A ‘Crisis’ in Healthcare Security

Recently Professor Avi Rubin was invited to speak at Enigma — a new security conference geared towards those working in both industry and research, recently launched by the USENIX Association.

According to Professor Rubin, health care information security is in crisis. In this presentation, Professor Rubin emphasizes the numerous vulnerabilities of our health care system. These vulnerabilities range from overt circumventing of security protocols to blissful ignorance of network security concerns.

Professor Rubin goes on to identify what makes cybersecurity in health care different from other fields, such as financial services. Finally, Professor Rubin offers a ‘Top Ten’ list of actions the health care community can take right now to improve the cybersecurity of health care.

Watch Rubin’s talk on YouTube.

Virtual Fitness Coach from Under Armour

“It’s fascinating, what’s happening, and very exciting,” – Avi Rubin

At the 2016 Consumer Electronic Show (CES) last week, Under Armour announced a suite of products and services relevant to THaW research topics.  Journalists sought out THaW researcher (and PI at Johns Hopkins) Avi Rubin for comment.

First the athletic wear maker unveiled its first-ever collection of fitness devices, a suite of products dubbed UA HealthBox that included a wristband, a heart-rate monitor and a Wi-Fi-enabled scale — plus a separate “smart shoe” and Bluetooth headphones. It also upgraded the UA Record application that powers those devices. … “It’s fascinating, what’s happening, and very exciting,” said Avi Rubin, a Johns Hopkins computer science professor…. (Lorraine Marbella, Baltimore Sun, January 9, 2016 [http://www.baltimoresun.com/business/under-armour-blog/bs-bz-under-armour-ibm-watson-20160109-story.html])

This is the first of many such announcements we anticipate throughout 2016. The challenge facing the THaW community is how to ensure that privacy is protected and the collected data is secure.

NSF website highlights THaW

NSF highlighted the THaW project on its website last week, gaining notice in blogs like Politico morning eHealth, the HealthITSecurity, and FierceMobileHealthcare.  NSF’s article describes THaW research on mobile-app security and on the authentication of clinical staff to clinical information systems, among other things.

mAuditor: A mobile Auditing Framework for mHealth Applications

Enormous numbers of mobile health applications (mHealth apps) developed recently on mobile devices (e.g. smart-phones, tablets, etc.) have enabled health status (e.g. sleep quality, heart rate, etc.) monitoring that is readily accessible to average mobile device users. Typically, such mHealth apps involve active usage of mobile device resources, such as on-board sensors, network bandwidth, etc. The rapid increase of these applications prompted the US FDA agency to put in place regulations on mHealth app risk assessment. But these existing and upcoming regulations have not yet been accompanied by a mobile auditing framework, which provides real-time monitoring of mHealth apps’ resource usage and triggers alerts to users if abnormal resource usage patterns are detected.

Haiming mAuditor graphic

In this project, we develop a mobile auditing framework shown in the figure to the left (mAuditor Framework). The mAuditor runs as a separate process along with mHealth apps and other general purpose apps (e.g. Facebook, Gmail, etc.). The mAuditor consists of the profiler and the analyzer. The profiler collects the system trace and parse the trace if needed. The parsed trace is utilized by the analyzer, which analyzes the resource usage patterns and compare them with predefined configurations. mAuditor with its low-overhead and non-obtrusive design, monitors mHealth apps’ resource usage patterns in real-time and triggers alerts to users if abnormal resource usage patterns are detected.

This work is being spearheaded by Haiming Jin and supported by his colleagues at UIUC, Ting-yu Wang and Klara Nahrstedt.



Klara Nahrstedt honored

nahrstedt_thawACM SIGMOBILE’s group N2Women announced today its inaugural list of “10 women in networking/ communications that you should know”, including THaW co-PI Klara Nahrstedt from UIUC.  She is in impressive company – details on these ten amazing women, as well as quotes from the many people who nominated these women, are available at the link below.


Congratulations to Professor Klara Nahrstedt!

Securing Healthcare IT Needs To Step Up Its Game…

Professor Avi Rubin (Johns Hopkins University) decries the lack of cybersecurity awareness and activity in the healthcare IT sector. “Of all the industries I’ve seen, healthcare seems to be the most behind in terms of securing their IT.” To read the rest of the Professor Rubin’s interview click here.

Future Computer Science & Engineering Grad Students

It made it seem a lot more fun and engaging of a pursuit. The consensus in the student panel seemed to be that it was very difficult but well worth it.

