HHS Audit Flags Web App Security Gaps at Large Hospital

Security weaknesses identified by federal auditors in web-facing apps used by a large hospital in the Southeastern U.S. are likely indicative of a sector-wide exposure to hacks.

See Also: Reduce Cloud Risk in Healthcare with Security by Default

Attackers could use the misconfigurations to expose sensitive patient information vulnerable to cyberattacks, according to a report published Monday by the U.S. Department of Health and Human Services’ Office of Inspector General.

Auditors examined whether the audited hospital had implemented cybersecurity controls to prevent and detect cyberattacks, ensure continuity of patient care in the event of a cyberattack and protect Medicare enrollee data.

The healthcare sector as a whole faces systemic challenges in implementing robust cybersecurity controls for a number of reasons. They include its complex IT environments and integration of third-party systems, resource constraints and competing priorities and rapid adoption of new technologies without consistent security oversight.

The hospital was described as having more than 300 beds and offering a variety of health services, including emergency, cardiac, neurology, maternity and radiology services. Auditors told Information Security Media Group they will not publicly identify the hospital due to a threat of cyberattacks against the healthcare sector.

The watchdog agency contracted with a third-party firm to conduct penetration testing of the hospital’s internet-accessible systems, web applications, vulnerability scanning and analysis, and phishing campaigns. The testing was conducted from August through September 2022.

Pen testers found the hospital implemented cybersecurity controls to protect against cyberattacks but that it lacked cybersecurity controls related to certain internet-accessible applications.

Auditors identified one internet-accessible web application as lacking multifactor authentication. Through a simulated phishing exercise, auditors were able to capture credentials and access the application.

A second web-facing application lacked strong data input validation and was not protected by a web application firewall. This left the app potentially susceptible to injection attacks and malicious code insertion.

These types of web app and related security weaknesses – including misconfigured systems, weak authentication and insufficient secure coding practices – are not unique to the one hospital that’s spotlighted in the report, Miguel Vallejo, an HHS OIG IT audit manager, told ISMG.

“Even organizations with generally strong cybersecurity programs may still have weaknesses,” he said.

HHS OIG recommends that all hospitals assess internet-accessible systems and web applications for similar vulnerabilities identified in the audit report of that one hospital, Vallejo said.

Hospitals should additionally review and enforce configuration and change management policies to ensure that new or modified systems undergo security impact analysis, strengthen authentication controls – including password complexity and multifactor authentication for remote access, and implement secure coding practices he said. Scanning web applications for vulnerabilities should be a regular exercise.

Other experts said the findings in the HHS OIG report underscore a need for healthcare organizations to adapt their security programs to reflect a fundamental shift in where critical app data exists.

“Sensitive data now resides not just in on-prem, internal apps, but also in web-based SaaS applications,” said Russell Spitler, co-founder and CEO of Nudge Security.

“Traditional network-focused security controls cannot adequately protect cloud applications where data flows across organizational boundaries,” he said. “This makes identity security controls – particularly MFA and single sign-on – essential for protecting this dynamic attack surface.”

Healthcare organizations should also address risks at the “workforce edge” – the rapidly expanding attack surface created by employees’ daily decisions about SaaS adoption, data sharing and app integrations, Spitler said.

“This decentralized ecosystem of hundreds or thousands of applications, identities and connections represents the fastest-growing risk area for most organizations,” he said. “Attackers actively exploit these gaps, making comprehensive visibility and control over this sprawling SaaS environment a critical security imperative, not an optional enhancement.”