Development of Cybersecurity Policies and Systems for Hospitals

This project focuses on the development of cybersecurity policies and systems for hospital IT infrastructure. It begins with an overview of the increasing implementation of IT in hospitals and the associated cyber risks, emphasizing the critical need for robust security measures to protect sensitive patient data. The project outlines the aim to develop and implement a security system using the Java platform to prevent data theft and unauthorized access. Objectives include reviewing literature, analyzing current information flow, identifying vulnerabilities, studying existing security models, developing a new security model, implementing Java code, and testing the system. Research questions address the necessity of a new cybersecurity system, potential threats, consequences of inadequate security, and methods to strengthen information security. The expected outcomes include reduced data processing risks, enhanced data security, improved system performance, increased resilience against hacking, and simplified cybersecurity processes. The project includes a literature review covering various cybersecurity models and their applications, followed by a detailed discussion of cybersecurity policies, information control, cyber-attacks, mitigation strategies, and risk prevention in healthcare settings. The methodology involves selecting a preferred language (Java), exploring organizational security policy models, establishing a hospital security plan, and identifying effective safety and security measures. The project culminates in the development of a security policy model for healthcare systems, addressing information security, privacy in healthcare, and the effects of security awareness. The implementation phase will involve coding and testing the developed system. The project's ultimate goal is to create a secure and reliable IT environment for hospitals, safeguarding patient data and ensuring operational integrity.

DEVELOPMENT OF CYBER
SECURITY POLICIES AND CYBER
SECURITY SYSTEM IN THE
HOSPITAL

Table of Contents
1. Title..........................................................................................................................................3
2. Background of the project........................................................................................................3
2.1 Aim....................................................................................................................................3
2.2 Objectives..........................................................................................................................3
2.3 Research questions............................................................................................................4
2.4 Expected outcomes of the project.....................................................................................4
3. Literature Review.....................................................................................................................5
4. Cyber security.........................................................................................................................11
4.1 Security policies in the hospital environment.................................................................12
4.2 Information control and security policy in healthcare systems.......................................23
4.3 Cyber security in hospital...............................................................................................27
4.4 Cyber-attacks in the hospital...........................................................................................30
4.5 How to mitigate the cyber risks in the hospital...............................................................33
4.6 Cyber security risks in healthcare...................................................................................34
4.7 Preventing healthcare cyber security issues....................................................................36
1

4.8 Evolution of cyber security in healthcare.......................................................................41
5. Methodology..........................................................................................................................42
5.1 Preferred language..........................................................................................................42
5.2 Models of organizational security policies.....................................................................43
5.3 Establishing hospital security plan..................................................................................44
5.4 Effective ways for the hospital safety and security.........................................................45
6. Security policy model in healthcare systems.........................................................................45
6.1 Security policy model in healthcare................................................................................45
6.2 Information security and privacy in healthcare...............................................................48
6.3 Security and privacy of information in mobile health-care communication system......52
6.4 Effects of Security Policies, Security Awareness in healthcare system.........................57
6.5 Developing healthcare network security policy..............................................................58
7. Project planning......................................................................................................................59
8. Implementation.......................................................................................................................60
9. References..............................................................................................................................73
2

1. Title
Development of cyber security policies and cyber security system in the hospital.
2. Background of the project
The implementation of IT infrastructure in various industries both in production and service
sector increase day to day. In hospitals, the implementation of the IT systems changes the entire
structure of the hospital and it increases the servicing capability to the new height. But at the
same time, it also has some limitations or risks. Consider the cyber-attack has happened in the
hospital. It is a nightmare. It affects people’s lives. So, the need for updating the security systems
in the hospital IT infrastructure is high. This project is regarding the development of the security
strategy and security system model for the hospital IT infrastructure. The proposed system must
capable of providing the immune against the cyber-attacks. In this report, the overall outline of
the proposal for developing the security system model is described. Here also, the various cyber-
security models currently used in various places are considered for the benchmarking.
2.1 Aim
The main intention of this proposed research work is to develop and implement the
security system to prevent the data stealing and unauthorized use of data in hospitals by using the
“Java” platform during the part of my academic project.
2.2 Objectives
For archiving the main aim of the project, the following objectives are required to be
completed. And they are listed below.
 Conduct a deep review of the various kinds of literature.
3

