IT Support and Hardware for Clinics
32.1K views | +1 today
Follow
IT Support and Hardware for Clinics
News, Information and Updates on Hardware and IT Tools to help improve your Medical practice
Your new post is loading...
Your new post is loading...
Scoop.it!

How to stop ransomware: It's really not that complicated

How to stop ransomware: It's really not that complicated | IT Support and Hardware for Clinics | Scoop.it

Ransomware. The word itself is scary enough, let alone the glimpse of just how damaging such attacks could be that the world saw in WannaCry and NotPetya during May and June. But cybersecurity experts counter that ransomware shouldn’t actually be so overwhelming to information security professionals -- if they adhere to simple best practices. 

For starters, backup files are crucial and those should be both encrypted and kept offline -- separate from the main network, according to Engin Kirda, professor of electrical and computer engineering and computer and information science at Northeastern University.

 

Lee Kim, HIMSS’ director of privacy and security said the real problem is that hospitals are often stuck running outdated, legacy systems. And even keeping pace with software patches is not always completely effective. Both NotPetya and WannaCry, for instance, leveraged vulnerabilities in these legacy systems.

In fact, Kim explained that when hospitals system must run these outdated systems, including those upon which medical devices are built, it’s necessary to make sure the ports of entry are as closed off as possible. 

 

“If an organization needs to run these systems, shelter the technology from the outside world and segment it from the network,” Lee said. “It’s always best practice to segment the network and not make it possible for one hacker to get in and pivot around your system.”

After patching, segmenting and software needs, Kim said that hospitals can increase defenses with pen testing, which actively scans the system or network for exploitable vulnerabilities.

“I can’t think of a better way to be prepared,” said Kim. “[Pen testing] should be done not just once in a blue moon, it needs to be done regularly. 

Hospitals should authorize the testing with a vendor or security employee with experience to ensure there are no disruptions due to high traffic. 

Risk assessments can also help reveal weaknesses and build defenses. 

 

“We want to make things more difficult for the attackers and reduce the volume of attacks,” she said.

Not surprisingly, the crux of the ransomware issue boils down to the biggest weakness to all networks: the user.

It’s a simple technique, hackers craft emails and trick users into action, Kirda said. “It’s just that some users don’t understand ransomware, and they end up doing things that allow a successful attack.”

 

So phishing training is critical, explained Kim. “It’s the adage of you’re only as strong as your weakest link. You can’t ignore teaching employees what to do and what not to do.”

Fortunately, there’s a lot that can be done with the human element. Naturally, employees should be trained to be cautious about opening attachments. “For an attack to be successful,” Kim said, “they just need a door or one hole to squeeze through.”

Some organizations are also labeling email as external, which can help employees determine the validity of an email sent supposedly from a member within the company. IT can add it to the bottom of every email in red. If an email is sent from outside it will push through the designated filter and notify the user it’s from an outside party.

 

Anti-phishing, user education and clearly marking emails as external or internal are basic blocking and tackling that can go a long way to thwarting attacks. Kim also recommended seeking outside help when you need it.

 

“Study up or hire someone experienced in cybersecurity,” Kim said. There are plenty of ethical hacking pointers available online, and “yet there are so many health organizations vulnerable to attacks. It’s really a twilight zone experience.” 

Ultimately, the issue lies with infosec professionals explaining why cybersecurity needs to be at the forefront of budget discussions and planning -- because it’s a safe bet that the attacks will keep on coming due to profitability. 

“Healthcare is low-hanging fruit,” Kim said. “That’s the unfortunate reality: the dragon is at the door.” 

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
No comment yet.
Scoop.it!

The Year of the Data Breach - HIPAA-HITECH Compliance Software & Consulting - Clearwater Compliance

As early as July, 2014 was already being called “The Year of the Data Breach”. Big brands like Home Depot and Target were the headliners, but they weren’t alone.  Retailers and financial institutions of all sizes were combating cyber crime after cyber crime. Meanwhile, the healthcare industry suffered its share of incidents as well. In fact, 2014 saw the U.S. Department of Health and Human Services’ database of major breach reports (those affecting 500 people or more) surpass 30.1 million people.

The good news is that 2014 is over. The bad news is that in 2015, things could get even worse.


It seems that 2014 was more of “a sign of things to come” than it was “a moment in time.” This rings especially true for those of us who are safeguarding protected health information.

We have entered an unprecedented era where cyber attacks are becoming more frequent and more sophisticated with every passing day.

