9_Building Automation Systems_Ty Greenhalgh_24AUG23.pdf

CLAROTY HEALTHCARE

Defense Health Agency Industry Day – Room 0C066 1

Building Automation Systems Cybersecurity 101

Speakers

Ty Greenhalgh Industry Principal

Medigate by Claroty

Jeff Critser “Critter”

DOD/Federal Civilian Director

Medigate by Claroty

Healthcare Cyber – In The News Not where your CEO wants to be

FDA - Patch Act

Patient Safety & Outcomes

Extend your existing IT security controls & governance into your clinical environment

Integrate your existing IT tech stack & workflows

Gain full visibility into all connected devices in your clinical environment1

The Approach to HDO Cybersecurity:

Three Key Principles

Cyber Physical Systems IT Devices IoT Devices

IoMT Devices BMS Devices

What Healthcare Executives are Saying….

• “Building management is an even bigger risk than IV Pumps…”

• ”Facilities systems going down cause panic”

• “Building system outages have a high level of visibility to the organization”

• “If I wanted to cause the most impact, I would hack the building”

• “More patients could be impacted from a BMS outage”

• “It doesn’t matter how the bad-actor got in; we have to stop all routes”

Securing Healthcare Cybersecurity Requires a Different Approach

Cyber-Physical Systems (IoMT, OT, IoT, BMS)IT Systems (servers, laptops, mobile devices)

Confidentiality, Integrity, Availability Patient Safety, Reliability, Productivity

Legacy Assets & Outdated Operating SystemsStandardized Protocols and Assets

Frequent Patching Permissibility Device Manufacturer Involvement

Compatible with Traditional Security Tools Incompatible with Traditional Security Tools

IT ENVIRONMENTS HEALTHCARE

ENVIRONMENTS

Cyber-Physical Security Maturity Journey Model Gartner Approach 1

IT

IoT

IoMTBMS

1Source: Market Guide for Operational Technology Security, Gartner, 2021

Inventory Establish baseline device risks

CMMS & CMDB

Risk - Identify and categorize devices needing risk assessment

Controls Which controls will be applied to what devices

How will they be applied and who will perform the task

Ongoing Monitoring & Maintenance

Workforce – Development and training

Governance – Bring departments together to share responsibility

Building a BMS Cyber-Physical Program

Inventory Consideration #1

• Identify BMS devices and components

• Deep packet inspection (DPI)

• Baseline device behavior

Cybersecurity Framework Foundations

Identify: Asset Mgmt.

ID:AM-1 Inventory Devices

ID:AM-2 Inventory Software

ID-AM-3 Map Communications

Version 8

01 – Inventory & Control Assets

02 – Inventory & Control Software

HICP 23

Medical Device Security Medium Size Hospital

A1 – Inventory Hardware A2 – Inventory Software

Device Identification - Blindspot

IT Scanners – discouraged

Proprietary Communication Protocols

Automated Asset Discovery

OT Deep Packet Inspection Granularity Precision Device Identification White Truck vs F250, XL, V8, 4WD

MAC: 7C:94:B2:7A:39:9E

IP: 10.1.132.136

MANUFACTURER: Intel PILA8472

MAC: 00:17:23:0E:CC:8F

IP: 10.1.132.136

MANUFACTURER: HP-232386-001

Network scan results using traditional IT security tools.