 Initial analysis of the current information flow chain in the hospital.
 Identification of weaker zones in the current security system.
 Study about the various security models currently used.
 Develop the security model for our case.
 Develop the java code and implement the developed code.
 Test the functioning of the developed system in the real case.
2.3 Research questions
The completion of this project involves the process of answering the following questions.
And these are the major questions (problems) resolved in this project.
 What is the need for a new cybersecurity system instead of the existing system in
hospitals?
 What are the possible threats to the Hospital’s IT system?
 What are the major consequences of the improper cybersecurity system?
 What are the different methods or strategies to strengthen information security?
 How to improve the immune against the data stealing and hacking?
2.4 Expected outcomes of the project
Here the important outcomes expected by the completion of this project is described.
4

 Reduces the risks involved in the data processing in the hospital.
 Provides security to the data stored or shared through the hospital IT system.
 Improves the performance of the system.
 Increases the immune against the hacking and data stealing.
 Reduces the complications involved in the cybersecurity process.
3. Literature Review
The authors Tristan Caulfield and David Pym described the security policy of the system
in the ‘Modelling and Simulating Systems Security policy’ paper. Managers of security face lots
of challenges in providing and designing the policies as per the requirements of an organization.
In this paper, mathematical modeling of the systems and its simulations are described. It helps
the security managers in the organization to take the decisions regarding security. Utility
theories are used for describing the policies of security for the security managers. The models
created in this paper are based on the original and real-world data obtained in the systems.
Gnosis tool is used for system modeling. Then, the created framework of the model is
implemented in the Julia language. The models used in this paper are tailgating model, sharing
of document model, device loss and composed model. Then, the results obtained from the
document sharing model in an organization are given in the form of a table and described in this
paper. By using these models, one can easily create and take decisions regarding the security
policies in the organization.
According to the research work carried out by ‘Sonya H Y Hsu’ on information sharing
and cyber threats. Here the author describes the various prototypes regarding information
sharing. It will be done by exploring the application of secure data platform including the manual
script. Here for the information sharing two methods are followed by the author. First one is data
management with confidence. And the second one is the agility regarding the information
5

exchange. Also, the examples are covered by the author regarding the information exchange and
cyber threats. And the author including the data sets and the landscape surrounding in this paper.
Mainly this paper focused on the data sharing application. And this application should regarding
the statistical research data centers. These data centers make the security need for the facilities
and the motivations. The detailed explanation is provided by the author regarding the research
data centers. These centers are helping to develop the quality of visualization of the output and
the data collection. Also, there may be a balance between the creation of big data and
accessibility. It is used to create the assists. The key functions are used by the author such as
information sharing, cybersecurity, and adaptive security technologies.
According to the research work carried out by ‘Martti Lehto’ on cyberspace threats and
the objectives and strategies of cybersecurity. Generally, the cyber threats may be classified into
many ways. This is considered as the evidence by the author when taking the cybersecurity on a
multi-national level. The common model is represented as threefold classification. It is based on
motivational factors. Nowadays many countries use this model for the cybersecurity. This is used
to handle the cybersecurity threats. Here the author described the fifth model. They are
cybercrime, cyber activism, and cyber warfare. Here the cyber-security is defined by the author
regarding the cybersecurity policies and strategic properties regarding the objective of the
cybersecurity. In this paper, the objective of the cyber-security is defined by the author for the
improvement of national cybersecurity level. For that many methods are explored by the author.
Also, the strategies of cybersecurity are delivered. These strategies are used to define the key
objective regarding the strategic priorities. The cyberspace is more increased in the rational
function in the way of providing critical support to the critical infrastructure, economy and
national security. The methods are described by the author to make the security for the
cyberspace. These are done by the national governments. Also, the cybersecurity objectives are
clearly explained by the author to develop the cyber ecosystem. Also the threats, vulnerabilities,
objects are analyzed regarding the cybersecurity.
According to the research work carried out by ‘Kartik Gopalan’ on healthcare
architecture regarding the security analysis of cyber-physical systems. Here the survey is made
6

