Case Study | Verifying the Effectiveness of Security Defenses for Healthcare Institutions

With the popularisation of medical informatisation and smart devices, healthcare institutions are facing increasingly severe cybersecurity threats. The complex interconnection of telemedicine, electronic medical records, and smart devices has expanded the attack surface of healthcare systems, leading to a surge in the risk of hacker attacks and frequent occurrences of patient privacy leaks and equipment control vulnerabilities. At the same time, the security of hospital intranets and risks in data transmission have become prominent, making the strengthening of all-dimensional cybersecurity protection an urgent need in the healthcare industry.

▌01 Main Dilemmas and Goals of Security Construction in Class 3A Hospitals

• Insufficient validation of existing defence effectiveness: Lagging behind in understanding newly emerging hacker attack methods, tools, and samples makes it difficult for existing security defence measures to quickly detect new types of attacks.

• Lack of validation after security policy updates: Following changes in security product policies, there is a lack of effective ways to validate their protective performance.

• Inability to assess security protection capabilities timely and comprehensively: Traditional penetration testing and offensive/defensive exercises have long intervals and can only reflect a momentary state, failing to demonstrate long-term security levels.

• Inability to patch vulnerabilities in some systems: Due to the unique nature of medical business systems, some asset vulnerabilities are difficult to patch, requiring the help of pre-emptive protection measures to reduce risks.

• Difficulties in correlation analysis during and after incidents: When security products cannot directly detect and block attacks, security operations platforms lack supplementary detection and contextual correlation analysis capabilities, making it difficult to establish effective rules for attack correlation analysis.

To safeguard hospital information assets and enhance security operations capabilities, security validation is crucial. Class 3A hospitals possess professional teams, and once the necessity of security validation is clarified, they need to reasonably evaluate security validation schemes and choose a solution that aligns with their development to build a closed loop of security operations through security validation.

▌02 Design of Security Validation Schemes

• Operational Model: Formulate a periodic validation plan on a "daily/weekly/monthly/quarterly/yearly" basis, covering dimensions such as device status monitoring, updates of attack methods, and cyber kill chain detection.

• Topological Deployment: Deploy validation nodes in boundary zones, business zones, and office zones respectively, covering core assets such as Web services, healthcare systems, and terminal devices.

• Validation Scenarios: Design six major scenarios including WAF protection, boundary attack chains, non-patchable vulnerability protection, endpoint security, ransomware attack simulation, and offensive/defensive exercise reviews, taking into account both common attack methods and the special needs of the healthcare industry.

▌03 Validation Results and Optimisation

• Initial Results: The first validation revealed various issues in the hospital's security defences, such as insufficient detection capabilities for some Web attacks, weak protection against malicious file transfers and covert tunnel communications in boundary zones, a low overall protection level against ransomware attacks, and limited peripheral protection effects on some non-patchable vulnerabilities.

• Optimisation Measures:

  • Technical Level: Upgrade the configuration of security devices, optimise the detection rules of firewalls, WAFs, and other devices, and enhance the capability to identify various attacks; update endpoint security product policies to improve the endpoint's defence level against malicious behaviours; strengthen peripheral protection policies for unpatchable vulnerabilities, such as adjusting firewall access control rules.

  • Operational Level: Improve the correlation analysis rules of the Security Operations Centre (SOC) to enhance the capability to detect abnormal behaviours across devices; establish automated incident response processes, such as automatically blocking attacking IPs and isolating infected endpoints, to shorten security incident handling times.

• Re-testing Results: Following optimisation, the overall protective effect has significantly improved, with obvious enhancements in various attack detection capabilities and a substantial increase in security incident response efficiency. An effective security operations closed loop of "detection-validation-optimisation" has been formed, shifting the hospital's security defence system from passive response to proactive defence, allowing it to withstand cybersecurity threats more effectively.

▌04 Core Value and Experience

• Core Value:

  • Quantified Defence Capability: Through data-driven evaluation, clearly demonstrate the protective efficacy of each security product in real attack scenarios, providing objective bases for security investment decisions and avoiding the dilemma of "stacking devices with unclear effects".

  • Enhanced Operational Efficiency: Establish an active operational model of "continuous validation-vulnerability prediction-policy optimisation", shortening security incident response times from hundreds of minutes to the minute level, significantly improving emergency response efficiency.

• Key Experience:

Attacker's Perspective Oriented: Step outside the traditional compliance inspection framework, validate the defence system from the hacker's attack path, precisely identify hidden vulnerabilities (such as blind spots in covert tunnel communication detection), and ensure that protection fits practical combat needs.

Normalised Validation Mechanism: Compared with single-time testing, periodic validation (such as daily device status monitoring, weekly attack method update detection) can timely discover "policy drift" problems, ensuring that defence capabilities remain continuously online.

Healthcare Scenario Adaptation: Targeting the unique nature of "difficult to patch vulnerabilities" in medical systems, focus on validating the effectiveness of peripheral protection measures (such as firewall isolation policies, access control rules) to confirm the effectiveness of alternative peripheral protection solutions for business continuity.

• Synergy between Technology and Operations: The validation process simultaneously tests the security team's response procedures, driving the collaborative evolution of technical protection (such as device rule optimisation) and operational processes (such as cross-departmental coordination mechanisms) to construct a multidimensional defence system of "people + technology + processes".

▌Sixun Security Metrics Validation Platform Provides You With:

• Attack Simulation Capability: Attack simulation of the complete cyber kill chain, covering all stages of attack behaviours such as reconnaissance, weaponisation, delivery, and exploitation, restoring real APT attack scenarios.

• Flexible Validation Modes: Support scenario-based one-click validation (predefined industry scenarios such as ransomware, healthcare industry attacks, etc.) and custom validation, with the ability to arrange the sequence of attack playbooks and simulate specific threat group methods or malware variants.

• Convenient Deployment and Management: Utilise a "Security Validation Brain + Robot" architecture, support SaaS-based and local deployment, with simplified deployment processes and support for multi-zone robot collaboration.

• Professional Mitigation Recommendations: Provide configuration optimisation recommendations targeting specific security products (such as NGFW, WAF) or vendors based on validation results, resolving defence shortcomings.

• Scientific Framework Classification: Classify attack scenarios based on frameworks such as MITRE ATT&CK and Cyber Kill Chain, supporting filtering of attack methods by security dimensions (network, endpoint, email, etc.) or framework dimensions.

• Data Visualisation: Provide rich visual charts (such as security scores, proportions of validation action states, and defence capability trends) to help personnel at all levels understand the security status.

• Continuous Updates of Rule Library:

  • Contains 18,000+ attack methods, 2000+ attack scenarios, tracking 400+ threat groups and APT syndicates.

Sixun Security Lab tracks internet vulnerabilities and hacker groups 7x24, providing the latest threat intelligence at the first opportunity to ensure that validation content synchronises with cutting-edge attacks.

For more information, click "Healthcare" to obtain the complete case study.