{"id":24214,"date":"2017-11-15T16:56:14","date_gmt":"2017-11-15T21:56:14","guid":{"rendered":"https:\/\/digital.hbs.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/"},"modified":"2017-11-16T15:31:59","modified_gmt":"2017-11-16T20:31:59","slug":"admitting-cybercriminals-to-hospital-through-the-front-door","status":"publish","type":"hck-submission","link":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/","title":{"rendered":"Admitting cybercriminals to hospital through the front door"},"content":{"rendered":"

On Friday May 12th<\/sup>, 2017, computer screens across British NHS hospitals freeze, and patient records are unavailable to their doctors. As a result, ambulances need to be rerouted, and thousands of planned surgeries and appointments are canceled.[1] The cause: a vulnerability in Windows XP has been exploited to gain access to the IT infrastructure and encrypt its data.[2] The hackers demand money to reinstate the systems. Finally, a cybersecurity expert succeeds in deactivating the virus before any ransom is paid. In terms of disruption however, the damage is done. The \u2018WannaCry\u2019 ransomware attack hit organizations across the globe, including Fedex, Renault and Telef\u00f3nica.[3,4] All of them had digitized their functionality and sensitive data, and connected their systems to the internet, relying on firewalls and encryption software to keep unauthorized people from accessing it.<\/p>\n

Currently, the most-used encryption algorithms use a public key. A popular algorithm is RSA, which uses the product of two large prime numbers as the basis for encoding secret information. Anyone can use this public key to encrypt data, but only someone who knows the two prime numbers can decrypt it.[5] Trust in this method is based on the ungodly amount of computing power it takes to parse numbers like these. However, this is about to change, due to the arrival of quantum computing.<\/p>\n

Whereas classical computers code information in a series of bits with values of either 0 or 1, a quantum computer\u2019s bits (or \u2018qubits\u2019) which can be both 0 and 1 at the same time, or any other value on the spectrum between completely 0 and completely 1. This means that the number of states a qubit can occupy is limitless. When multiple qubits are linked together, they can form an entangled network with faster-than-light interaction which allows for trying multiple solutions to a problem at the same time. The network only puts out the solution that works, such as the prime numbers at the base of a public key.[6]<\/p>\n

If efforts to develop a quantum computer are successful, online communications that rely on encryption software with public keys will be vulnerable. Instead of using an obscure backdoor, as WannaCry did, cybercriminals can use quantum computing to bust right through a system\u2019s front door.[7,8]<\/p>\n

Managing cybersecurity risk should certainly be a priority for the NHS, which is currently working to become a \u2018paperless\u2019 organization by 2020. This storing patients\u2019 personal health records centrally, and providing them to clinicians and patients online, which means that large amounts of confidential patient data need to be transferred externally to patients\u2019 private devices.[9] Another part of the project is allowing patients to book appointments online, opening up another potential entryway for hackers to disrupt hospital logistics.<\/p>\n

The huge risk to the organization\u2019s operations notwithstanding, an investigation by the UK National Audit Office (NAO) after the attack found a lack of preparation for cybersecurity breaches within the NHS. Although the Department of Health had developed a plan, it had not been properly communicated or tested within the organization. When things went wrong, few people knew what to do.[10]<\/p>\n

The good news for the NHS is that quantum computing is not here yet. Building a functional quantum computer is a huge technical challenge that has not yet been completed. However, massive resources are being pumped into developing it. A few years ago a research team succeeded in parsing the number 56,135 using a 4-qubit device[11], and the US government is working under the assumption that the technology will be fully functional within the next 10 years.[12] Once it is here, we should assume not only the well-intentioned will use it. As a result, organizations like the NHS will need to be ready for their defenses to be tested once more.<\/p>\n

To fare better this time around, there are several actions the NHS could take in the short term to strengthen security. They should implement the recommendations of the NAO to improve their response to \u2018classical\u2019 cyber-attacks. In the medium term, they should prepare for the arrival of quantum computing by implementing symmetrical security algorithms, which do not share a public key and are seen by experts as harder for a quantum device to crack. An example is the AES algorithm, already in use across the US government.[13] In addition, it makes sense to add protection which does not rely purely on cryptography, such as dual-factor authentication, which forces would-be intruders to crack two separate security systems at a time, increasing the logistical challenge.[14]<\/p>\n

