Cybersecurity Protection for PACS and Medical Imaging: Deployment Considerations and Practical Problems

Abstract

Cybersecurity is increasingly affecting the healthcare sector. In a recent article, the authors analyzed specific attacks against picture archiving and communications systems (PACS) and medical imaging networks and proposed security measures. This article discusses issues that require consideration when deploying these proposed measures and provides recommendations on how to implement them. Hospitals should deploy virus scanners on systems where permitted, with high priority on devices that are part of the central IT infrastructure of the hospital. They should introduce a systematic management of software updates on operating system, application software and virus scanner level and clarify the provision of security updates for the intended duration of use when purchasing a new device. They should agree with the PACS vendor on a long-term strategy for implementing access rights, and enable encrypted network communication where possible. This requires an agreement on the encryption algorithms to be used, and a public-key infrastructure. For most of these tasks, standards and profiles exist today. There are, however, some gaps: Implementation of cybersecurity measures would be facilitated by integration profiles on certificate and signature management, and access rights in a PACS environment.

Cybersecurity in health sector: a systematic review of the literature

“…To this day ransomware has been affecting considerably in the health sector, these cybercriminals block the communication of medical devices that are being used, and these medical equipment are the ones with more vulnerability to attacks despite their importance to save lives [22], [33]- [35], have also led to the interruption of different scenarios such as the radiotherapies of thousands of patients, mostly on the impact of COVID-19 [36]- [38]. Similarly, the authors mention that there are numerous security concerns, such as denial of service, spoofing, and remote hijacking, these cyber-attacks are associated with internet connectivity in medical things, and such devices mostly have security and privacy issues as they have very limited computing power [39], [40].…”

Framework for cyber risk loss distribution of hospital infrastructure: Bond percolation on mixed random graphs approach

“…\end{equation*}$$ Scenario II . The second scenario is a hospital with high cyber protection by keeping devices updated with the most recent patches, using authentication credentials, removing default passwords, and implementing any other cybersecurity protection methods (Eichelberg et al., 2021). Multiple settings for the low probability of edge contagion are characterized by $$p_{i}=q_{i}$$ for each component in the following $$$$\begin{align*} &p_{IMW} = q_{IMW} = 0.10, &&p_{DW} = q_{DW} = 0.15, \\ &p_{PM} = q_{PM} = 0.20, &&p_{IP} = q_{IP} = 0.25 \end{align*}$$$$and varying values for the edges between the PACS and HIS system by having $$$$\begin{equation*} p_{PACS} = q_{PACS} \in \lbrace 0.40, 0.35, 0.30, 0.25, 0.20, 0.15\rbrace \end{equation*}$$$$and between the HIS system and CNS by letting $$$$\begin{equation*} p_{CNS} = q_{CNS} \in \lbrace 0.35, 0.30, 0.25, 0.20, 0.15, 0.10 \rbrace .$$…”

“…The second scenario is a hospital with high cyber protection by keeping devices updated with the most recent patches, using authentication credentials, removing default passwords, and implementing any other cybersecurity protection methods (Eichelberg et al, 2021). Multiple settings for the low probability of edge contagion are characterized by p i = q i for each component in the following p IMW = q IMW = 0.10, p DW = q DW = 0.15, p PM = q PM = 0.20, p IP = q IP = 0.25 and varying values for the edges between the PACS and HIS system by having p PACS = q PACS ∈ {0.40, 0.35, 0.30, 0.25, 0.20, 0.15} and between the HIS system and CNS by letting p CNS = q CNS ∈ {0.35, 0.30, 0.25, 0.20, 0.15, 0.10}.…”

“…Since medical imaging digital files use DICOM, the DICOM Part 10 File Format had a vulnerability that can "contain the header for an executable file, such as Portable Executable malware" according to CVE 2019-11687 with a CVSS base score of 7.8. Eichelberg et al (2021) analyzed other specific attacks and threat vectors of the PACS system. Such threats could allow an attacker to compromise connected clinical devices and laterally spread malicious code to other devices on the network undetected (Health Sector Cybersecurity Coordination Center, 2020.…”

Enabling Your Radiology Business to Thrive Strategic Lessons Learned During the Initial and Subsequent Surges of the Covid-19 Pandemic

“…Our staff who were affected by fraudulent activity appreciated the timely notification, free credit check opportunities, names of contacts in our HR Department, resources for state and police reporting, for credit company notifications and freezes, and for bank notifications. If processes were not already in place to protect your data and that of your patients, these must be prioritized as widespread use of remote clinical, education and communication systems will subject you to cyberattacks (18). There have been a number of recent high profile, high impact attacks on University of California San Francisco (UCSF), Washington DC and U Vermont.…”