and hygiene in place to prevent ransomware in the first place.

So if you're not dealing with ransomware, you're preventing ransomware?

Well, I mean, I think that's where we need people to be thinking is, look, like, A, you need to adopt the opinion you can do it, you can win. That's not to say that you won't have losses in between, but over time we need to adopt a perspective of positivity that if we work hard and do the right things and we execute basics well, we can stay reasonably ahead of most of the threats we face.

Wait, does this mean you're seeing a defeatist attitude in the industry right now?

I think that it's easy to adopt a defeatist attitude. I think we're seeing it a lot in marketing of cloud security and other on-prem security products. I think that fear doesn't help encourage security professionals to focus on, hey, you know, we don't need to do everything really well. We need to do certain things very well.

Hmm.

And I think this is obviously a cloud discussion. So, like, one of the conversations I see a lot of, which sort of supports my point, is the cloud can do so much more to help organizations become more resilient. against threats to their systems, not just ransomware. And it's not just think of cloud as a backup or a restoration benefit to on-premise system attacks. When you reinvent your architecture, you eliminate classes of attacks like ransomware entirely. But, and we need healthcare CISOs to not only be focusing on hygiene, doing things really well, like credential management, patching systems, having secure networks, Et cetera, et cetera. Those things really matter. But also to be looking at new architectures too that could help them not only address the limited attacks but also avoid them entirely in the future. If they don't have time, they need the time. And if they're not thinking about things and they need ideas, that's what I'd be thinking about.

But I mean, what about insiders? Sorry, it's a bit of a left-field question. But in traditional thinking, I guess you assume that in a healthcare setting, insiders want to peek at celebrity health records and all the classic insider scenarios. So maybe Charles can enlighten us on more fun— sorry, I keep thinking fun, but like more scary insider scenarios.

Yeah, look, I'll tell you, insider threats are very real to healthcare organizations, particularly those that are really research-focused, that are trying to come up with ways to cure cancer, to cure diseases. I think one of the more prevalent threats that we are dealing with and that we hear about, and we've heard about over the past few years, are those that are related to foreign governments that have talents programs where they're essentially trying to acquire knowledge from their citizens and their people that are distributed across the world. If you think about it from their perspective, it makes a whole lot of sense. They have people that go out to a variety of research institutions across the globe and they learn a lot of things. Where things get a little bit tricky to handle are the situations in which you've got legitimate researchers or physicians that have access to organizations, and you sometimes find that they end up stealing or taking a lot of information from those organizations that they work with because they have legitimate access to obtain that data. And it sometimes gets really tricky to understand, you know, is a physician that's downloading gigabytes of data doing it because there are legitimate reasons for them to get access to that, because maybe they want to do additional research on their home computers, which, by the way, may be very legitimate and may be authorized means of Where it gets tricky is kind of understanding when do those situations lead to situations where those researchers share that data with other people that perhaps want to use it and maybe want to share it with state-owned enterprises within the countries that they came from. So it gets, it gets really difficult, but there have been a number of arrests. There's been termination of employments for a number of prominent physicians and researchers that have worked at some of the larger healthcare research institutions. And so, yeah, insider threats are a pretty big problem. There's another category of insider threats that I'd also mention that are more malicious in nature, where you have individuals that might steal data from those organizations that they work for, and they end up extorting the companies. So they're looking to make money by threatening to publish data that they've stolen from the organizations that they work for. And so we see that in some situations. Usually, the people that are doing that aren't very sophisticated criminals. They don't necessarily have the most advanced techniques to steal data. They don't necessarily cover their tracks very well, and often when approached, they confess. That's probably the other category of insiders that we tend to deal with when we do investigations at Mandiant.

I want to pick on that because I think there's a couple of interesting threads there. One, are there monetization paths for this kind of data outside of extortion? Well, let's start there. What are the monetization paths for this kind of data other than extortion?

You're not paid enough? You want to go into criminal business, Tim? Seriously?

The thoughts crossed my mind.

The look on your face.

Yeah. From my perspective, I think extortion is probably the most lucrative way to monetize stolen data. I personally feel that it's hard to monetize stolen healthcare information nowadays. For whatever reason, I don't really see the data being stolen and sold on markets. One thing that I actually find pretty interesting is, although we see threat actors disrupting hospitals, they don't seem to really have an ethical dilemma with doing that. For whatever reason, I do see threat actors threatening to publish stolen healthcare records. I just don't see them following through with that very often. I don't know why. I don't know if they have an ethical dilemma with that or what, but for whatever reason, I see very few threat actors actually publish healthcare data that's stolen. I see healthcare data being stolen quite often, I just don't see it being published. I just can't quite explain why that's the case.

