An Integrated Threat Modeling and Mitigation Framework for IoT Healthcare Using MITRE ATT&CK and Cyber Kill Chain Models

Given the importance, timeliness, and richness of the topic, it has been extensively investigated in the literature through a wide range of studies and methodological approaches. The study by Zisad and Hasan [7] has analyzed the cyber risks associated with a healthcare system, specifically with Radiological Medical Devices (RMD), starting with a presentation of the RMD with the aim of discovering how it works, then defining the assets, and discovering the attackers' access points, which will help to build a Data Flow Diagram (DFD) representing an attacker model, and identify the vulnerabilities and threats present in the model, and propose mitigation strategies at the end to deal with these threats.

Li and Madisetti [8] also used the MITRE ATT&CK matrix to detect and prevent ransomware attacks on healthcare systems, by understanding the attackers' techniques and the IoCs that can be generated as the ransomware attack progresses, and using them to deduce mitigation solutions.

The paper by Abdelwahab et al. [9] used the MITRE ATT&CK framework to validate a robust defense system against attacks before they occur, which can help organizations minimize the damage and impact of security incidents. To do this, Abdelwahab et al. [9] first clarified a set of common terms such as vulnerability, risk, threat, etc. then cited specific examples of standards and norms of information security management that are essential for planning defense strategy, such as Critical Security Controls (CIS), and combined the MITRE ATT&CK tool and multi-criteria decision-making (MCDM) to propose a strong defense strategy.

Zahid et al. [10] conducted an in-depth analysis of the likely threats in the Industrial automation technologies domain, more specifically on the Cyber-Physical System (CPS) by mapping between MITRE ATT&CK, and NIST Security control framework to conclude that security controls are effective against identified threats, and which are known in the basis of the MITRE ATT&CK matrix.

Study by Jin et al. [11] presented the analysis of threats linked to IoT architectures, and chose to focus on the case of botnets whose aim is to carry out massive attacks on a target to impact its availability, and prevent it from responding when requested. Study by Jin et al. [11] begins by mentioning well-known botnet attacks, then describes MITRE ATT&CK, and the structure of the I3TM framework (Targeting-Threat Modeling) which will be deployed in the analysis of the attack chain by botnets on IoT architectures, by working on a concrete case of Medusa botnets.

This paper is a study of an IoT environment in the healthcare sector, clarifying the threats that can increase attack surfaces, identifying and evaluating them, using the MITRE ATT&CK framework, which was chosen because it gives a proactive view of the movements and actions of attackers according to their motivations, The paper presents a case study of the compromise of a remote cardiac patient monitoring system using the MITRE ATT&CK tool, and respecting the Cyber Kill Chain stages, and finally proposing mitigation solutions that greatly help to reduce attack surfaces and minimize risk, especially in a healthcare domain which operates with hyper-sensitive and critical data that can never tolerate the risks of compromise, unavailability, alteration or other.

MITRE ATT&CK is a commonly used paradigm for categorizing and documenting adversarial tactics, methods, and procedures. It assists security professionals in understanding, detecting, and responding to assaults by offering an organized matrix of typical attacker actions across multiple environments. This section describes the key components and primary versions.

4.1 Overview of MITRE ATT&CK

The term MITRE ATT&CK stands for MIT Research Establishment, while ATT&CK is an acronym for tactics, techniques and common adversary knowledge. It represents a tool presenting a structured and organized knowledge base in a matrix format of tactics and techniques adopted by adversaries and used by threat hunters, cyber defense professionals, and red teams to better understand attackers' strategy and approach, their behaviors, classifying them and analyzing attack lifecycle stages and common adversary behaviors, so that they can understand attacker tactics in advance, and anticipate a hunt using the framework, tactics are mapped to techniques, which are further broken down into sub-techniques [14].

MITRE ATT&CK is available in various versions and matrices, each suitable for a specific technical environment. The most commonly used are listed below [15].

• MITRE ATT&CK for Enterprise

Used very often in traditional IT environments and supports different systems such as Windows, macOS, Linux, Azure AD, Office 365, Google Workspace, AWS, GCP...etc which makes this version more sought after by SOC teams, and in security audits and IS hardening [16].

• MITRE ATT&CK for Mobile

It is a version that supports attacks targeting smartphones and tablets using Android or iOS systems, and is in greater demand in the case of BYOD security and mobile medical applications [17].

