Francois Driessen presented at the 2024 Healthcare and Pharma Cybersecurity Virtual Summit on the conventional security paradigm that appears to be failing the healthcare industry.
The presentation is relevant well beyond healthcare: to any organization focused on safeguarding intellectual property, confidential information, mission-critical operations or IoT and OT systems, or that is vulnerable to ransomware.
Let’s protect people the way they deserve.
Full Transcript
Francois Driessen: Hello, my name is Francois Driessen and I am with ADAMnetworks, and it’s really nice to have you for this session. I’m looking forward to spending a little bit of time with you to unpack specifically healing of a broken philosophy that keeps hurting healthcare. So as we go through this together, we’re really going to be looking at four key things. I will be looking at the conventional security paradigm: where is it actually failing healthcare and pharma? And then what’s actually happening, like why is this actually happening, and looking at some practical elements of the attacks versus defense and so forth. And then diving into a new philosophy that we refer to as Zero Trust Connectivity, and then applying that, or showing you some examples of it being applied, so that we can explore the value that that actually does have for the healthcare and pharma industries. So with that, I’d love to just go ahead and jump in with you guys.
About ADAMnetworks
Francois Driessen: So a little bit about ourselves as ADAMnetworks. At the core, what we do at ADAMnetworks is that we protect people. Our primary focus is that technology should serve people. For me to speak about any technology, no matter how exciting or fancy or new it is, if it’s not actually making someone’s life better, then it essentially is useless. And so at the core, we want to make sure that technology is wrangled properly so that in the end humans benefit from it, versus the other way around. And I think that specifically in the healthcare industry, you’ll find that there’s a good fit if that is your approach: making technology serve people, serve the purpose of the people. I do think that we’ll see good things for all people. I mean, in short, make the world a better place, right?
Healthcare and pharma under attack
Francois Driessen: Well, the healthcare and pharma industry is under attack, and I put a little bit more focus on the healthcare side. So USA Today just reported recently that we’ve got one in three Americans affected by some sort of healthcare breach last year, and that is a pretty steep number, right? And then keep in mind that, I think, the UnitedHealthcare breaches that hit like 1.7 billion, there’s PJ&A, there’s Ascension. So I don’t think I have to rehash what we’re already reading in the news.
Francois Driessen: But let’s look at specifically the areas that we feel that the security industry has not really delivered for healthcare and pharma. And the first one is ransomware. I mean, that is, I think, right on the top there. And we will look at why this is actually happening, but let me just say this: I do not think that ransomware is as prevalent as it is because hospitals and the healthcare industry doesn’t care. I don’t think that that’s the case. And neither is ransomware a new thing; it’s been with us for a long time. The issue here is that it’s not going away; it’s actually increasing.
Francois Driessen: And then the next thing that goes on top of that is the data extortion. So if you don’t pay up, next thing is, okay, private information that’s getting leaked out. Now that doesn’t just affect the healthcare and pharma industry; that affects the patients, the people that we’re supposed to be serving, right? And then you get to the triple extortion, where, okay, fine, these compliance bodies that are supposed to be there to help make sure that things are secured are now used as additional leverage to extort the victims in health and pharma industries. So you don’t pay up, they’ll just go ahead and report you. They’re so nice to do that, for the governing bodies.
Francois Driessen: So there’s another interesting thing that I think is important that we’ll be looking at, is that medical IoT has lots of vulnerabilities, and we’ll look into that a little bit more. But then this is a fundamental lack of protection for medical IoT, for operations technology in the industry, and we will dive into that specifically. And then another thing to keep in mind: in cyber warfare, everyone is a target. And know that pharma and medical, of course, are essentially high-value targets, and your soft targets, right?
Understanding the target
Francois Driessen: So why is this happening? Okay. What we should be doing here is really just, let’s look at the target, to understand that fully. Let’s look at the defenses, and then let’s look at the attacks. And I think once you understand those three aspects, I think it will be quite self-explanatory why we find ourselves in the situation that we’re finding ourselves in for healthcare and pharma.
Francois Driessen: So let’s first make sure we understand the target. So first of all, I think what we need to say and understand right off the bat: when we’re speaking about healthcare, we’re speaking about pharma, we are speaking about really infrastructure that affects human lives on an existential value. It is not just a matter of not being able to get something that you want. These are really matters of life and death. And something as simple as a disruption that prevents normal operations for a hospital can really be an issue of life and death for someone, or for a family could change the course of the direction of that family forever, really. And so that’s, I think, the first thing that we need to know when we actually look at healthcare and pharma as a target, and handle it with that proper respect.