by the author regarding the architecture of cyber-physical systems. Some of the architectures are
illustrated in this paper by the author. Most of the architectures are evaluated and examined.
From the analysis, some of the architectures are used here by the author. These architectures are
evaluated by using the sequence of qualities regarding the cyber-physical systems for healthcare.
The architecture diagrams have explained the functionality with the detailed description. Mainly
the functionality of infusion pumps is analyzed. The STRDIDE model is used by the author to
decompose the functionality to describe the security issues and how they can be addressed. The
key functions are used by the author such as software architecture, healthcare, security,
blackboard, and cyber-physical systems. Then the architectural qualities of healthcare is defined
by the author. Finally the author concluded with the comparison of security issues between the
various architectures. These comparisons are used to make the conclusion about the architecture
which is suitable for making the security based on the need of cyber-physical systems in health
care systems.
According to the research work conducted by ‘Ajeet Singh’ on a study of cyber-attacks
on cyber-physical systems. Here the improvement of cyber-physical performance is described by
the author. Generally, the cyber-physical system is represented as the patch of the cyber world
and physical world components. These components only used to make the increment of physical
performance. Also, the usage of a cyber-physical system is explained by the author in this paper.
Here the cyber-physical systems could be increased. Because the cyber and the physical devices
are connected to illustrate the state of the art technologies. When the cyber threats and the cyber-
attacks have happened, it should be documented. From the study analysis, the author described
the security issues and challenges regarding the cyber-physical systems. It is considered as the
global issue. And also, the proper mechanism is needed for the cyber-physical systems. The
author also described the investigation regarding the relationship between the cyber-physical
systems and internet of things. The cyber-attacks are clearly explained by the author regarding
the cyber-physical systems. Also, the attacks happened in recent years are explained by the
author. Then the chart is prepared by the author regarding the recent cyber-attacks. Also, the
definitions and domains are analyzed by the author regarding the cyber-physical systems. And a
lot of vulnerabilities are identified and explained by the author. They are hardware, software,
7

network, technical and platform vulnerabilities. In this paper, the different kind of vulnerabilities
is explained by the author regarding the cyber-physical systems. The different kind of challenges
is explained by the author regarding the cyber-physical systems. Also, the discussion is made
regarding the cyber-attacks, cyber threats, and the cyber-physical systems. Finally, the author
concluded with the security protocols and security measures for optimizing the cyber-attacks on
the cyber-physical system. The structural diagrams are analyzed and illustrated by the author.
According to the research work conducted by ‘Qingliang Zeng’ on statistical tests for
integrity attacks on cyber-physical systems. In this, the author described the method to detect the
integrity attack by performing the statistical tests. The detailed description of the cyber-physical
system is provided by the author. Normally, this cyber-physical system had features such as
network, computation and widespread sensing. Here, the proof is delivered by the author. The
normality of the residual error is similar to that measurements. The residual error is obtained
from the Kalman filter. The proposed method uses this kind of property. It can detect the time
correlations rather than finding the distribution changes. The author used some key functions
regarding the statistical tests. They are a linear stochastic system, estimator, cyber-physical
systems and integrity attacks. The mathematical function and the calculations are used by the
author to define the problem statement. The statistical tests are conducted by the author. For each
detection and analysis, the definition, theorem and the results are provided. The application
method and the attacks are described in this paper.
According to the research carried out by the author ‘Devesh Mishra’, the network can be
protected from threats and Ransomware by implementing cybersecurity guidelines and defense.
In this paper, the attack surface and minimization of the attack surface is explained. For
minimizing surface attack, ‘defense in depth’ compelling structure is created. There are three
types of attack surface present in the hospital network. They are Network attack surface, human
attack surface and software attack surface. And also, follow the followings to minimize the
attack surface. They are the deployment of intrusion detection and prevention system, threat
assessment, encryption, backup the data, and create a layer of defense. In the Ransomware
attack, the hacker demands ransom in order to stop the attack. The attackers hack the medical
8

