A SECURE HEALTHCARE ENVIRONMENT FOR INFORMATICS RESILIENCE

Projektinformationen

HEIR

ID Finanzhilfevereinbarung: 883275

DOI

10.3030/883275

Projekt abgeschlossen

EK-Unterschriftsdatum 22 April 2020

Startdatum 1 September 2020

Enddatum 31 August 2023

Finanziert unter

• Secure societies - Protecting freedom and security of Europe and its citizens

Gesamtkosten

€ 4 999 975,00

EU-Beitrag

€ 4 999 975,00

Koordiniert durch

INSTITUT MINES-TELECOM
France

Periodic Reporting for period 2 - HEIR (A SECURE HEALTHCARE ENVIRONMENT FOR INFORMATICS RESILIENCE)

Berichtszeitraum: 2022-03-01 bis 2023-08-31

Zusammenfassung vom Kontext und den Gesamtzielen des Projekts

The HEIR project developed a platform to protect both the IT infrastructure and the data of medical environments, typically hospitals. For infrastructure protection, the HEIR project developed and experimented a threat hunting platform that enables detection of software vulnerabilities, misconfigurations and active attacks. The threat hunting platform feeds a graphical user interface (GUI) that displays the “Risk Assessment for Medical Applications” (RAMA) score. The GUI enables an IT administrator to investigate these vulnerabilities according to their severity, and prioritize actions that will address the most severe risks. The RAMA score is also integrated in the HEIR observatory, that enables a regulatory authority to observe the status of the healthcare sector IT and issue directives for major security vulnerabilities. The privacy-aware platform (PAF) enables access to data while complying with privacy regulations. It acts as a gateway to medical data, redacting the information returned as response to queries according to policies and the role of the requester of the data.

Arbeit, die ab Beginn des Projekts bis zum Ende des durch den Bericht erfassten Berichtszeitraums geleistet wurde, und die wichtigsten bis dahin erzielten Ergebnisse

During the second period of the HEIR project, we developed the second and final version of our tools, the threat hunting platform, the privacy-aware framework and the observatory. We experimented these tools in four use cases and presented demonstrations during info days at the four pilot partners. Concerning dissemination, we led several activities towards the healthcare sector, demonstrating that cybersecurity is becoming a critical issue for healthcare. Concerning exploitation, the business model of HEIR revolves around providing a marketplace for security components and privacy-aware solutions. In order to reach out to potential customers, we also developed an online tool. The HEIR Repository encompasses a detailed description of the overall HEIR platform, highlighting the security needs addressed and the unique characteristics and advantages it offers. Additionally, it provides individual descriptions of all the components, outlining the security requirements each component addresses, along with their novel features and advantages.

Fortschritte, die über den aktuellen Stand der Technik hinausgehen und voraussichtliche potenzielle Auswirkungen (einschließlich der bis dato erzielten sozioökonomischen Auswirkungen und weiter gefassten gesellschaftlichen Auswirkungen des Projekts)

The progress beyond the state of the art in threat hunting is demonstrated by our capability to integrate tools in a single platform, and provide a mechanism for quantifying the security risk across multiple categories of tools. The question of quantifying cybersecurity is a long-standing one and our contribution in this topic constitutes a significant demonstration that one can evaluate risk from multiple sources and build meaningful comparisons. The privacy-aware framework experimentation has demonstrated the capability to create new mechanisms for information exchange in the healthcare sector, between hospitals and researchers, and between hospitals and regulatory bodies. The example of diabetes-related information exchange in Norway demonstrates the scientific and social benefits for better managing chronic diseases. More generally, the HEIR project has contributed to awareness raising of cybersecurity issues in healthcare, hopefully reducing the impact of cybersecurity incidents in hospitals by ensuring that medical and administrative staff are aware of the risks.

Official logo of the HEIR project