Francois Driessen: The next thing is that anyone’s data, when it comes to being a patient, you are in a vulnerable position, and that data that gets out there is, I mean, everything is confidential. And then of course on the pharma side, the information that is contained within pharma operations is obviously filled with intellectual property and trade secrets, right?
Francois Driessen: One more thing, I think, to just look at is that, as I’ve already mentioned, in cyber war everyone is a target. And I think we’re reaching a point where we can’t just ignore that, because hospitals are a great way for actually getting information about military personnel, about your first responders and so forth, because it’s an easy way. People by nature have to divulge personal information, very deeply personal information, when they’re in the vulnerable place of having to get healthcare, right? And that lives in a central place, and so obviously it’s a very juicy target for any APTs, right? And then in non-kinetic warfare, as I’d mentioned, if you can take down healthcare, if you can prevent those services from happening, that’s a whole chunk, really, that you can take out of the defense capabilities of a country that you would wish to attack. And of course in bioweapons, pharma will be targeted directly.
Francois Driessen: And so almost the way to think about it is that, the medical part, you have this armored horse, and the medical system, the healthcare system, is really kind of like the soft underbelly. It’s an essential part of this warhorse, but it’s not armored like the rest of the military elements of a country would be. So it’s an easy way to get to your target.
Francois Driessen: Yes, I don’t think you guys would be strangers to this, but there’s another huge issue that plagues healthcare and pharma, specifically healthcare in the medical world, is that medical IoT is very, very hard, if not impossible, for most to protect properly. And the reason for it is because the norm is to get stuff to work, then get it optimized. This is the evolution of technology, really, and then to get it secured. The internet itself is on that same path, and the internet is sitting at this point where it’s between optimized and struggling to get the security part. So anything that connects to the internet is going to be subject to the same vulnerability that the internet itself is subject to, and we’re going to be diving into that a little bit more.
Understanding our defenses
Francois Driessen: Okay, so let’s talk about understanding of our defenses for a moment. The first I want to cover here is the notion of the operational technology air gap. And to a large extent the whole movement for protecting OT is to say, hey, let’s keep it air-gapped. Now in medical, in healthcare, the idea, I mean, that’s failing OT, and it is merging. Everything is becoming connected, interconnected, all the time. And when you look at the actual incident response cases, it’s always: well, I thought there was an air gap, but oops, it was breached here, right? And in medical, that’s something that’s not really even applicable. Every new device pretty much has some sort of way to either get updates or send data somewhere. So that notion, I don’t think, is really relevant much more on the healthcare side.
Francois Driessen: Now let’s look at the NIST CSF for a moment, which is sort of like the spine, really, for the whole cyber industry, or security industry: governing, right, through identify, protect, then you detect, you respond and recover, right? We’re highlighting detect here just because that is the way, nothing on NIST specifically, but that’s the way that the industry has taken this and put all of the innovation focus on: when you actually hit the detect phase, that’s where your fancy technology comes and kicks into gear. That’s when you call out all of your cyber ninjas, and that’s when you act. That’s when the fight really starts. And I want to show you guys something about that specifically.
Understanding the attacks
Francois Driessen: So now let’s look at the attacks, right? So an attack can be very complex. The attack chains can be so complex that that would be a whole presentation just on that. But what I’ve done here is just to highlight a few recurring key elements that I just want to draw your attention to. So first of all, there’s initial access; that’s important. There’s defense evasion; that’s really important. And then exfiltration, impact. So if we were actually taking this attack framework and distill it down, let’s talk about it this way, because all of the details of the intricate stuff that happens is not that important for where I’d like us to go.
Francois Driessen: So they need access, right? That’s the first thing that needs to happen. And then you may need to make sure that you do not get detected, right? And the next thing that is incredibly important in a successful attack is having egress, right? You need to be able to have command and control. You need to pivot to other positions. You need to be able to exfiltrate that data so that you can now run your extortion campaign, or encrypt or disrupt, whatever your real motive for the attack is, right? So let’s just treat it that way to simplify things.
Francois Driessen: Now let’s look a little bit at the defense and attack, and where these things fit into each other. Going through identify, protect, detect, respond, recover: the main attack events that need to happen in the attack chain all happen before you hit detect. And so data is exfiltrated before detection takes place. Encryption can be the way that you actually detect, right? Or even the extortion part of it. So what you see here is that the industry has moved to put all of the innovation effort onto the detect phase, but the issue here is that everything in the attack happens really before we hit that phase. And so we see this as a failing philosophy, really.
