Is cybersecurity the weakest NHS supply chain link?

The NHS faces a grow­ing cyber threat, with the sup­ply chain a par­tic­u­lar vul­ner­a­bil­i­ty. What is the nature of the prob­lem – and how can it be addressed?

The health service’s pro­cure­ment process is as com­plex as it is size­able. Cyber­crim­i­nals will take the eas­i­est attack option, and that weak link can often be found down­wind in the sup­ply chain.

Eliz­a­beth Giug­no is head of cat­e­go­ry for cyber­se­cu­ri­ty at Crown Com­mer­cial Ser­vice (CCS). In a recent arti­cle for Dig­i­tal Health, she not­ed that the NHS has seen a “sig­nif­i­cant increase in cyber attacks since the begin­ning of the pan­dem­ic” and flagged the pro­cure­ment process as a key focus for cyber resilience. 

So how exact­ly do cyber attacks threat­en the pro­cure­ment process? A Novem­ber 2021 Nation­al Cyber Secu­ri­ty Cen­tre (NCSC) report revealed that ran­somware attacks are unsur­pris­ing­ly high on the health­care agen­da. This high­lights the dan­ger of social engi­neer­ing – where a vic­tim is tricked into open­ing the doors to an attack – and the threat posed when sys­tems aren’t up to date with secu­ri­ty pro­tec­tions. 

“The NHS strug­gles to get devices deliv­ered with cur­rent and sup­port­ed oper­at­ing sys­tems and espe­cial­ly keep­ing these main­tained and patched once they are in,” says Phil Howe, CTO at Core to Cloud, which pro­vides cyber­se­cu­ri­ty tech­nol­o­gy and ser­vices into the NHS. 

“Ran­somware is clear­ly the major issue fac­ing health­care today,” says Dr Saif F Abed, found­ing part­ner of Cyber­se­cu­ri­ty Advi­so­ry Ser­vices at The Abed­Gra­ham Group, a clin­i­cal­ly led reg­u­la­to­ry affairs and risk man­age­ment con­sul­tan­cy in the health­care space. When prod­ucts and ser­vices are under con­sid­er­a­tion, pro­cure­ment process­es must be robust enough to judge their resilience “in the face of increas­ing­ly sophis­ti­cat­ed attack­ers”. 

Physician, heal thyself

Dr Jacqui Tay­lor is CEO at cloud ser­vice archi­tects Fly­ing­Bi­na­ry and an advi­sor to the UN on the effec­tive use of new pro­cure­ment prac­tices. She under­lines the com­plex­i­ty of the health ser­vice and the impact this has on the sup­ply chain: 

“We always dis­cuss the NHS as if it was an organ­i­sa­tion — it is not,” Tay­lor says. “It is a com­plex series of organ­i­sa­tions, most of which have auton­o­my for the way in which they pro­cure ser­vices and often the ser­vices they sup­ply.” 

Take GPs, the front-line physi­cians who are often the first con­tact for patients. There were 35,146 GPs around the UK in 2020, whose surg­eries func­tion as small busi­ness­es. Across such a frag­ment­ed estate, inter­op­er­abil­i­ty is a key weak­ness of NHS pro­cure­ment. 

“From a cyber­se­cu­ri­ty per­spec­tive the NHS is a dis­trib­uted organ­i­sa­tion which is con­nect­ed by tech­nol­o­gy,” Tay­lor says, one where “the cyber risks are unquan­ti­fied and not under­stood, cer­tain­ly not by the major­i­ty of the peo­ple who work there.”

Mitigating the risk

Unsur­pris­ing­ly, there are plen­ty of mea­sures already in place to help secure the NHS sup­ply chain from cyber attacks. These include the manda­to­ry DCB0129 Clin­i­cal Risk for Health IT stan­dard, under which sup­pli­ers must show that they’ve bench­marked and assessed the patient safe­ty impacts should their solu­tions be com­pro­mised. There’s also the Data Secu­ri­ty Pro­tec­tion Toolk­it (DSPT), which demands base­line tech­ni­cal secu­ri­ty stan­dards and sets 10 secu­ri­ty stan­dards around peo­ple, process and tech­nol­o­gy to help guide trusts. “Both of these can help de-risk pro­cure­ment,” Abed says. 

Then there’s the Edge4Health plat­form, which aims to stream­line the process­es between sup­pli­ers and providers while increas­ing com­pli­ance. This should pro­vide a more agile way for pro­cure­ment teams to engage with sup­pli­ers, while cre­at­ing trans­paren­cy in the process, accord­ing to Abed. 

The prob­lem from a pure­ly cyber­se­cu­ri­ty per­spec­tive is that it’s hard to judge how suc­cess­ful it can actu­al­ly be. The rea­son, accord­ing to Abed, is that inte­grat­ing stan­dards and audit­ing their appli­ca­tions post-pro­cure­ment are “dis­tinct­ly dif­fer­ent chal­lenges”.

Tay­lor says the plat­form is yet anoth­er exam­ple of rein­vent­ing the wheel, some­thing the NHS “is famous for”. Indeed, the one-stop-shop idea is “almost but not as com­pre­hen­sive as the set of cyber ser­vices that NHS Dig­i­tal rec­om­mends via the NCSC frame­work,” she says. 

And then there’s accred­i­ta­tion. Is it real­is­tic to expect require­ments like ISO27001 or Cyber Essentials/Plus to reach all the way along com­plex sup­ply chains?

These are all about review­ing the con­trols with­in a state­ment of applic­a­bil­i­ty, Howe says. They help to “show that a sup­pli­er has put in place, doc­u­ment­ed and audit­ed their inter­nal secu­ri­ty.” 

How­ev­er, while agree­ing that such base­line stan­dards are pos­i­tive, Abed warns that they aren’t health­care spe­cif­ic. Ulti­mate­ly, “accred­i­ta­tion is only one step in a com­plex process to effec­tive­ly man­age risk,” he says.

Forward thinking 

Sup­ply chains are more vul­ner­a­ble than ever across all sec­tors. This presents a par­tic­u­lar­ly tricky chal­lenge for the NHS. Ulti­mate­ly, ask­ing dif­fi­cult ques­tions of the wider sup­ply chain is essen­tial to pre­vent weak links in the NHS pro­cure­ment process. 

“Fur­ther invest­ment in audit­ing sup­pli­ers and sup­port­ing local pro­cure­ment teams” will have a sig­nif­i­cant impact, along with ensur­ing account­abil­i­ty, Abed con­cludes.  

As for the sup­pli­ers them­selves, Tay­lor advis­es that with­out NCSC Cyber Essen­tials accred­i­ta­tion, they “don’t have a chance of under­stand­ing how to work across the NHS estate.” Any sup­pli­er must under­stand the impor­tance of scale across such a huge and com­pli­cat­ed oper­a­tion. “As a sup­pli­er, I rec­om­mend you agree the scale propo­si­tion upfront so you can be sure of the cyber­se­cu­ri­ty con­trols you will need.”