‘This is cutting-edge technology that will help keep patient information and NHS systems safe’
The UK’s National Health Service (NHS) has been given a fresh set of security tools to help streamline its digital transformation while stemming the increasing threat of cyber-attacks on its infrastructure.
Making the announcement this week, NHS Digital said that new services would be available to all NHS Trusts, hospitals, clinics, and doctors’ surgeries, helping each to meet the challenges that data-driven healthcare has created.
“This is great news for NHS organisations,” said Rob Shaw, deputy chief executive of NHS Digital, in a statement published on Monday.
“This is cutting-edge technology that will help keep patient information and NHS systems safe, at no cost to local organisations.”
The free toolkit includes network intrusion detection and prevention capabilities, secure Domain Name Server (DNS) services, web content filtering, data loss prevention, and a “next-generation” firewall.
“This means that we will be able to monitor for threats more effectively, supporting the NHS to increase data security and helping to provide safer care for patients,” Shaw said.
Upping security after WannaCry
The package, worth an estimated £40 million ($48 million) and delivered, in part, by Accenture, follows previous support given to Britain’s flagship healthcare provider in the wake of the WannaCry ransomware attack, which temporarily debilitated more than a third of NHS trusts in 2017.
This disruption resulted in the cancellation of nearly 20,000 NHS hospital appointments after thousands of PCs around the world became infected with the ransomware, now regarded as the biggest cyber-attack to have affected any health service to date.
According to data released by NHS Digital, the NHS blocked over 11 million email-based cyber-attacks between 2016 and 2019, as the public health care provider continues to be a prime target for digital malevolence.
While no patient data was affected by the 2017 WannaCry incident, the NHS was heavily criticized for not following basic cybersecurity recommendations, with a post-mortem audit by the Public Accounts Committee (PAC) revealing that every one of the 200 NHS trusts failed an on-site cyber assessment, The Daily Swig reported.
“The extensive disruption caused by WannaCry laid bare serious vulnerabilities in the cyber security and response plans of the NHS,” Meg Hillier, Labour politician and Public Accounts Committee Chair, said in the PAC report a year after the ransomware attack.
“I am struck by how ill-prepared some NHS trusts were for WannaCry, in many cases failing to act on warnings to patch exposed systems because of the anticipated impact on other IT and medical equipment,” she added.
Multiple warnings sent to NHS trusts as early as 2014 urged organizations to update or patch their software, meaning the some £92 ($115) million in damages caused by WannaCry could have easily been prevented.
In response to the 2017 attack, the UK government has been funneling money into the NHS to assist with improving its cyber resilience, building on NHS Digital’s Cyber Security Operations Centre (CSOC), which is predominately tasked with monitoring threats across NHS networks.
Support packages have also extended to other cyber hygiene toolkits, including an agreement with Microsoft to provide support for Windows 10 migration for legacy machines running Windows XP, Windows Server 2003, and SQL Server 2005.
“As part of the Windows 10 investment we have also deployed over 900,000 Advanced Threat Protection licenses which gives the Cyber Security Operations Centre (CSOC) a national view of the cyber threats at end point (desktops, etc) as well as providing local organisations with a view of their specific cyber risks and threats,” a spokesperson from NHS Digital told The Daily Swig.
IT upgrade, stat
Data obtained by British think-tank Parliament Street reveals that 65 NHS trusts spent a total of £612 million ($744 million) on improving their IT in the 2018/19 financial year. Last April, NHS Digital projected that £150 million ($182 million) would be spent on the health service’s cybersecurity over the next three years.
However, a white paper presented by researchers at Imperial College in July details how outdated systems and a lack of technical expertise continues to hinder any digital transformation.
“The NHS suffers from massive technical debt and that is where the largest dangers of breaches to confidentiality, integrity and availability of systems exists,” Ian Thornton-Trump, head of cybersecurity at AMTrust International, told The Daily Swig.
“In the case of NHS, there is an opportunity to find the best balance without favouring cyber security solutions over general IT improvements.
“Believe it or not reduction in technical debt would also be a massive improvement in security,” he added.
While cybersecurity and its implementation remains a responsibility of individual NHS organizations, NHS Digital has delivered on a number of cybersecurity initiatives since the time period examined in the Imperial College report, a spokesperson said.
The Windows 10 migration support package is among these initiatives, as is a strong focus on perimeter security solution, which was produced alongside technical experts from the UK's National Cyber Security Centre (NCSC).
“The perimeter security solution will support local NHS organisations to improve their cyber security, whilst boosting national capability,” an NCSC spokesperson told The Daily Swig.
“We are working with NHS Digital to ensure the NHS can benefit from our Active Cyber Defence programme at scale.”
The Active Cyber Defence (ACD) program is focused on reducing the UK's exposure to commodity phishing and malware-based attacks. More than 22,000 phishing campaigns were thwarted in the UK last year, as part of its efforts.
The new cyber boost to the NHS covers a five-year contract, expected to be available this winter. Palo Alto Networks and Imperva are additional partners in its delivery.
RELATED NHS still vulnerable to WannaCry-style cyber-attacks, report warns
