Ghayoomi Hadi, Laskey Kathryn, Miller-Hooks Elise, Hooks Charles, Tariverdi Mersedeh
Department of Civil, Environmental and Infrastructure Engineering, George Mason University, Fairfax, VA, USA.
Department of Systems Engineering and Operations Research, George Mason University, Fairfax, VA, USA.
Digit Health. 2021 Nov 29;7:20552076211059366. doi: 10.1177/20552076211059366. eCollection 2021 Jan-Dec.
This paper investigates the impact on emergency hospital services from initiation through recovery of a ransomware attack affecting the emergency department, intensive care unit and supporting laboratory services. Recovery strategies of paying ransom to the attackers with follow-on restoration and in-house full system restoration from backup are compared.
A multi-unit, patient-based and resource-constrained discrete-event simulation model of a typical U.S. urban tertiary hospital is adapted to model the attack, its impacts, and tested recovery strategies. The model is used to quantify the hospital's resilience to cyberattack. Insights were gleaned from systematically designed numerical experiments.
While paying the ransom was found to result in some short-term gains assuming the perpetrators actually provide the decryption key as promised, in the longer term, the results of this study suggest that paying the ransom does not pay off. Rather, paying the ransom, when considered at the end of the event when services are fully restored, precluded significantly more patients from receiving critically needed care. Also noted was a lag in recovery for the intensive care unit as compared with the emergency department. Such a lag must be considered in preparedness plans.
Vulnerability to cyberattacks is a major challenge to the healthcare system. This paper provides a methodology for assessing the resilience of a hospital to cyberattacks and analyzing the effects of different response strategies. The model showed that paying the ransom resulted in short-term gains but did not pay off in the longer term.
本文研究了一场影响急诊科、重症监护室及辅助实验室服务的勒索软件攻击从发起至恢复期间对医院急诊服务的影响。比较了向攻击者支付赎金并随后进行恢复以及从备份进行内部全系统恢复这两种恢复策略。
采用一个基于患者、资源受限的典型美国城市三级医院多单元离散事件模拟模型，对攻击及其影响以及测试的恢复策略进行建模。该模型用于量化医院对网络攻击的恢复能力。通过系统设计的数值实验收集见解。
虽然发现支付赎金在假定犯罪者实际按承诺提供解密密钥的情况下会带来一些短期收益，但从长远来看，本研究结果表明支付赎金并不划算。相反，在事件结束且服务完全恢复时考虑支付赎金，会使更多急需治疗的患者无法得到救治。还注意到重症监护室的恢复与急诊科相比存在滞后。在应急预案中必须考虑到这种滞后情况。
易受网络攻击是医疗系统面临的一项重大挑战。本文提供了一种评估医院对网络攻击恢复能力以及分析不同应对策略效果的方法。该模型表明支付赎金带来了短期收益，但从长远来看并不划算。