A failing philosophy
Francois Driessen: And the consequences of this failing philosophy is really that even if you had real-time detection, it’s not fast enough. You’ve already been breached, right? The attack has already taken place. Leaked IP and confidential data, it’s not going to come back. Your data extortion cannot be recovered with data backups, all right? And reputation damage is permanent. The effect that it has on employees in the industry, the effect that it has on patients, it can be permanent, right?
Francois Driessen: And so the way that the industry is now moving is to say, well, let’s get AI into the mix. Okay, wonderful. But the issue here is that that AI is mostly set on the detection phase yet again, right? And guess what’s happening on the adversary side? Well, they’re also using AI. So now AI is used in their creation, as well as making sure that the evasion is successful, right?
Francois Driessen: And so a very interesting thing happens here, like anyone who’s into AI in general and adversarial networks knows: you really have two AIs that you pit against each other. The one is trying to create its fake thing; the other thing is trained to detect that fake thing. And so when you put these two together, the one that’s creating the fake thing, the one that’s creating the object or generating the object, is becoming better and better and better, because every time this one says, hey, not good enough, it tries again, until this one actually gets fooled. And so essentially what’s happening in the industry is that we have created a GAN between the security industry and the adversary that is essentially creating malware that is very, very good at evasion. Because the security industry is very good at detection, the malware is very good at evasion. So this is not putting us in any different position than what we were before. The only thing is we’ve added more technology to it, right? It’s still the whack-a-mole game of: someone is doing something new that’s bad, the defense needs to know about it and be reactive about it so that they can prevent that from happening again the second time.
Francois Driessen: But there is a philosophical problem here. By trying to keep up with the bad guy, the bad guy always gets to make the first move, and by the time that they make their move, the damage has already been done. Okay, so go back to that first slide: just putting AI into the mix, we’re not in a different position. We’re just throwing more technology at it.
Francois Driessen: So it’s time to look at a cool coffee mug. Okay, I’m not going to read it; you can read it yourself. Apparently Einstein didn’t say this, from the research that I had done, but I do think it’s something worthy of living on a coffee mug. Okay, what I am going to say is this: we have to admit that harder, faster, stronger, more complicated, more AI, more expensive, more elaborate, more compute overhead is not going to change anything. It really comes down to changing the philosophy.
A new philosophy: Zero Trust Connectivity
Francois Driessen: And so what if we could change something in the fundamental structure of how the cybersecurity framework works? And here’s what we believe the solution is. What if we moved any network to the place where, instead of having to wait for the detect phase, we just say, you know what, you’re already breached? Whatever you were going to do by the time that you actually were able to detect the malware and the adversary in your network, why don’t you just move there right now? So, see, this way there’s no way to evade it. You don’t have to detect it, because you’re just going to say, you know what, I’m moving into a breach position right now.
Francois Driessen: What if we moved the protect to be the very, very first thing that you do? Out of that, have the ability to identify both assets as well as threats, okay? But what you would have done at the response phase, you do that right at phase one. And we do that by just saying, you know what, shut everything down. Deny all connections by default, and then only allow the connections that, one, are requested by a verified asset, and two, are going to a destination that is verified to be good and that is authorized by the administrator of that network. And then of course, once that connection has taken place, move back to the default state and collapse that connection.
Francois Driessen: So what’s the net result of doing this? Well, one is you can actually protect against unknown, undetectable threats. So living-off-the-land attacks, or attacks that are so advanced that they can effectively evade, you don’t have to worry about that, because you don’t have to wait for the detect to take place. You can move into it immediately. So if you stop trying to catch up with what is bad and just use your compute for verifying what is good, a very interesting thing happens. And we actually have a number to that. The number that we have found for keeping track of what is good, versus having to try and keep track of everything that could potentially be bad, for corporations that are already using Zero Trust Connectivity, is roughly 7,000 to 1. For every 7,000 potential connections that you need to explore, that could potentially happen, that could be malicious, and most of them are, okay, only one of them is essentially good. So if you put your compute on that, there’s a lot less work to do.
How Zero Trust Connectivity works
Francois Driessen: So let’s look at Zero Trust Connectivity in a very basic, simple form. So there we have a device, okay? It could be anything: a computer, or an MRI, or whatever it is. Whatever this device is, it needs to somehow connect. So let’s say that it is a computer for now, and let’s say that it needs to make a connection to some sort of bank. So let’s say it was Bank of America. And so what happens in Zero Trust Connectivity is that we send a robot ahead, check that the connection is safe. If it is, write it on a dynamic allow list, which then lets that computer connect to Bank of America.
