NIST SPECIAL PUBLICATION 1800-24

---

Securing Picture Archiving and Communication System (PACS):

Securing Picture Archiving and Communication System (PACS):

Cybersecurity for the Healthcare Sector

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra

Bronwyn Hodges

Jason Kuruvilla*

Kevin Littlefield

Bob Niemeyer

Chris Peloquin

Sue Wang

Ryan Williams

Kangmin Zheng

*Former employee; all work for this publication done while at employer.

FINAL

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-24

The first draft of this publication is available free of charge from: https://www.nccoe.nist.gov/library/securing-picture-archiving-and-communication-system-nist-sp-1800-24-practice-guide

NIST SPECIAL PUBLICATION 1800-24

Securing Picture Archiving and Communication System (PACS): Cybersecurity for the Healthcare Sector

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra

National Cybersecurity Center of Excellence National Institute of Standards and Technology

Bronwyn Hodges

Jason Kuruvilla*

Kevin Littlefield

Bob Niemeyer

Chris Peloquin

Sue Wang

Ryan Williams

Kangmin Zheng

The MITRE Corporation McLean, Virginia

*Former employee; all work for this publication done while at employer.

FINAL

December 2020

U.S. Department of Commerce

Wilbur Ross, Secretary

National Institute of Standards and Technology

Walter G. Copan, Undersecretary of Commerce for Standards and Technology and Director

Volume A

• Executive Summary
  • Challenge
  • Solution
  • Benefits
  • Share Your Feedback
  • Collaborators

Volume B

• 1 Summary
  • 1.1 Challenge
  • 1.2 Solution
  • 1.3 Benefits
• 2 How to Use This Guide
  • 2.1 Typographic Conventions
• 3 Approach
  • 3.1 Audience
  • 3.2 Scope
  • 3.3 Assumptions
  • 3.4 Risk Assessment
    • 3.4.1 Establishing the Risk Context
    • 3.4.2 System Actors
    • 3.4.3 Use Case Scenarios
      • 3.4.3.1 Sample Radiology Practice Workflows
      • 3.4.3.2 Image Data Access Across the Enterprise
      • 3.4.3.3 Accessing, Monitoring, and Auditing
      • 3.4.3.4 Imaging Object Change Management
      • 3.4.3.5 Remote Access
    • 3.4.4 Threats
    • 3.4.5 Vulnerabilities
    • 3.4.6 Risk
  • 3.5 Security Control Map
  • 3.6 Technologies
• 4 Architecture
  • 4.1 Architecture Description
    • 4.1.1 PACS Ecosystem Components
    • 4.1.2 Data and Process Flow
    • 4.1.3 Security Capabilities
    • 4.1.4 Asset and Risk Management
    • 4.1.5 Enterprise Domain and Identity Management
      • 4.1.5.1 Access Control
    • 4.1.6 Network Control and Security
      • 4.1.6.1 Network Segmentation and VLANs
      • 4.1.6.2 Firewall and Control Policies
      • 4.1.6.3 Microsegmentation
      • 4.1.6.4 Anomalies and Events Detection (Behavioral Analytics)
      • 4.1.6.5 Intrusion Detection and Prevention Systems
    • 4.1.7 Endpoint Protection and Security
    • 4.1.8 Device Hardening and Configuration
      • 4.1.8.1 Malware Detection
    • 4.1.9 Data Security
      • 4.1.9.1 Data Encryption (at-rest and in-transit)
    • 4.1.10 Remote Access
  • 4.2 Final Architecture
• 5 Security Characteristic Analysis
  • 5.1 Assumptions and Limitations
  • 5.2 Scenarios and Findings
  • 5.3 Analysis of the Reference Design’s Support for Cybersecurity Framework Subcategories
    • 5.3.1 Asset Management (ID.AM)
    • 5.3.2 Risk Assessment (ID.RA)
    • 5.3.3 Identity Management and Access Control (PR.AC)
      • 5.3.3.1 Identity Management
      • 5.3.3.2 Access Control
    • 5.3.4 Data Security (PR.DS)
    • 5.3.5 Information Protection and Procedures (PR.IP)
    • 5.3.6 Protective Technology (PR.PT)
    • 5.3.7 Anomalies and Events (DE.AE) and Security Continuous Monitoring (DE.CM)
  • 5.4 Security Analysis Summary
• 6 Functional Evaluation
  • 6.1 PACS Functional Test Plan
    • 6.1.1 PACS Functional Evaluation Requirements
    • 6.1.2 Test Case: PACS-1
    • 6.1.3 Test Case: PACS-2
    • 6.1.4 Test Case: PACS-3
    • 6.1.5 Test Case: PACS-4
    • 6.1.6 Test Case: PACS-5
    • 6.1.7 Test Case: PACS-6
    • 6.1.8 Test Case: PACS-7
    • 6.1.9 Test Case: PACS-8
    • 6.1.10 Test Case: PACS-9
    • 6.1.11 Test Case: PACS-10
    • 6.1.12 Test Case: PACS-11
    • 6.1.13 Test Case: PACS-12
• 7 Future Build Considerations
• Appendix A List of Acronyms
• Appendix B References
• Appendix C Pervasive Versus Contextual Controls
• Appendix D Aligning Controls Based on Threats

