Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...
A recent wave of ransomware attacks targeting hospitals highlight the cybersecurity vulnerabilities of health-care facilities.
Bloomberg BNA Privacy & Data Security News Senior Legal Editor Jimmy H. Koo posed a series of questions to Duo Security Inc. Director of Security Research Steve Manzuik on cybersecurity threat trends and what health-care facilities should do if they're subjected to a ransomware attack.Bloomberg BNA:
Are you seeing any recent trends in cybersecurity threats to health-care facilities?Steve Manzuik:
Health-care facilities are an interesting problem from a cybersecurity perspective. They have a lot of systems running older, potentially unsupported software that, for various reasons, can't be replaced or updated. Security teams at these facilities have to deal with outdated application frameworks like JBOSS, outdated client side software like java and flash, old medical devices running unpatchable operating systems and now, we can add cryptolocker/ransomware to the list of potential threats.
While these aren't really new trends there seems to be a heightened attention on attacking health-care organizations. The ability to monetize a successful attack as well as the willingness for organizations to pay out a ransom seems to have compounded the threats.Bloomberg BNA:
The use of ransomware is on the rise and recently, the U.S. and Canada released a ransomware alert. Are health-care facilities particularly vulnerable against these types of malware?Manzuik:
I don’t think health-care facilities are more vulnerable to this threat than other organizations. However, thinking from an attacker’s perspective, you are almost guaranteed to capture sensitive data—health records, billing information and other personal identifying information—when you attack a health-care facility with a cryptolocker/ransomware type threat. Combine that with the dangerous precedent set by those organizations who have paid the ransom and you have a very attractive target for an attacker.
Ransomware has been around since sometime before 2013 where we saw a variant called cryptolocker that wasn't used in targeted attacks but more randomly sent to targets of opportunity. For cryptolocker, many end users—consumer—were infected with only a few corporations being hit. The big change here is the targeting of health-care organizations which as stated is due to the nature of the data they have.
The ability to monetize a successful attack as well as the willingness for organizations to pay out a ransom seems to have compounded the threats.
What kind of techniques do hackers employ to plan malware in a health-care facility’s information system?Manzuik:
The most common way this malware gets introduced is via a phishing attack where they essentially trick a user into either visiting a malicious link or opening a malicious attachment. Typically, these links or attachments leverage known vulnerabilities in components such as Flash and Java which give the malware elevated access to the target system.
While we like to think of hackers as big Nation States with billions of backing behind them, the reality is that most attackers will go for the target with the most damning data and which takes the least amount of effort. With the recent Medstar compromise it was rumored, but since debunked, that an out-of-date application server may have been the culprit. While these types of issues definitely exist in the health-care space, phishing attacks have proven to be more reliable and harder to detect until after the attack.Bloomberg BNA:
If a health-care facility is under attack by a ransomware, what should it do?Manzuik:
Before they become under attack by ransomware, health-care organizations should be reviewing their requirements under the Health Insurance Portability and Accountability Act. HIPAA requires organizations to not only have proper backups in place for important data but also an emergency plan to allow data to be accessed in the event of an incident or other emergency. Having good backups is key here.
Just as health-care companies have routinely stated for the public: prevention is key. Rather than constantly responding to attacks after they happen, health-care organizations would be wise to put better protections in place to prevent attacks from happening in the first place. In the case of preventing phishing attacks, Duo Security recommends internal trainings and basic security solutions such as password managers and two-factor authentication, which both quickly and simply raise the bar against an attack.
It’s back to the basics—Duo recommends the following security practices to increase overall security hygiene for health-care organizations:
These recommendations apply to the majority of security problems, not just ransomware.
Just as health-care companies have routinely stated for the public: prevention is key.
Are there lessons to be learned from the recent cyberattack on Medstar?Manzuik:
I think the overall lesson here is that organizations are still failing to plan for these kinds of attacks before they happen. The ransomware aspect is what is making these health-care attacks particularly compelling for readers and the media. The actual attacks themselves aren’t much different than what every organization, no matter their size or industry, should be actively trying to prevent from happening in the first place.
The fact that this type of attack is successful on an organization that has regulatory requirements designed to prevent exactly this type of thing from happening is troubling. Regulatory requirements alone are clearly not enough to prevent attacks. Organizations need to be proactive and vigilant, perhaps even beyond what is required by law.
Medstar’s response, especially the criticism they have aimed at the media attention, has been rather curious and suggests that organizations need to be better prepared to not only proactively defend against attacks but also have a proper response plan in place that includes how to handle public reports. While no one wants to see themselves make the news due to a breach, all organizations should have a plan in place on how to put their best foot forward and calm public fears versus trying to simply stop the conversation.
All Bloomberg BNA treatises are available on standing order, which ensures you will always receive the most current edition of the book or supplement of the title you have ordered from Bloomberg BNA’s book division. As soon as a new supplement or edition is published (usually annually) for a title you’ve previously purchased and requested to be placed on standing order, we’ll ship it to you to review for 30 days without any obligation. During this period, you can either (a) honor the invoice and receive a 5% discount (in addition to any other discounts you may qualify for) off the then-current price of the update, plus shipping and handling or (b) return the book(s), in which case, your invoice will be cancelled upon receipt of the book(s). Call us for a prepaid UPS label for your return. It’s as simple and easy as that. Most importantly, standing orders mean you will never have to worry about the timeliness of the information you’re relying on. And, you may discontinue standing orders at any time by contacting us at 1.800.960.1220 or by sending an email to firstname.lastname@example.org.
Put me on standing order at a 5% discount off list price of all future updates, in addition to any other discounts I may quality for. (Returnable within 30 days.)
Notify me when updates are available (No standing order will be created).
This Bloomberg BNA report is available on standing order, which ensures you will all receive the latest edition. This report is updated annually and we will send you the latest edition once it has been published. By signing up for standing order you will never have to worry about the timeliness of the information you need. And, you may discontinue standing orders at any time by contacting us at 1.800.372.1033, option 5, or by sending us an email to email@example.com.
Put me on standing order
Notify me when new releases are available (no standing order will be created)