In a recent 60 Minutes special, FireEye CEO David DeWalt estimated that 97 percent of companies are getting breached, with hundreds of thousands of attacks happening on a weekly basis across the globe.


Retailers, banks and others are consistently increasing their spending related to security. They are trying diligently to prevent attacks. But in today’s environment, DeWalt believes that breaches “are inevitable.”

The burden that breaches place on the economy, individual organizations and consumers is significant. Widespread compromises of data are driving $11 billion plus in fraud each year. Just as costly is the fact that we are teetering on a crisis of confidence. Can anyone really protect sensitive data?

Given all this, should we just waive the white flag and surrender?

Obviously, the answer is no. While breaches may indeed be “inevitable” at the macro level, there are absolutely things that can be done to reduce the amount of breaches that occur, and to give your organization a better chance of not being part of the statistics. What’s more, the eventual damage a breach causes is highly contingent upon how well you respond to it.

Consider this scary statistic. From the time a “bad guy” hacks into sensitive data, it typically takes 229 days for the breach to be detected. 229 days!

DeWalt argues, as do we, that trying to prevent a breach is only part of what your organization should be doing. A comprehensive approach means that you are assessing your risk of falling victim to a breach, identifying ways to mitigate that risk from coming to life and appropriately planning for how you will respond if you do experience a breach. In other words, how are you assessing and managing information risk within your organization?

The criminals eventually are going to find their way into organizations.

So, the task at hand if you’re among the unlucky ones is to make sure the bad guys don’t gain access to your most important information, that you identify breaches much more quickly and that you stop the criminals from leaving with valuable information. In short, limit the damage.

The plain truth is that the year ahead promises more of the same. A cybersecurity war is being waged, and your data is at the center of it. Make sure you are prepared for battle. If you haven’t done so already, I’d encourage you to download Clearwater’s whitepaper explaining our Information Risk Management Capability Advancement Model. It’s a free resource, and it offers an extensive framework for determining how well you are equipped to manage information risks, and what steps you should consider in the year ahead to strengthen your internal programs.

Here’s to hoping 2015 is a breach-free year for you!


more...
No comment yet.
Scoop.it!

Cybercriminal gang plunders up to $1 billion from banks over two years

Cybercriminal gang plunders up to $1 billion from banks over two years | IT Support and Hardware for Clinics | Scoop.it

A still-active cybercriminal gang has stolen up to a $1 billion from banks in at least 25 countries over the last two years, infiltrating networks with malware and spying on employees’ computers to facilitate large wire transfers, Kaspersky Lab said Sunday.

The computer security vendor, which said it will release a report Monday on its findings, said the gang penetrated deeply into the banks’ networks, taking time to learn about internal procedures to make their fraudulent activity less suspicious.

In some cases, the gang learned about wire transfer systems by watching administrators’ computers over video.

“In this way the cybercriminals got to know every last detail of the bank clerks’ work and were able to mimic staff activity in order to transfer money and cash out,” Kaspersky said in a news release.

The group, called Carbanak after the malware the gang installed on computers, attempted to attack up to 100 banks and e-payment systems since 2013 in 30 countries. The gang members are suspected to be from Russia, Ukraine, other parts of Europe and China.

Some of the financial institutions affected are in Australia, Brazil, Bulgaria, Canada, China, Czech Republic, France, Germany, Hong Kong, Iceland, India, Ireland, Morocco, Nepal, Norway, Poland, Pakistan, Romania, Russia, Spain, Switzerland, Taiwan, Ukraine, the U.K., the U.S.

None of the banks or financial institutions have been named. Kaspersky said in a news release on that Interpol and Europol are involved in the investigation.

Each theft took between two and four months, Kaspersky said. Bank computers would be infected with malware through spear-phishing attacks, which involves sending targeted emails with malicious attachments or links to select employees.

Spear-phishing emails are crafted in a way to make it likely a recipient will open an attachment or click a link that appears innocuous but installs malicious software on a computer.

As much as $10 million was stolen in a raid at a time, Kaspersky said. Funds were transferred using online banking or e-payment systems to the gang’s own accounts or to other banks in the U.S. and China.

In other instances, the attackers had deep control within a bank’s accounting systems, inflating account balances in order to mask thefts. For example, Kaspersky said that an account with $1,000 would be raised to $10,000, with $9,000 transferred to the cybercriminals.

ATMs were also targeted, Kaspersky said. The gang commanded the machines to dispense money at a certain time, with accomplices ready to pick up the disgorged cash.


more...
No comment yet.