Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objects
Relevance. The functionality of malware has grown exponentially in recent years. There are more and more ways in which attackers can gain access to secret or personal data, as well as information stored in critical information infrastructure, including those related to the healthcare sector, but the...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | Russian |
| Published: |
Publishing house "Ophthalmology"
2022-12-01
|
| Series: | Офтальмохирургия |
| Subjects: | |
| Online Access: | https://ophthalmosurgery.ru/index.php/ophthalmosurgery/article/view/448/710 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1850066726142607360 |
|---|---|
| author | R.V. Alekhin A.I. Katasonov M.V. Lesnevskii D.N. Smirnov |
| author_facet | R.V. Alekhin A.I. Katasonov M.V. Lesnevskii D.N. Smirnov |
| author_sort | R.V. Alekhin |
| collection | DOAJ |
| description | Relevance. The functionality of malware has grown exponentially in recent years. There are more and more ways in which attackers can gain access to secret or personal data, as well as information stored in critical information infrastructure, including those related to the healthcare sector, but the consequences of attacks on such objects lead to serious consequences. A striking example is the leak of data to the public from the database of the unified dispatch service of the Lipetsk Region, which contained a lot of information about the patient, including their full name and address. Purpose. Investigation of the vulnerability BDU:2022-05212, which allows an attacker to gain full rights to the infrastructure. On the basis of the research done, to study the principles of operation of this vulnerability, as well as classify it and identify the consequences for CII objects. Make a list of measures necessary to ensure security against attacks of this kind. Material and methods. This article describes how to gain unauthorized access through the CAS administrative interface by calling the URL on the page that is used to install the default on the server and create the first administrator user. As well as an experimental study of this vulnerability, methods for its detection and consequences for CII subjects was carried out. Results. In accordance with the Federal Law of July 26, 2017 Nо. 187-FZ, definitions are considered that allow classifying information systems in the field of health care as CII and consider an actual example of data leakage in this area due to the vulnerability of the CAS server at the network level. The article also discusses the basics of the CAS server, compiled a vulnerability classification table BDU:2022-05212, and indicated the basic vulnerability vector metric according to the FSTEC standards. The conclusion in this article is based on how to protect against this vulnerability, as well as recommendations for resolving the problem if the attack has already been committed before. The results of the study will improve the level of authentication security in web applications and sites using CAS server technologies, organizations operating in the banking sector, as well as in the healthcare sector related to CII. Conclusion. The article puts the key – the security of the infrastructure of subjects of critical information infrastructure in the field of healthcare. This article will be useful for employees of the information security department working with CII objects, especially those operating in healthcare, banking, and other areas of the financial market. |
| format | Article |
| id | doaj-art-b9970bf312d549a589f036767431feeb |
| institution | DOAJ |
| issn | 0235-4160 2312-4970 |
| language | Russian |
| publishDate | 2022-12-01 |
| publisher | Publishing house "Ophthalmology" |
| record_format | Article |
| series | Офтальмохирургия |
| spelling | doaj-art-b9970bf312d549a589f036767431feeb2025-08-20T02:48:39ZrusPublishing house "Ophthalmology"Офтальмохирургия0235-41602312-49702022-12-011334s11512210.25276/0235-4160-2022-4S-115-122Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objectsR.V. Alekhin0https://orcid.org/0000-0002-3750-2376A.I. Katasonov1https://orcid.org/0000-0002-3441-3984M.V. Lesnevskii2https://orcid.org/0000-0003-4266-7535D.N. Smirnov3https://orcid.org/0000-0002-2804-2128The Bonch-Bruevich Saint Petersburg State University of Telecommunications, Saint Petersburg, Russian FederationThe Bonch-Bruevich Saint Petersburg State University of Telecommunications, Saint Petersburg, Russian FederationA.I. Katasonov,The Bonch-Bruevich Saint Petersburg State University of Telecommunications, Saint Petersburg, Russian FederationA.I. Katasonov,The Bonch-Bruevich Saint Petersburg State University of Telecommunications, Saint Petersburg, Russian FederationA.I. Katasonov,Relevance. The functionality of malware has grown exponentially in recent years. There are more and more ways in which attackers can gain access to secret or personal data, as well as information stored in critical information infrastructure, including those related to the healthcare sector, but the consequences of attacks on such objects lead to serious consequences. A striking example is the leak of data to the public from the database of the unified dispatch service of the Lipetsk Region, which contained a lot of information about the patient, including their full name and address. Purpose. Investigation of the vulnerability BDU:2022-05212, which allows an attacker to gain full rights to the infrastructure. On the basis of the research done, to study the principles of operation of this vulnerability, as well as classify it and identify the consequences for CII objects. Make a list of measures necessary to ensure security against attacks of this kind. Material and methods. This article describes how to gain unauthorized access through the CAS administrative interface by calling the URL on the page that is used to install the default on the server and create the first administrator user. As well as an experimental study of this vulnerability, methods for its detection and consequences for CII subjects was carried out. Results. In accordance with the Federal Law of July 26, 2017 Nо. 187-FZ, definitions are considered that allow classifying information systems in the field of health care as CII and consider an actual example of data leakage in this area due to the vulnerability of the CAS server at the network level. The article also discusses the basics of the CAS server, compiled a vulnerability classification table BDU:2022-05212, and indicated the basic vulnerability vector metric according to the FSTEC standards. The conclusion in this article is based on how to protect against this vulnerability, as well as recommendations for resolving the problem if the attack has already been committed before. The results of the study will improve the level of authentication security in web applications and sites using CAS server technologies, organizations operating in the banking sector, as well as in the healthcare sector related to CII. Conclusion. The article puts the key – the security of the infrastructure of subjects of critical information infrastructure in the field of healthcare. This article will be useful for employees of the information security department working with CII objects, especially those operating in healthcare, banking, and other areas of the financial market.https://ophthalmosurgery.ru/index.php/ophthalmosurgery/article/view/448/710critical information infrastructure protectioninformation securityhealthcare industryvulnerabilitiesinfotelecommunications |
| spellingShingle | R.V. Alekhin A.I. Katasonov M.V. Lesnevskii D.N. Smirnov Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objects Офтальмохирургия critical information infrastructure protection information security healthcare industry vulnerabilities infotelecommunications |
| title | Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objects |
| title_full | Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objects |
| title_fullStr | Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objects |
| title_full_unstemmed | Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objects |
| title_short | Study of the critical vulnerability of the authentication service and the consequences for medical institutions related to CIIP objects |
| title_sort | study of the critical vulnerability of the authentication service and the consequences for medical institutions related to ciip objects |
| topic | critical information infrastructure protection information security healthcare industry vulnerabilities infotelecommunications |
| url | https://ophthalmosurgery.ru/index.php/ophthalmosurgery/article/view/448/710 |
| work_keys_str_mv | AT rvalekhin studyofthecriticalvulnerabilityoftheauthenticationserviceandtheconsequencesformedicalinstitutionsrelatedtociipobjects AT aikatasonov studyofthecriticalvulnerabilityoftheauthenticationserviceandtheconsequencesformedicalinstitutionsrelatedtociipobjects AT mvlesnevskii studyofthecriticalvulnerabilityoftheauthenticationserviceandtheconsequencesformedicalinstitutionsrelatedtociipobjects AT dnsmirnov studyofthecriticalvulnerabilityoftheauthenticationserviceandtheconsequencesformedicalinstitutionsrelatedtociipobjects |