I can think of only one relatively well-known example of that actually, and it was mental healthcare data in a Scandinavian country. I want to pick on another thing there about insider threat and foreign exploitation. You mentioned that. What's the foreign exploitation angle on healthcare data? I can understand this in defense contracting or jet engines or rocket ships.

But he said healthcare research, medical research. That's what Charlie said, right?

So it's research. I see.

Exactly. So it's research. It's not protected health information. It's what are the latest and greatest innovations around curing cancer or treating cancer.

Sure.

Obviously, when you think about a growing population that's dealing with disease. They want to know how do they take care of their people.

Yeah. So let me prod Taylor a little bit and say, dude, you're, you're a CISO. Would you think about it right away? Like, would you think research versus PHI? I, I, I'm puzzled myself. Like, I would not think about it myself. I would be like, protect PHI. But then Charles reminds me, they may not be after PHI, they might be after health medical research data. So is that a natural thinking for CISOs, Taylor, or not?

Well, I mean, so yeah, I kind of have to look at the path of monetization. Then you have to kind of look at How that data would then be used. Research is built on PHI. So, if your research is the goal, PHI isn't, you're going to go for the research that it's built on. It makes sense. PHI can use, or protected health information can be used to create leverage on people in negotiations. It can be used for a variety of reasons, and insiders want it for a variety of reasons. And like calling it just extortion at a high level kind of misses the point because there's many forms that extortion can take.

Mm-hmm.

The other thing I'd say is like, we confuse PHI also, like, with like being the only data the health system has that's valuable. Charles brings up research. I would bring up the keys that keep your system operational. I'd also throw out there, and this has been something we've seen increasingly, is like the medical equipment itself is being attacked. These are things that are attached to your body that provide life-sustaining care while you're in surgery or keep you alive outside of the operating room, things like Implanted cardiac devices, pacemakers, et cetera. Those things, those things are being increasingly attacked. You're reading quite a bit about, I think it was a month ago, we were just reading about major vulnerabilities in a lot of this equipment. And that's really important because, yes, extortion is interesting. Extortion certainly is one way of using data acquired from a medical facility to make money. I don't mean to scare anybody, but if you really want to raise the bar, on monetizing insider or outsider access to a health system. There's nothing like affecting a vulnerable pacemaker and then extorting someone's health.

So you're trying to tell me that it's not just FUD, there's like real— it's like I need to lose my sleep over that, right?

I think you go read about Urgent11 or the Access7 vulnerabilities and you'll get what I'm talking about.

Yeah. And by the way, from my perspective, I definitely think there's a number of security vulnerabilities that exist in healthcare technology, and that's something that we all need to think about. The good news is, at least from my perspective, and perhaps there's a case of bias, but I don't have any real-world examples where I've seen threat actors actually exploit medical devices that maintain life. And thank God I haven't seen that. But certainly at some point in time, there are very real-world vulnerabilities that security researchers have identified and have been able to demonstrate proof of concepts. I just hope that the criminals that have the ability to do this choose not to do it because there's obviously an ethical boundary that many don't want to cross.

These sound like the kind of attacks that would raise one's blood pressure or get your heart rate up.

They're raising my blood pressure already. And of course, I've known about them. I was just afraid Charles would say the opposite. And by the way, Anton, these are not just myths. They happened to such and such company 3 days ago. I was like, he's not saying that.

And again, I do recognize I've got a case of bias. Nobody's called me and nobody's called my organization to deal with this.

Let's hope it stays this way. So to switch topics to something maybe more mellow. So this is another Charles question based on his IR experience. All we hear about is phishing, right? Phishing, how easy it is, how— well, not at Google, of course— how easy it is at some other companies. But based on your experience, what are the more interesting ways in other than phishing? And by interesting, I mean, again, popular with attackers, those that work. I guess I get the phishing part. Like, take phishing out and tell us what's going on in addition to that.

Yeah, absolutely. It's really timely because we're in the process of publishing the mTrends report, which basically summarizes the key themes and trends that we observed in our caseload data from the prior year. And there's a few things that we noticed. Actually, there's a decline in phishing that we've observed. And so what we're actually seeing more of now is the exploitation of vulnerabilities.

Hmm.

And it's a combination of zero-day vulnerabilities, but also vulnerabilities where patches are available but just haven't been applied to organizations. And we saw pretty massive exploitation last year. We saw exploitation of the Accelion product, Microsoft Exchange. There's countless products that were mass exploited. And there are a few things that stood out to me. One, it's actually uncommon to see state-sponsored threat actors mass exploit particular vulnerabilities. We saw Log4j vulnerabilities that impacted a variety of different software. And we saw a number of threat actors, government-affiliated, that were very quick to exploit that in a large order and with a lot of different targeting, a lot of different victims. So that's becoming a much more popular way for threat actors to break in. Another way is by leveraging and exploiting easily guessable passwords or password reuse. So just think about using the same password on multiple sites.