Francois Driessen: Right now you need to go to, let’s say, the New York Times. It checks to see that it’s safe. The AI goes to check to see if it is actually safe and verified. Well, there’s a ton of dependencies, what we call them, on this web service as well, about 35 additional things. It’s not just one domain and one web service that’s necessary for the site to run, okay? And some of them are good, but then some of them could be ads, trackers, potential malware and whatnot. So those are simply just not added to the dynamic allow list, right? And so for this computer, now the internet is just Bank of America and the good parts of the New York Times. The last site needs to go to some other service. It checks to see that it’s safe. If it is, it dynamically gets written. And so the internet has just been rewritten for this device to contain only three destinations, and out of those destinations, only the good parts of those destinations.
Francois Driessen: So let’s say that there’s some new attack. No one has ever seen it. It’s super advanced. It runs circles around any defenses that are out there. Undetectable. Well, who cares? It’s not part of this computer’s version of the internet, right? Let’s say there’s a thousand more. Well, who cares? It has nothing to do with this device’s connection to the internet.
Francois Driessen: But let’s take it a step further. An insider threat comes, puts a flash drive into this machine, okay? And with this flash drive infects the machine as an initial access broker, right? Well, that needs to connect to some C2 server, which is not part of this machine’s version of the internet, and some sort of place to exfiltrate data to, but that just doesn’t exist for this machine. This machine cannot connect to it. So essentially what you’ve got is a threat that was physically implanted, neutralized, because you’ve disrupted the attack chain there.
The technologies required
Francois Driessen: Okay, so the technologies required for Zero Trust Connectivity, I think it’s important to just mention. The first of all is that there’s really a rewriting. There’s a layer that gets added to TCP/IP, where DNS was essentially used as an afterthought for TCP/IP. And what we do in a Zero Trust connected environment is to just change that, to say no: if you do not first look up via DNS, and it’s verified by AI-driven dynamic allow listing, that IP connection just simply doesn’t take place. So essentially what we’re doing is we’re using DNS as the root of trust and using AI to verify these connections, and we are disallowing any direct connection that has been requested that’s not first been verified in DNS.
Francois Driessen: Okay, so, but there is a requirement for healthcare. Remember we spoke about the IoT world, or the medical IoT world: first of all, you cannot have an endpoint agent, because how are you going to put this on this surgical laser or this MRI or whatever it is? Some of them, yeah, okay, fine. But if you’re relying on endpoint agents, there’s a whole slew that needs to be protected in the healthcare sector that never will get its protection, and that’s part of the reason why we’re sitting in the position that we’re sitting in.
Francois Driessen: So Zero Trust Connectivity works on the principle to say, okay, well, let’s do it at the edge. Let’s do it at the network edge, which means that it’s out of band. You don’t need to put any agent on that device, right? But what’s interesting is that it’s a flexible edge. That means you could move it right up to the cell tower with an APN, if it is a direct cellular connection for this device, or move that edge right onto the actual endpoint if it supports something like that, and on devices enforce it with MDM, whatever it is. So bottom line is that the edge is flexible. It just needs to somehow get in between the device and the internet, okay? And so that is already doable. It’s already working.
Francois Driessen: And another thing I think it’s important to mention is the notion of sovereign data custody. The whole idea here is that you have these nodes that live on the network edge, okay? But the data doesn’t need to be proxied to some central location, okay? It stays where it stays, and you just have a central brain. So you have centralized control, right, but you have the performance of a decentralized system, and the data stays wherever it is. Whether it’s cloud, the edge, on the cloud, the Zero Trust Connectivity node lives there; if it’s on-prem, it lives there. So the data doesn’t go anywhere, replicating that to a third party, right? So for more on that, come to our booth and we can tell you more about that. But that’s something that we felt was essential in the design of Zero Trust Connectivity.
An attack chain under Zero Trust Connectivity protection
Francois Driessen: So let’s look at an attack chain under Zero Trust Connectivity protection. So let’s look at a phishing attack, just as an example here. It actually just came up in a meeting earlier, where I spoke to two people in the financial industry, and they’re telling me that they’re literally getting three times a day, they’re doing phishing attack simulations for training, in order to prevent them from getting phished. Okay. Well, personally, in my mind, I think that it is inhumane to expect, with the perfectly crafted email that’s going to be generated by AI, okay, that is going to come to an employee from what appears to be one of their colleagues, on a project that they’re actually working on, written even in the tone of voice, or in the written voice, of one of their colleagues or a client, it’s inhumane to expect that they’re not going to make that mistake. And so having to live under that stress: what’s the consequence when they actually click on it, right? And I think the industry has gone here because there’s just no solution; there hasn’t been a solution up to now.
