Analysing digital evidence towards enhancing healthcare security practice: The KID model

Due to emergency situations in healthcare, there is a requirement in electronic health records in various hospitals for emergency access known as "Break-the-glass"or self-authorization. This is in compliance with the availability aspect of the information security (IS) principles. This requirement therefore, provides broad access to healthcare staff. Meanwhile internal users of Electronic health records (EHR) system such as the healthcare staff can exploit their legitimate broad access right to breach privacy and hence, the need to analyse the digital evidence of their logs towards enhancing privacy and security.But, the lack of labelled data makes it challenging to efficiently assess the security practice of the users in a big data context. Therefore we developed a K-means iterative and discriminate model (KID model) towards identifying normal and abnormal security practice among healthcare staff with unlabelled logs of EHR of a typical hospital. The model was tested with real logs which captured all evidence of the healthcare staff's login and logout transactions between 13 May 2014 and 17 April 2021. The data contains 933,508 sessions from 1,220 unique users in 2,623 unique days and these were anonymised.The model was evaluated to be reliable with the Silhouette approach and it was used to determine abnormal and normal security practices. Some staff logged in for over three years without logout which is a huge security gap. Multiple sources of login sessions of the system administrator's account was also detected. Other abnormal clusters also showed unusual patterns of long session duration and some healthcare staff such as doctors and nurses were averagely using one terminal in a day to create login and logout sessions. Management could take measures to investigate into the cause of long session duration as that can be an opening for session hijacking. Also, the normal and abnormal behaviour which were detected in the study can be further assessed to be used for labelling data for supervised learning purposes.