So '80s. Oh my God, I want to cover my ears and then just scream. Yeah.

The fact of the matter is, you know, when you deal with organizations that have tens of thousands of employees, you know, there are a lot of people that have their favorite password and they choose to use it across a lot of different websites. And so when one site gets hacked, there's a pretty standard methodology for threat actors to just download all the password hashes, Use GPUs to crack them and attempt to reuse those passwords across a variety of sources. And they get in, and it's a pretty common thing.

Yeah.

Well, your question next, Anton, is, well, what about MFA? Well, the trick that threat actors leverage is they do MFA push spamming to people. So you get their username and the password right, and then you get a prompt for an MFA or a code. And when you have the opportunity to push and create a popup on somebody's mobile device, if you do it enough times, somebody's going to get annoyed and just click yes. And that happens quite often. We saw state-sponsored actors doing that last year, and we see kids that are hacking for fun that are doing that right now. It's a pretty effective technique to get in. Then there's obviously the supply chain attacks, but not supply chain attacks like the sophistication of what UNC2452 did at SolarWinds, but really it's where threat actors break into service providers, steal credentials, where those credentials allow the threat actor to access a variety of other environments. Or the network of a company that gets hacked facilitates access to via maybe VPNs or whatnot into other companies. So we see a lot of that right now.

The model of cracking passwords for known accounts, then spraying them at scale. When I was at Shape, we coined the phrase credential stuffing for that.

Yeah.

And I've always enjoyed that expression.

Absolutely.

The supply chain with suppliers is such a funny old is new again thing too. I mean, that was how Target got owned back in the day.

Yeah, what's funny is SolarWinds in December 2020 changed everybody's definition of what a supply chain attack is. And so if you ask people what a supply chain attack was in November 2020, they tell you something very different than what they said in January 2021 and beyond. But, you know, we often forget about the attacks on credentials of vendors that have access to environments. And so that is a very common technique for attackers.

Not to date myself, but I can still remember NotPetya was distributed through a malicious update through an accounting package. that got pushed. So I don't know if it's the OG of supply chain attacks, but it certainly, to a certain degree, SolarWinds and it were similar in that respect.

Yeah, and that was definitely another large-scale but different kind of supply chain attack. But now that you mentioned NotPetya, I can't talk about NotPetya without clarifying one thing that everybody seems to get wrong. Everybody seems to talk about the EternalBlue vulnerability that was exploited as part of NotPetya, and they talk about that as if that was the main way in which the wiper propagated. It wasn't that. It was— that certainly gave access to some systems, but the main propagation occurred because they leveraged a Mimikatz type of capability.

Local admin passwords.

Exactly. And then just propagated up.

Yeah.

People were patched. I mean, if you talk to anybody affected by NotPetya, most of them were patched and they still got it because this other sort of hygienic issue around password and credential management, which we talked a little bit about before, wasn't on anyone's radar. That changed quick.

Absolutely.

So we're getting towards the end of our time today, and I want to do one question before we get to our usual final question. Should we pay the ransom?

Oh, come on.

And I think maybe it's like, I want to make it like, let me squeeze Taylor a little bit here. Like, I'm going to go harder on Taylor. When you were a CISO, would you have paid, or would you have recommended your boss or your boss's boss to pay? And if yes, when?

Can I give you their Social Security number too before I answer? So like, look, Every situation is different. Every situation is complicated. We hope that people can do their best with the data that they have when they're in those situations, that the data they have is accurate, that the people they're working for are telling them the truth, and that they have a full understanding of their options. I would say that if it were me personally, like, my strong preference would be no. But again, I'm not in a scenario right now where the impact of saying no Prevents healthcare, prevents the livelihood and safety of other people. That scenario is very different than the one I'm in here. I mean, if you ransom to me right now, you'd just get a pretty old laptop and a cruddy monitor I could go to Best Buy and fix, right? The impact of that event on me now is not huge. But as a healthcare CISO, when I'm running 4,000 beds, supporting 3,000 physicians with potentially up to 20,000, 25,000 people all getting care at the same time, The math changes and you got to take all that in. So there's no clear answer to that question. It is ultimately, it comes down to things that affect payment the most are obviously what's at risk, what the residual risks of that are, how prepared you are to make one decision or another, and what impact that has on the things you value most. And that's really what it comes down to.

But then what does IR tell us? Does it mean that you're going to get, for example, this whole repeat ransoms and other stuff? So what can IR tell us about this?