 Student participant, Explore Graduate Studies in CSE Workshop


Launched by Prof. Kevin Fu in November, 2014 and co-led by Profs. Jenna Wiens and David Kotz in 2015, THaW professors and students led two workshops in October 2015 on “Exploring Graduate Study in CS and Engineering”. These workshops targeted undergraduate students, primarily juniors and seniors, majoring in Computer Science or related fields. The workshops aimed to educate students about the potential for an exciting career in CS&E research, either in academia and industry, and to coach them in effective ways to prepare their graduate school application.

UM Future Grad Student MeetingBoth the University of Michigan and Dartmouth College hosted one-day workshops that were open to students from around the country.  A diverse set of more than 60 students enjoyed

  • an overview of the exciting research underway at the two schools,
  • Q&A panels of faculty and current graduate students,
  • a writing clinic with tips and tricks for preparing their academic statement of purpose, and
  • one-on-one advising by professors.

Survey results show that students overwhelmingly found the workshops to be helpful in thinking about their career options. Several students mentioned that the workshops increased their overall interest in pursuing graduate studies in CSE. The workshops were funded by the NSF through the THaW grant, by Dartmouth, and by the University of Michigan.

Evaluation of ECG-Based Protocols in the Real World (on-going research)

Researchers: Professor Avi Rubin, Michael Rushanan – Johns Hopkins University

After some researchers proposed the use of electrocardiograms (ECG) as a source of biometric information for secure authentication and identification of individuals, THaW Professor Rubin and graduate student Michael Rushanan set out to test this assumption by extending work done at MIT on the post-processing of ECG data.

Their research grew out of concern with the proliferation of implantable medical devices and how to secure these devices against external network-based attacks.

Commercial companies have built their businesses upon the unique nature of ECG data. Most of the current applications have been focused on the supposed uniqueness of ECG as a biometric identifier for use in commercial transactions. Rubin and Rushanan set out to determine whether a person’s ECG really is a secure and reliable means of identification and authentication.

The ECG example below uses three different electrode placements and IPI peak identification. The purpose of this experiment was to validate if the authentication scheme under test works with slightly, but expected, noisy experiments that require physical contact.

Rushanan identified temporal granularity as their biggest research challenge and expects his first research results should be available in the coming months.

Rushanan ECG Graph

THaW researchers help secure the Precision Medicine Initiative

Earlier this year, President Obama presented a plan to launch the Precision Medicine Initiative (PMI), an ambitious research effort to recruit over one million participants in a long-term effort to understand the individual characteristics of health and disease. The research effort will aggregate clinical data as well as behavioral and environmental data – including, potentially, sensor data from smartphones and wearables – which will, needless to say, require careful security precautions and wise privacy policies.

The PMI advisory board invited THaW researcher David Kotz to a summer workshop on the potential for mobile technology in collecting data for PMI, and specifically to comment on mechanisms to support privacy.  The PMI’s proposed Privacy and Trust Principles are an interesting read! [pdf]

White HouseToday, the White House Office of Science and Technology Policy (OSTP) gathered a dozen thought leaders – including THaW team members Darren Lacey and David Kotz – to advise them as they begin developing a security framework for the Precision Medicine Initiative.  This fascinating discussion was led by Chief Data Scientist DJ Patil, and is just the first step in developing a comprehensive security framework for this important national research initiative.

THaW webinar – September 8 at NSF

Security and Privacy: Mobile Medical Applications
David Kotz, PhD – Dartmouth College

September 8, 2015      12pm-1pm ET

NSF CISE: Smart and Connected Health Presentation and Webcast
4201 Wilson Boulevard, Arlington VA, Room 110

Mobile medical applications offer tremendous opportunities to improve quality and access to care, reduce cost, and improve individual wellness and public health. These new technologies, whether in the form of software for smartphones as specialized devices to be worn, carried, or applied as needed, may also pose risks if they are not designed or configured with security and privacy in mind. For example, a patient’s insulin pump may accept dosage instructions from unauthorized smartphones running a spoofed application; another patient’s fertility-tracking app may be probing the Bluetooth network for its associated device, exposing her use of this app to nearby strangers. In this webinar, Dr. David Kotz presents an overview of the security and privacy challenges posed by mobile medical applications, including important open issues that require further research.

 Webcast Access:  https://nsf.webex.com/nsf/onstage/g.php?d=744297685&t=a