Volume C

• 1 Introduction
  • 1.1 How to Use this Guide
  • 1.2 Build Overview
  • 1.3 Typographic Conventions
  • 1.4 Logical Architecture Summary
• 2 Product Installation Guides
  • 2.1 Picture Archiving and Communication System (PACS)
    • 2.1.1 Philips IntelliSpace PACS
    • 2.1.2 DCM4CHEE
  • 2.2 VNA
    • 2.2.1 Hyland Database Server
    • 2.2.2 Hyland Acuo VNA
    • 2.2.3 PACSgear Core Server
    • 2.2.4 Hyland NilRead
  • 2.3 Secure DICOM Communication Between PACS and VNA
    • 2.3.1 Public Key Infrastructure (PKI) Certificate Creation
      • 2.3.1.1 Create PKI Certificate for Hyland Acuo VNA
      • 2.3.1.2 Create PKI Certificate for Philips IntelliSpace PACS
    • 2.3.2 Public Key Infrastructure (PKI) Certification Installation
      • 2.3.2.1 Install PKI Certificate for Hyland Acuo VNA
      • 2.3.2.2 Install PKI Certificate for Philips IntelliSpace PACS
    • 2.3.3 TLS Secure DICOM Configuration
      • 2.3.3.1 TLS Configuration for Hyland Acuo VNA
      • 2.3.3.2 TLS Configuration for Philips IntelliSpace PACS
    • 2.3.4 PACS and VNA TLS Integration Tests
  • 2.4 Modalities
    • 2.4.1 DVTk Modality Emulator
    • 2.4.2 DVTk RIS Emulator
  • 2.5 Asset and Risk Management
    • 2.5.1 Virta Labs BlueFlow
    • 2.5.2 Tripwire Enterprise
  • 2.6 Enterprise Domain Identity Management
    • 2.6.1 Domain Controller with AD, DNS, and DHCP
    • 2.6.2 DigiCert PKI
  • 2.7 Network Control and Security
    • 2.7.1 Cisco Firepower
    • 2.7.2 Cisco Stealthwatch
    • 2.7.3 Tempered Networks Identity Defined Networking (IDN)
      • 2.7.3.1 Conductor Installation
      • 2.7.3.2 HIPswitch Installation
    • 2.7.4 Zingbox IoT Guardian
    • 2.7.5 Forescout CounterACT 8
    • 2.7.6 Symantec Endpoint Detection and Response (EDR)
  • 2.8 Endpoint Protection and Security
    • 2.8.1 Symantec Data Center Security: Server Advanced (DCS:SA)
    • 2.8.2 Symantec Endpoint Protection
  • 2.9 Data Security
    • 2.9.1 Microsoft Azure Cloud Storage
    • 2.9.2 Hyland VNA Cloud Archive Device
  • 2.10 Secure Remote Access
    • 2.10.1 TDi Technologies ConsoleWorks
    • 2.10.2 Symantec Validation and ID Protection (VIP)
• Appendix A List of Acronyms
• Appendix B References