Yeah, so I've got a few perspectives. Like, first of all, my position on paying extortion demands has evolved over the years based on what, what I've learned and what I've actually seen happen. About half of my clients end up paying, and they pay because they feel that there's no better option but to pay. And it's not because they have bad backups. In fact, most of my clients actually have pretty good backups. They're paying for a few reasons. One, a very common reason is, although they have good backups of all their systems, they don't have the scalability and the resiliency of their backup infrastructure to be able to restore every single server and workstation that was taken offline. It's just a challenge because of bottlenecks with the backup infrastructure. Other times, the threat actor impacts the backup infrastructure, and so that becomes challenging. And so you've got to revert to offline backups, and that's a time-consuming process. And you just think about the number of days that go by where you can't conduct business operations. And if you think about a healthcare facility, you're potentially impacting human lives. And so those are things that come into calculation. Other things that come into the calculation are how valuable is the data that was stolen and how impactful or harmful would it be if that data showed up on the public internet. Nobody wants materially sensitive data to show up on the internet, and so those are things that people take into consideration. Other things that people consider is, is if you pay the threat actor, will they go away and will the chaos stop? And a lot of times the chaos does stop when you pay the threat actor. It depends on how And this is going to sound silly, but it depends on how reputable the threat actor actually is. And there are definitely degrees of reputability of threat actors because they recognize the business model requires them to produce positive outcomes when you pay them. In terms of caseload data, we don't often see the same exact threat actor re-extort a company after they've already paid that threat actor. We see other threat actors break into those organizations. They probably had no idea that they had been compromised before and that they had paid an extortion demand. But in general, threat actors, when they get paid, they tend to move on. They go away because there's a relatively infinite number of victims that they could pick and choose from.

That all depressingly makes sense. So I want to wrap up with our traditional final questions. First, what's your tip to improve resilience in healthcare? And then 2, do you have recommended reading for for our listeners so we don't leave them empty-handed.

And of course, we're going to link to MTREND. So saying MTREND is a bit cheating because of course everybody knows this report's kind of everybody's favorite. So we're going to link to that. But what else?

Sure. From my perspective, there's 2 things that I tend to recommend to healthcare organizations. Number one, conduct a red team exercise. Don't give your testers limitations. Allow them to test anything the way that a real-world adversary would. And don't feel embarrassed or ashamed if the testers are able to get access to materially sensitive data or patient information, or perhaps could disrupt healthcare giving operations. Use that as an opportunity to learn and make improvements based on that. I think what's common is there's a stigma associated with red team exercises where if the testers break in, the CISO did something wrong. Sometimes this may be the case, but usually it's just, hey, it's a great opportunity for the good guys to hack in, Find vulnerabilities and get 'em fixed. Second thing I'd recommend healthcare organizations do is conduct a tabletop exercise and get the business leaders involved. So get the CEO involved, get the general counsel involved, get the IT leadership and, and other business unit leaders involved. Because when you're dealing with a business disruption event, it's not just an IT problem. There are a lot of business leaders that will have some level of expectations and involvement in responding to an event. And so it's good for them to understand what are the roles and responsibilities and expectations of them. In terms of reading, of course, MTrends, but beyond that, there's a guide that we put out. It's essentially Mandiant's playbook for how we respond to multifaceted extortion events and what are the key things that we do on day zero when we get involved. So what are the tactical remediation steps? We call it— I think we call it the Ransomware Protection and Containment Guide. It's available on the Mandiant website. It's a few dozen pages of very specific tactical information to help organizations better prevent these types of events. But again, it's our playbook that we use on day zero in a very consistent manner when we help organizations. And we wanted to release it for free because it's the right thing to do.

So, I got to say, I don't know, Charles, if you read the blog on building a resilient healthcare system, but you cited 2 of the 5 practices we highlighted in the first blog. I want the listeners to know that Charles and I didn't do this on purpose, but I'm glad that I get to take a small chunk of property in Charles's brain for the next 20 years as he thinks about it.

I love it.

But, yeah, I mean, I would say go read those blogs. There's 3. By the time this podcast will be released, there's 3 that get into building a resilient healthcare system and it covers these what we're calling antifragility mechanisms. So, tabletops, actually purple teaming is the suggestion, although closely— and the reason purple versus red is we want to Find and fix as we go versus just having a day at it. And the third is— oh, God, I got to pull it up. But tabletops and purple teams are prominently featured as antifragility mechanisms. And an antifragility mechanism is a mechanism if you buy the belief that intentionally exposing yourself to harm will actually make you stronger over time if you learn how to adapt to that harm and turn it into a strength. If you buy the belief that in order to get get better, you have to break things, which is what I think resilient organizations do, then you will build resilience through relatively simple mechanisms like tabletop exercises and collaborative penetration testing and red teaming. But there are other things you need to do around building visibility and structural awareness into your assets, and some of the blogs get into that.

Well, listeners, we will make sure that the blogs are available. Taylor, Charles, thank you so much for joining us. We really appreciate your time today. You two are Well, Taylor, as ever, a lovely guest. And Charles, we're going to have to find the time to have you back on the show. Listeners, thank you for joining us.

Awesome. Excellent.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Juvaikinen and TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.