Many Board members may have seen the reports published by the Office of the Australian Information Commissioner (OAIC). It talks in broad terms about the huge spike in mega breaches of data in the health sector. The OAIC report shows an eye-popping 1 million affected people in this sector alone. As a remediation method, the Privacy Commissioner has suggested data minimisation as one of the key methods for businesses in the health sector to adopt to safeguard the exposure of their patient’s data in case there is a breach. Data minimisation, in simple terms, means that hospitals must hold only the very basic information of their client to do their job.
For hospitals and clinics that face strict regulatory scrutiny, it is best to partner with cyber security auditors. These professionals have the expertise to identify whether they are hoarding any obsolete data that may face exposure in the dynamic and complex digital environments. For one of our clients in the health sector, this regulatory warning came very close to becoming a costly reality. This client shared with us how an attempt was made on their digital infrastructure. They said that the malicious packet arrived at their domain through their warehouse management department, which was connected to a compromised supply chain connection. This connection was being used to sync the current stock level at the clinic of medical supplies with a third-party medical supplier.
The hackers first breached the external network at the supplier’s end and then used that trusted connection to get patients’ data from the hospital. On analysing the threat, experts at our Cybernetic GI later concluded that their primary goal was the internal database of the hospital, where they could have laid their hands on years of archived procurement requests and some sensitive details of specialised medical orders.
Disaster was avoided because the warehouse manager found a distinct anomaly when he was reviewing the morning stock levels on the dashboard. The issue that caught his eye was that the supplier interface, instead of requesting current supply levels of medical equipment, was repeatedly sending requests to access the historical procurement archive. The manager immediately stopped the external connection and reported this activity to the internal IT team. The IT team snapped the connection permanently and avoided a serious data breach.
The warehouse manager developed the skill to notice such anomalies and had a clear understanding of what to do when faced with such a situation. To help the employees at our client’s hospital develop such skills, Cybernetic GI conducted an awareness training for non-technical logistics staff. This training apprised them of what red flags they must look for and, in case they face such a situation, what they should do and to whom they should report.
Before training the personnel, Cybernetic GI conducted a vulnerability assessment of the digital infrastructure to check how secure the third-party vendor integration was.
After conducting the API penetration testing, we identified the security gaps and reported the same to the executive board. The board used our analysis and remediation suggestions as a blueprint to execute the technical fixes to plug any security holes in their digital infrastructure, restrict vendor access, and implement strict data minimisation rules. By working with a professional, certified cyber security consultant in Australia, like Cybernetic GI, the company was able to create a strong base of architectural boundaries with trained personnel. This change in the security architecture of the digital infrastructure is what helped them ensure that a targeted supply chain attack remains blocked.