devices such as MRI machine, ventilators, an endoscope and demands the hospital management
to pay the ransom. If they pay the ransom, the attacker will stop the attack otherwise the attacker
will not stop it. It causes more uncomfortable for both patients and doctors. The event and log
management, vulnerability management, access control, network and policy profile, log retention
policy, data filter and awareness program are the elements in the analysis. These are explained in
detail. The key steps for effective incident response are preparation, identification, containment,
eradication, and recovery. In the preparation step, prevention steps are taken before the attack
has happened. In identification, the incident is identified after the attack has happened. In
containment, required steps are taken to avoid further damages and in eradication, response to
the incident is provided. Finally, in the recovery testing, monitoring and validation of the system
are take place.
According to the research carried out by the author ‘H. Joseph Wen’, security and privacy
is more important in E-Healthcare information management. In healthcare organization privacy
and security of the healthcare information is most important. The patient’s personnel healthcare
information such as health conditions and test results etc. must be maintained in privacy. The
medical information about the patient can affect the patient’s basic life activities because these
are sensitive data. If the privacy of the patients’ information is not maintained properly, then it
will affect the reputation of that healthcare organization. The lack of data privacy causes more
problems in healthcare organization and the hackers can easily get any patients’ information and
demand ransom from them and the hospital management. Another most important thing in
healthcare organization is security. The computer security is more critical and sensitive with the
internet and world wide networks. There are three basic things in E-Healthcare information
security. They are availability, confidentiality and integrity. The confidentiality means the
transmitted data and data present in the system are only revealed by the authorized persons. The
unauthorized access is need to be prevented. The integrity means the data present in the network
and computer should be free from any kind of modification, deletion and creation by the
unauthorized persons. The availability means only the authorized person access the data in the
computer and network and the authorized access must not denied. And in this paper, the security
measures of physical security, personal security and administrative security are explained in
9

detail. The technical solutions for E-healthcare information systems management such as
cryptography, encryption algorithms, digital signatures, user verification, personal identification,
computer architecture, protection against viruses and network communications linkage
safeguards are explained in detail.
According to the research work carried out by ‘Pooja Mohan’ on security policies for the
intelligent healthcare environment. The security policies are described by the author regarding
the healthcare management system. Here, patient monitoring is explained by the author. The
artificial intelligence had an important role in the healthcare management system. Actually,
patient monitoring would be performed by wearing a sensor on the body. Also, these sensors
should be embedded in the environment. The quality of service should be improved based on the
personalized health care services. The information exchange needs to be improved among the
healthcare system. It is used to provide care services. By these actions, the application may be
act as a vulnerable to security risks. In this paper, the author proposed the ontology development
for handling the risks in an effective manner. It also used to manage the healthcare system
problems. Mainly it contributes to the emergency situation. The author used some key functions
for the research. They are a sensor, security, attacks, and ontology. The context-aware secure
framework is provided by the author. Also, the rules and the procedures are delivered regarding
the development of ontology. Also, the ontology representation is provided by the author by
using HTML.
According to the research work conducted by ‘Bernd Carsten Stahl’ on information
security policies. Here, the author described the policies for the particular health sector. Initially,
the organizations need to concern about the security maintenance and integrity regarding the
information sources. But in hospitals, it seems to be critical. Because it had issues regarding the
accuracy and confidentiality of the information. Security managers need to monitor security
activities. It will be more useful for the development of security policy. The research is needed to
be developed to make the contribution of security policies. It is used to protect the system from
internal and external threats. The author explored some kind of works. That is important and
legitimate. But it missed describing the various views of security and policies. Also, the author
10

described the novels insights to handle the critical section regarding information exchange. Also,
the author delivered the analysis which includes the evidence regarding the health service. The
finding results are supporting the description of information security policies. Finally, it is
concluded with the discussion of finding implications and the future research avenue. The author
used the key functions for the research. They are information security, ideology, hegemony,
critical research, and healthcare.
According to the research work carried out by ‘John A. Stankovic’ on cyber-physical
systems in wireless and healthcare. The wireless and mobile healthcare systems are rapidly
increasing nowadays. So, most of the systems are represented as cyber-physical systems. The
crucial situation may happen when designing the cyber-physical systems. So, these cyber
physical systems are constructed by using the principles and other security policies. According
to healthcare cyber-physical system, the human physiology is free and independent. These
features are used to make the increase regarding the research problems for cyber-physical
systems. Also in this paper, the author highlighted the research questions and promising
directions regarding wireless and mobile healthcare cyber-physical systems. The author used
some key functions such as challenges, security, safety, privacy, and wireless health. And also
used the system components such as sensing, monitoring, classification, and inference. Then, the
research questions are developed by the author. The privacy, security, and safety are explained.
Also, the discussion is made regarding healthcare and networks.
4. Cyber security
Cybersecurity is used to secure a network from hackers or unauthorized access. The
malicious attacks are overcome by this cybersecurity. It protects the data and important files of
the organization in a secure manner. Here, cyber-security is going to be implemented in the
hospital (Rizov, 2018).
Cybersecurity is very important to any organizations like government, defense, and medical
and in industries. Because all the data which related to the above-mentioned departments are
11