Quantum computing will arrive. What remains to be seen is how long it will take us to get there, and what disruption will be caused for those organizations that are ill prepared when it does.<\/p>\n

(778 words)<\/p>\n

Endnotes<\/strong><\/p>\n

    \n
  1. BBC News (2017). NHS ‘could have prevented’ WannaCry ransomware attack. [online] Available at: http:\/\/www.bbc.com\/news\/technology-41753022 [Accessed 15 Nov. 2017].<\/li>\n
  2. Washington Post (2017). NSA officials worried about the day its potent hacking tool would get loose. Then it did. [online] Available at: https:\/\/www.washingtonpost.com\/business\/technology\/nsa-officials-worried-about-the-day-its-potent-hacking-tool-would-get-loose-then-it-did\/2017\/05\/16\/50670b16-3978-11e7-a058-ddbb23c75d82_story.html?utm_term=.a5ae2b3e6866 [Accessed 15 Nov. 2017].<\/li>\n
  3. The Guardian (2017). NHS seeks to recover from global cyber-attack as security concerns resurface. [online] Available at: https:\/\/www.theguardian.com\/society\/2017\/may\/12\/hospitals-across-england-hit-by-large-scale-cyber-attack [Accessed 15 Nov. 2017].<\/li>\n
  4. Sharman, J. (2017). Nissan’s Sunderland factory latest victim of massive cyber attack<\/em>. [online] The Independent. Available at: http:\/\/www.independent.co.uk\/news\/uk\/home-news\/nissan-sunderland-cyber-attack-ransomware-nhs-malware-wannacry-car-factory-a7733936.html [Accessed 15 Nov. 2017].<\/li>\n
  5. Rivest, R., Shamir, A. and Adleman, L. (1983). A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM<\/em>, 26(1), pp.96-99.<\/li>\n
  6. Chu, J. (2017). The beginning of the end for encryption schemes?<\/em>. [online] MIT News. Available at: http:\/\/news.mit.edu\/2016\/quantum-computer-end-encryption-schemes-0303 [Accessed 15 Nov. 2017].<\/li>\n
  7. How did the WannaCry ransomworm spread?. (2017). [Blog] com<\/em>. Available at: https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/05\/how-did-wannacry-ransomworm-spread\/ [Accessed 15 Nov. 2017].<\/li>\n
  8. Rousseau, A. (2017). WCry\/WanaCry Ransomware Technical Analysis. [Blog] Endgame<\/em>. Available at: https:\/\/www.endgame.com\/blog\/technical-blog\/wcrywanacry-ransomware-technical-analysis [Accessed 15 Nov. 2017].<\/li>\n
  9. Next stept on the NHS Five Year Forward View. (2017). [online] NHS, March 2017. Available at: https:\/\/www.england.nhs.uk\/wp-content\/uploads\/2017\/03\/NEXT-STEPS-ON-THE-NHS-FIVE-YEAR-FORWARD-VIEW.pdf [Accessed 15 Nov. 2017].<\/li>\n
  10. Investigation: WannaCry cyber attack and the NHS. (2017). [online] Department of Health. Available at: https:\/\/www.nao.org.uk\/wp-content\/uploads\/2017\/10\/Investigation-WannaCry-cyber-attack-and-the-NHS.pdf [Accessed 15 Nov. 2017].<\/li>\n
  11. Dattani, N. (2014). Quantum factorization of 56153 with only 4 qubits. org<\/em>. [online] Available at: https:\/\/arxiv.org\/abs\/1411.6758 [Accessed 15 Nov. 2017].<\/li>\n
  12. US Department of Commerce (2016). Report on Post -Quantum Cryptography<\/em>. NIST Interagency Report 81 05. [online] National Institute of Standards and Technology. Available at: https:\/\/csrc.nist.gov\/csrc\/media\/publications\/nistir\/8105\/final\/documents\/nistir_8105_draft.pdf [Accessed 15 Nov. 2017].<\/li>\n
  13. Wood, L. (2011). The Clock Is Ticking for Encryption<\/em>. [online] Computerworld. Available at: https:\/\/www.computerworld.com\/article\/2550008\/security0\/the-clock-is-ticking-for-encryption.html [Accessed 15 Nov. 2017].<\/li>\n
  14. Keizer, G. (2013). Security experts applaud Apple’s new two-factor authentication<\/em>. [online] ComputerworldUK. Available at: https:\/\/www.computerworlduk.com\/it-vendors\/security-experts-applaud-apples-new-two-factor-authentication-3436827\/ [Accessed 15 Nov. 2017].<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    Quantum decryption will soon arrive to compromise the reliability of standard cybersecurity practices – just as the British National Health Service is working to make its most sensitive data digitally accessible.<\/p>\n","protected":false},"author":9962,"featured_media":24215,"comment_status":"open","ping_status":"closed","template":"","categories":[845,2029,41,744,2821],"class_list":["post-24214","hck-submission","type-hck-submission","status-publish","has-post-thumbnail","hentry","category-cybersecurity","category-digitization","category-healthcare","category-hospital","category-quantum-mechanics","hck-taxonomy-organization-uk-national-health-service","hck-taxonomy-industry-health","hck-taxonomy-country-united-kingdom"],"connected_submission_link":"https:\/\/d3.harvard.edu\/platform-rctom\/assignment\/rc-tom-challenge-2017\/","yoast_head":"\nAdmitting cybercriminals to hospital through the front door - Technology and Operations Management<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Admitting cybercriminals to hospital through the front door - Technology and Operations Management\" \/>\n<meta property=\"og:description\" content=\"Quantum decryption will soon arrive to compromise the reliability of standard cybersecurity practices - just as the British National Health Service is working to make its most sensitive data digitally accessible.