• MITRE ATT&CK for Industrial Control Systems (ICS)

Dedicated to industrial systems (SCADA, PLCs, RTUs, HMI, etc.), very often applied with great criticality in the OT (Operational Technology) domain as in energy, health, and production [18].

• MITRE ATT&CK for Cloud

Is a sub-category of the Enterprise matrix; but which takes into consideration techniques dedicated to the cloud, it is used for public cloud services (AWS, Azure, GCP, etc.), and ensures cloud security, SaaS, IaaS...

4.2 Tactics, techniques, and sub-techniques

The tactics present the motivation and rationale of the attackers, the techniques describe how the attackers achieved their goals, the sub-techniques provide a higher level of precision than the techniques, by describing exactly how the technique was deployed by the attacker. The following are examples of the tactics used by MITRE ATT&CK for each version [19].

• MITRE ATT&CK for Enterprise

- Exfiltration (TA0010): Removing and stealing data from the target machine.

- Execution (TA0002): Launching malicious code on the target's system.

- Command and Control (TA0011): Communicating with the target remotely in order to gain control.

• MITRE ATT&CK for Mobile

- Initial Access (TA0027): Obtaining an entry point that serves as a first access to the mobile.

- Persistence (TA0028): Establishing a lasting presence and access even after the target has been rebooted, updated, or cleaned.

- Impact (TA0034): Affect the target by destroying it, encrypting it, disrupting its operation, etc.

• MITRE ATT&CK for ICS (Industrial Control Systems)

- Impair Process Control (TA0115): Aiming to collect and use a set of techniques and methods to cause disruption and malfunction of an industrial process, impact its production, disrupt its safety...

- Inhibit Response Function (TA0114): Techniques used by the adversary to hinder or disable security functions altogether.

- Collection (TA0100): Gather data useful for achieving your objective, such as documents, from the ICS environment.

• MITRE ATT&CK for Cloud

- Reconnaissance (TA0043): Gathering information about the target that can be used to carry out an attack (example: cloud buckets).

-Resource Development (TA0042): Preparing and establishing the resources, tools and access needed to carry out the attack like malicious cloud accounts.

- Defense Evasion (TA0005): Bypassing and hiding the actions and movements of security tools in the cloud environment so as not to detect the attacker's malicious presence.

The techniques and sub-techniques are numerous. Table 1 showing some examples for each version of the MITRE ATT&CK matrices.

Table 1. Overview of MITRE ATT&CK tactics, techniques, and example sub-techniques

Table 3. Risk matrix table

Table 4. Mapping of risk-prioritized threats to Kill Chain stages and ATT&CK techniques

2.jpg

Figure 2. Diagram of Kill Chain stages of compromise of patient system correlated with MITRE ATT&CK

6.4 Countermeasures and mitigation mechanisms

In order to correct the potential threats previously identified in Table 2, the following solutions are proposed:

a- Installation of a Malicious Healthcare Mobile App

- Mandatory verification of digital signatures for healthcare applications (M1016: Code Signing).

- Deployment of an MDM to control installations (M1003: Application Vetting).

- Raising patient awareness of the risks of unofficial APKs (M1017: User Training).

- Enforcing installation via official stores using an ‘allowlist’ (M1002: Platform Security).

- Strengthening Android/iOS permissions to limit privilege escalation (M1018: OS Security Configuration).

b- Exploitation of Vulnerabilities in IoT Medical Devices

- Patches and firmware updates, with integrity verification (M1051: Update Software).

- Removal of default identifiers, regular key rotation (M1027: Password Policies).

- Strict network segmentation (dedicated medical VLANs) to limit lateral movement (M1030: Network Segmentation).

- Enable mutual TLS for sensors/gateways (M1041: Encrypt Network Traffic).

- Implement minimal exposure surface: disable unnecessary services (M1042: Disable Unnecessary Features).

c- Phishing Targeting Healthcare Staff

- Regular phishing simulation campaigns (M1017: User Training).

- Enable MFA on healthcare accounts (M1032: Multi-Factor Authentication).

- Deployment of anti-spam filters and DLP (M1021: Restrict Web-based Content).

- Behavioral analysis of accounts via UEBA (User Behavior Analytics).

- Blocking of dangerous macros and attachments (M1047: Audit).

d- Modification of Sensor or Medical Device Firmware

- Mandatory digital signature for all firmware (M1016: Code Signing).

- Startup integrity attestation process (Secure Boot) (M1046).