Francois Driessen: But let’s look at this for a moment. So you do get that perfectly crafted email, right? And now they have one of two options: they click on the link, or they open that attachment, okay? Let’s look at clicking on the link first. They click on the link, and the moment that they do, nothing happens, because that domain is just not a verified connection. So the connection for their computer or mobile device or whatever it is, even if it’s a smish or a quish, doesn’t matter, okay? That connection is already denied. You don’t have to jump into action to prevent that from happening; it’s prevented in the first place, right? They might be met with a block page that informs them that this connection is denied, and they can actually request it to be inspected and whatnot. But bottom line is that the attack chain has already been disrupted before you now go and detect anything or get new information about it, right?
Francois Driessen: So let’s go to the other side. Let’s go to opening the attachment. So let’s say a Trojan was in there. They open this file, and this malware would now go for the second stage of the attack, or reach out to some C2 server. Well, yet again, nothing needs to be detected. What will happen is absolutely nothing, because that connection is already denied. And let’s say that it was a direct IP connection for the first one, or this is actually trying to connect via DoH, or Telegram, whatever circumvention channel is out there that would normally run circles around firewalls, conventional firewalls and so forth. It doesn’t matter, because with Zero Trust Connectivity, that connection is just simply denied.
Francois Driessen: Okay, so let’s go back to this new philosophy. And so you guys can see that right at the first step, it is already protecting. We don’t have to wait to detect. We can protect and neutralize in the very first phase already, okay? And then of course, out of that, the ZTc system could be integrated with SIEM, and logs for every single connection that’s trying to be made out of that network could be fed into that. And then, sure, detect, see where things are trying to go, but only after you’ve already prevented that attack, or you’ve already prevented that connection from taking place, in the first place. Does that make sense?
A real-world case
Francois Driessen: Let’s look at a real-world case. Okay, so name redacted for privacy reasons, but 10,000 employees, four countries, three continents. So they got ransomed, okay? And they had McAfee Enterprise, Cisco ASA, and, just as with most of the effective ransomware attacks, they’d been there for six months, in this case without being detected. A lot of technology debt in this operation, and so it was an easy target for the bad actors to get in on, okay?
Francois Driessen: So by the time they realized that it had happened, Zero Trust Connectivity was implemented, which essentially shut down everything. But because the adaptive AI can automatically verify all the needed connections that needed to take place, they were able to move this corp from being crippled and completely on fire to fully operational with only one weekend shift lost globally, okay? The ransom wasn’t paid. And here’s the kicker, actually: there’s been over 5,000 reinfection attempts since the event had taken place, okay? Most of them were because of phishing. And then of course, as I mentioned, technology debt: some of their controllers were Windows XP based, and it would be very expensive to replace these, but they still do the job that they’re supposed to be doing, right? And so with Zero Trust Connectivity and proper isolation, these devices are able to still function today without actually getting compromised, behind Zero Trust Connectivity.
Francois Driessen: And it could sound too good to be true, but please stop at our booth. This is really the reason why we’re having this session with you, is because healthcare needs this. We want to help people, okay?
Additional consequences of Zero Trust Connectivity
Francois Driessen: There’s additional consequences of Zero Trust Connectivity. I won’t have time to dive into all of them, but because all connections are visible at the edge, okay, shadow IT is resolved. I already mentioned the IoT and medical IoT being protected. Attack surface reduction to near zero. I mentioned sovereign data custody. And mitigating the human factor, with phishing and smishing vectors being destroyed, really.
Francois Driessen: The only thing in an arsenal that I can see that exists today that can protect against undetectable, unknown threats, zero days, is Zero Trust Connectivity. And of course it’s not the only thing that’s out there, and it’s not the silver bullet that’s going to do everything, okay? But the aim in security is to get to the place where your adversary either moves on to another target, where their resources are spent, they move on to another target, or they give up altogether. And for corporations that are living in Zero Trust connected environments, we see that as the case.
Francois Driessen: So thank you for spending time with us today. I hope everything makes sense. I know we’ve moved a little bit fast here, but please stop by our booth. We’d love to help you protect the people and systems that you care about, and I’d love to tell you more about the technology that we’re sitting with in our hands, and applying this philosophy properly. Thank you.