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/\" \/>\n<meta property=\"og:site_name\" content=\"Technology and Operations Management\" \/>\n<meta property=\"article:modified_time\" content=\"2017-11-16T20:31:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/98500425_hi016492235.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"371\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/\",\"name\":\"Admitting cybercriminals to hospital through the front door - Technology and Operations Management\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2017\\\/11\\\/98500425_hi016492235.jpg\",\"datePublished\":\"2017-11-15T21:56:14+00:00\",\"dateModified\":\"2017-11-16T20:31:59+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/#primaryimage\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2017\\\/11\\\/98500425_hi016492235.jpg\",\"contentUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2017\\\/11\\\/98500425_hi016492235.jpg\",\"width\":660,\"height\":371},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/admitting-cybercriminals-to-hospital-through-the-front-door\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Submissions\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Admitting cybercriminals to hospital through the front door\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/#website\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/\",\"name\":\"Technology and Operations Management\",\"description\":\"MBA Student Perspectives\",\"potentialAction\":[{\"@type\":\"性视界Action\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Admitting cybercriminals to hospital through the front door - Technology and Operations Management","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/","og_locale":"en_US","og_type":"article","og_title":"Admitting cybercriminals to hospital through the front door - Technology and Operations Management","og_description":"Quantum decryption will soon arrive to compromise the reliability of standard cybersecurity practices - just as the British National Health Service is working to make its most sensitive data digitally accessible.","og_url":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/","og_site_name":"Technology and Operations Management","article_modified_time":"2017-11-16T20:31:59+00:00","og_image":[{"width":660,"height":371,"url":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/98500425_hi016492235.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/","url":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/","name":"Admitting cybercriminals to hospital through the front door - Technology and Operations Management","isPartOf":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/#website"},"primaryImageOfPage":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/#primaryimage"},"image":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/#primaryimage"},"thumbnailUrl":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/98500425_hi016492235.jpg","datePublished":"2017-11-15T21:56:14+00:00","dateModified":"2017-11-16T20:31:59+00:00","breadcrumb":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/#primaryimage","url":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/98500425_hi016492235.jpg","contentUrl":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/98500425_hi016492235.jpg","width":660,"height":371},{"@type":"BreadcrumbList","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/admitting-cybercriminals-to-hospital-through-the-front-door\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/d3.harvard.edu\/platform-rctom\/"},{"@type":"ListItem","position":2,"name":"Submissions","item":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/"},{"@type":"ListItem","position":3,"name":"Admitting cybercriminals to hospital through the front door"}]},{"@type":"WebSite","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/#website","url":"https:\/\/d3.harvard.edu\/platform-rctom\/","name":"Technology and Operations Management","description":"MBA Student Perspectives","potentialAction":[{"@type":"性视界Action","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/d3.harvard.edu\/platform-rctom\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission\/24214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission"}],"about":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/types\/hck-submission"}],"author":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/users\/9962"}],"replies":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/comments?post=24214"}],"version-history":[{"count":0,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission\/24214\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/media\/24215"}],"wp:attachment":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/media?parent=24214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/categories?post=24214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}