Cybersecurity Challenges for PACS and Medical Imaging

Abstract

Cybersecurity issues have been on the rise for years, increasingly affecting the healthcare sector. In 2019, several attacks have been published that specifically aim at medical network protocols and file formats, in particular digital imaging and communications in medicine. This article describes five attack scenarios on picture archiving and communications systems (PACS) and medical imaging networks: the import of patient data from storage media containing malware, a compromise of the hospital network, malware embedded in digital imaging and communications in medicine images or reports, a malicious manipulation of medical images and a network infiltration of malicious health level seven messages. Prevention and mitigation measures for each of these attacks exist, some of which can be implemented by the system user (e.g., hospital), while others require implementation in the PACS and medical imaging devices by the vendors. In practice, however, many of these are not in common use. What is missing today are PACS network security guidelines for practitioners that support users in keeping their network secure. Furthermore, integrating the healthcare enterprise integration profiles and test tools might be needed to address the deployment of public key infrastructure and digital signatures in the PACS environment.

Influence of Human Factors on Cyber Security within Healthcare Organisations: A Systematic Review

“…Such threats, commonly categorised as “social engineering”, allow the attacker to exploit the large amount of public information hosted on social media platforms to gather the personal information of healthcare professionals [ 15 ]. Social engineering attacks are designed to circumvent traditional cybersecurity measures [ 18 ]. A well-known social engineering method is phishing.…”

“…A well-known social engineering method is phishing. The role and impact of phishing attacks have been well studied in the literature [ 8 , 9 , 10 , 13 , 15 , 16 , 17 , 18 , 41 , 43 , 55 , 56 ].…”

“…Following the increasing number of articles being published, addressing the role of humans in the loop for enhancing the cybersecurity since 2016 [ 8 , 9 , 10 , 11 , 12 , 13 , 14 , 15 , 16 , 17 , 18 , 19 , 20 , 21 , 22 , 23 , 24 , 25 , 26 , 27 , 28 ], there is a need to consolidate the research findings. The main objective of this systematic review is to review the literature to gather evidence from organisational case studies, author observations and scientific developments in cybersecurity to identify the role of including humans in the loop for strengthening cyber defence within the healthcare industry.…”

Cybersecurity Protection for PACS and Medical Imaging: Deployment Considerations and Practical Problems

“…It also enables the PACS to maintain an audit trail that documents which actions were performed by which user À information that will be important in the case of an unauthorized disclosure of patient data. The deployment of such an audit trail, based on the IHE integration profile "Audit Trail and Node Authentication" (ATNA, see Section Product Support), is one of the apparent omissions in (1).…”

“…In the recent years, there has been dramatic increase in cybersecurity incidents in the healthcare sector, such as computer virus infections, ransomware, and the theft and publication of patient data. We have recently analyzed specific cybersecurity challenges affecting medical imaging and PACS networks (1), and also proposed a specific list of security measures. A synopsis of these security measures is shown in Table 1.…”