A hospital with 2,000 employees in the E.U. deployed Cynet protections across its environment. The hospital was in the process of upgrading several expensive imaging systems that were still supported by Windows XP and Windows 7 machines. Cynet protections were in place on most of the Windows XP and Windows 7 machines during the upgrade process, ensuring that legacy operating systems would not cause vulnerabilities or delay the activation of an incident response plan.

The hospital’s I.T. security team appreciated this coverage after their previous provider abandoned support for Windows XP and Windows 7. “One of the many reasons we chose Cynet was their support of legacy Windows machines. It’s expensive, difficult, and time-consuming to upgrade our imaging system software, but we needed protections as we slowly migrated to more current Windows environments. Cynet was one of the few providers that continue to protect these older Windows environments.”

The Attack

Along with Cynet, the hospital implemented advanced authentication for doctors to access systems that contained sensitive patient information in the form of a USB key. The USB key contained a hidden partition with a digital certificate used to digitally sign and log the user’s activities. The USB drive could also be used as standard removable media storage for the user.

Unfortunately, because users could use the USB key to store files from any device, one of the USB keys became infected with malware. The malware was embedded in a JPEG image file, among many image files on the USB device. When the doctor used the USB key to retrieve diagnosis images from a Windows 7 machine, the media portion of the key pushed the infected images to the machine. Because the machine was connected to the hospital network, this could allow the attacker to move laterally and ultimately exfiltrate sensitive data or cause other harm.

Cynet Protections

Fortunately, Cynet protections immediately detected the malicious file and quarantined it before it could execute. This attack underscores the need for layered security. Even when the advanced authentication protections were leveraged to execute malicious code, the device protections detected the malicious code and prevented it from executing. It also reinforces the importance of a well-prepared incident response plan.

Summary

Small to medium-sized hospitals and medical facilities continue to leverage legacy Windows operating systems due to the time and cost required to update the expensive medical systems they control. However, it’s critical that devices are adequately protected as attackers tend to target the “low-hanging fruit” – systems that likely have weaker protections in place. With the proper protections and a roadmap for incident response, healthcare organizations can continue to maximize the lifespan of their highly specialized equipment.