SECURITY

MANUFACTURER: Schneider DEVICE TYPE: Smart UPS X 3000 MODEL NAME: APC NetSure

S/N: SA18117495XX

SW Version: NOS MBv4.10 PFv6.20 PHI: No Critical: Yes

FACILITIES MANAGEMENT

IP: 10.1.56.136

OS TYPE: NetSure RTOS SW Version: : NOS MBv4.10 PFv6.20 PHI: No BEHAVIOR: Normal

VULN: 2 - ICSA-15-181-01,

ICSMA-20-170-04

RIPPLE20 VULN: True

TAG: FW-PANW-NO-

INTERNET

SECURITY

MAC: 00:40:9D:0E:CC:8F

IP: 10.1.132.136

FLOWS: 6 Internal / 0 External BEHAVIOR: Normal

SEGMENT: POWER-

VLAN056

TAG: FW-PANW-NO-

INTERNET

NETWORKING

MANUFACTURER: Schindler DEVICE TYPE: Traction Elevator

MODEL NAME: 3300 MRL

S/N: PH38948511

SW Version: VxWorks PHI: No Critical: Yes

MAC: 7C:94:B2:7A:39:9E

IP: 172.16.12.173

FLOWS: 6 Internal / 0 External BEHAVIOR: Violation

SEGMENT: PCI-VLAN0012

(12)

TAG: FW-PANW-

INTERNET

SECURITY

IP: 172.16.12.173

OS TYPE: VxWorks RTOS SW Version: DCX R3.1 PHI: No BEHAVIOR: Violation

VULN: 2 – CVE-2020-9805,

CVE-2019-1307

Urgent/11: True

TAG: FW-PANW-INTERNET

FACILITIES MANAGEMENT

NETWORKING

SECURITY

Single Pane of Glass – IT & OT

Drill Down – OT Devices

Device Details

Vulnerabilities – per device

Risk & Criticality Consideration #2

• Network Architecture

• Air Gap

• Disconnected BMS

• Geography

• Determine vulnerabilities and threats

• Specific to the BMS

• Critical assets

• Identify

• Operations disruption

• Patient safety

• Prioritize system/devices & mitigation impacts

Vulnerabilities – per device

Security Measures Implementation Consideration #3

• Access Controls & Authentication

• Update and Patching

• Firmware, Operating Systems

• Known Exploited Vulnerabilities (KEV)

• Endpoint

• Vulnerability Management

• Network Management

• Segmentation, Firewalls

Access Control

Building Automation Control

Intercom/Paging System

HVAC

Gas Delivery

Pneumatic Tube System

Freezer & Refrigeration Control

Elevator Control

Emergency Power Generation

Surveillance Cameras

HMI

Building Controller

Engineering Workstation

Building Controller

Engineering Workstation

HMI HMI

Hospital Network Segmentation

Access Control

Building Automation Control

HVAC Surveillance Cameras

Building Controller

Ongoing Monitoring and Maintenance Consideration #4

• Implement continuous monitoring solutions

• detect

• respond to cybersecurity incidents in real-time

Maintenance Operator Dashboard

Role Based Permissions

Role Based Permissions - Devices

Role Based Permissions - Alerts

Role Based Permissions – Threats & Risks

Role Based Login

Reduce Risk at Procurement Contract Language Framework - HSCC https://healthsectorcouncil.org/model-contract-language-for-medtech-cybersecurity-mc2/ https://healthsectorcouncil.org/model-contract-language-for-medtech-cybersecurity-mc2/

Workforce – Training & Awareness Consideration #5

• Foster a culture of cybersecurity awareness

• Comprehensive cybersecurity training operations and maintenance

• Risks and consequences of cyber threats and social engineering tactics

• Cross functional team training

• Vulnerability management

• Applying mitigations

• Cyber event simulations

Governance & Policy Consideration #6

• Establish policies for Building Management Systems (BMS)

• Develop protocols for incident response and recovery

• Resilience

• Compliance - regulations and standards (e.g., HIPAA, NIST, HICP)

• Cross functional team collaboration

Mayo Clinic’s Cyber Team

Structure

We Are The Cavalry

• IT vs OT

• OT is Expanding & Vulnerable

• Gartner Journey - Visibility …. Oh Wow ….. Firefighting

• Engage in cyber activities concerning BMS

• Get Started

• Step #1 – Accurate & Detailed Inventory

• Step #2 – Device Communications

• Step #3 – Risk, Criticality, Vulnerability & Impact

• Step #4 – Determine Controls to be Implemented

• It’s a Journey

CLAROTY HEALTHCARE Thank you

Ty Greenhalgh Industry Principal, Healthcare

Ty.G@Claroty.com

Jeff Critser “Critter”

DOD/Federal Civilian Director

Medigate by Claroty