- Disabling of unsecured debug/OTA ports (M1042).

- Inventory and strict control of deployed firmware versions (M1013: Application Inventory).

- Enhanced physical security of devices (tamper-proofing) (M1050).

e- Theft and Exfiltration of Sensitive Patient Data

- Encryption of data at rest, in transit and in RAM (M1041).

- Least Privilege Access and Zero Trust to limit data exposure (M1026).

- Monitoring of outgoing traffic (DLP + L7 firewall) (M1037: Filter Network Traffic).

- Detection of anomalies in IoMT/MQTT traffic (M1031: Network Intrusion Prevention).

- Segmentation of patient data in segmented cloud environments (M1030).

f- IoT Botnet Attack Disrupting Device Availability

- IoT-aware IDS/IPS to detect botnet behavior (M1031).

- Segment critical devices in isolated medical VLANs.

- Regularly update vulnerable components (M1051).

- Rate-limit cloud endpoints to block saturation (M1030).

- Block communications to C2 via Threat Intelligence Feeds (M1035: Limit Access to C2).

g- Targeted APT Attack Against Healthcare Infrastructure

- Deployment of SIEM, EDR, and NDR for complete visibility (M1036: Monitoring).

- Zero Trust architecture (continuous verification) (M1026).

- Frequent key rotation, strict management of privileged accounts (M1027: Password Policies).

- Segmentation of critical infrastructure (DMZ, FHIR API, data lakes).

- APT response plan with continuous threat hunting (M1035).

h- Ransomware Impacting Patient Data & Clinical Services

- Behavioral detection of abnormal encryption (M1040: Behavioral Analytics).

- Offline backups, tested and restorable (M1053: Data Backup).

- Automatic isolation of suspicious hosts (M1030: Segmentation).

- Rigorous application of patches (M1051).

- Enhanced access control and MFA (M1032).

i- IoT Healthcare Supply Chain Compromised

- Verification of suppliers according to ISO 27001, ISO 13485, FDA cybersecurity guidance.

- SBOM (Software Bill of Materials) analysis for each component (M1051).

- Control of third-party libraries before deployment (M1047).

- Detection of code modifications, signatures and hashes (M1016).

- Rapid isolation of compromised components (M1030).

j- Theft of Healthcare Professional Accounts

- Mandatory MFA (M1032).

- Continuous auditing of accounts and rights (M1018: Account Use Policies).

- Regular rotation of passwords/keys (M1027).

- Detection of abnormal usage via UEBA (M1040).

- Passkeys and strong authentication for cloud access.

6.5 Discussion

Threat modelling can be carried out using different approaches and tools. In this study, MITRE ATT&CK was chosen and projected into an IoT environment in the healthcare sector. The application of the matrix revealed significant and rich results regarding the threats that may arise in the IoMT environment, and systematically revealed vulnerabilities that can be targeted by attackers who very often target this domain given the sensitivity and criticality of the data processed and circulated in this network. MITRE ATT&CK clarified a set of techniques used by attackers according to their motivations, which are presented as tactics in the framework. For example, T1566 in Table 2 presents the phishing technique exploited by the attacker to gain initial access to the target, which is presented by the ‘Initial Access’ tactic in MITRE ATT&CK. The phishing technique can be executed with one of the sub-techniques T1566.001 Spearphishing Attachment, T1566. 002 Spearphishing Link, T1566.003 Spearphishing via Service, and T1566.004 Spearphishing Voice, depending on the targeted victim. According to MITRE ATT&CK, the attacker can also guarantee the ‘Initial Access’ tactic through the Trusted Relationship technique (T1199) by compromising a third party or trusted entity in direct interaction with the target. T1041, presenting Exfiltration Over C2 Channel, is a technique identified by the attacker when their motivation/technique is ‘Exfiltration’ or data theft by exfiltration via a Command-and-Control channel. To better understand threats through MITRE ATT&CK techniques, this paper discusses a use case study that traces the path of an attack following the Cyber Kill Chain cycle, which consists of seven stages. Each stage has been correlated with a MITRE ATT&CK technique that meets the requirements for completing the stage in question. This study helps to better identify threats affecting healthcare in an IoT domain. Effective identification with MITRE ATT&CK and Cyber Kill Chain paves the way for correction and mitigation, as MITRE ATT&CK extracts tactics, techniques, and sub-techniques by putting on the hat of an attacker, which facilitates their detection and reduces the attack surface.