The Healthcare Industry Cybersecurity Task Force’s report on healthcare cyber security echoes a similar study on medical device security issued by Synopsys and the Ponemon Institute.

On the heels of a damning study by Synopsys and the Ponemon Institute, which provides a blow-by-blow accounting of the many problems with medical device security, a federal task force has finally released its report on the poor state of healthcare cyber security and how to fix it. The report, issued by the Health Care Industry Cybersecurity Task Force, was mandated by the Cybersecurity Act of 2015, identifies six “high-level imperatives” to improve healthcare cyber security in the U.S.:

1. Define and streamline leadership, governance, and expectations for healthcare cyber security.
2. Increase the security and resilience of medical devices and health IT.
3. Develop the workforce capacity necessary to prioritize and ensure healthcare cyber security awareness and technical capabilities.
4. Increase healthcare cyber security readiness through improved awareness and education.
5. Identify mechanisms to protect R&D efforts and intellectual property from attacks or exposure.
6. Improve information sharing of industry threats, risks, and mitigations.

Medical Devices, Legacy Systems Pressing Issues for Healthcare Cyber Security

The federal task force’s findings on medical device security echoed those of the Ponemon/Synopsys report, meaning that it is largely nonexistent: There are no standards, no testing procedures, and no accountability. The task force urges medical device manufacturers to improve manufacturing and development transparency; bake cyber security into the software development lifecycle when developing medical devices and EHRs (including issuing security patches throughout the product’s lifecycle); and collaborate with healthcare organizations to establish standards for device-device authentication.

Legacy systems also pose grave risks to healthcare cyber security. This was illustrated by the recent WannaCry ransomware attacks, which targeted machines using older versions of Windows and hit the U.K.’s National Health Service particularly hard, forcing facilities to cancel procedures and divert emergency patients. Among other proactive security measures, the task force instructs healthcare organizations to 1) inventory their data environments and document unsupported operating systems, devices, and EHR systems; 2) when possible, replace or upgrade systems with supported alternatives that have superior security controls; 3) in cases where equipment cannot be replaced, develop and document retirement timelines; and 4) leverage segmentation, isolation, hardening, and other compensating risk reduction strategies for the remainder of each piece of equipment’s lifecycle.

A Point Person and a Set of Standards Are Needed

Modern healthcare organizations operate in a complex data environment that involves not only the protection of patient records but also payment card data, tax data, and a multitude of devices used both to store information and treat patients. Meanwhile, healthcare organizations are subject to multiple security standards and frameworks, many of which contradict each other. Worse yet, in some areas, such as smart medical devices, there are no standards.

To address these issues, the task force recommends appointing a single person within the Department of Health and Human Services (HHS) to coordinate healthcare cyber security initiatives and liaise with other cyber security centers within the government, as well as a cybersecurity rapid response team whose job would be to respond to vulnerabilities in medical devices.

Further, the task force recommends utilizing the National Institute of Standards and Technology (NIST) Cybersecurity Framework to standardize risk assessment and definitions industry-wide. That said, the task force recognizes that the NIST framework is generic, and not all sections can be directly mapped to a healthcare environment; therefore, the task force recommends that NIST work with HHS to develop an application of the framework specific to healthcare cyber security environments.

The key takeaway from the taskforce report is that proactive cyber security, with risk assessments, testing, and robust compliance standards, will win the day.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]

Four Important Lessons from the WannaCry Ransomware Attacks

The recent WannaCry ransomware attacks put cyber security on the front page of every newspaper in the world. Now, everyone knows what ransomware is and how destructive it can be, but will anything change? Following are four critical lessons that both organizations and individuals should take away from WannaCry.

No Organization is “Too Small” or “Unimportant” to Be Hacked

Too many businesses still think that only national or multinational firms, or companies in certain industries, have to worry about cyber security. However, hackers do not discriminate, and neither did the WannaCry ransomware. WannaCry, which took advantage of vulnerabilities in old, unsupported versions of Windows, sought out victims according to the operating systems they were running, not the size of their enterprises. While infections at large organizations like Renault, Telefonica, and the NHS grabbed the media’s attention, small businesses were hit as well. Often, small organizations are even more susceptible to hackers than multinationals because small firms are more likely to be running wildly outdated operating systems or have a “homemade” website that may or may not be secure.

Still not convinced that your small enterprise needs to take cyber security seriously? Consider the following: Over 40% of cyber attacks target small businesses, and the U.S. Securities and Exchange Commission reports that 60% of small firms will go out of business within six months of a data breach. There is no such thing as a business that hackers “don’t care about,” and the fallout from a hack can be catastrophic.

You Must Back Up Your Systems & Data

The best way to defend against an attack like the WannaCry ransomware is to take proactive steps to ensure it doesn’t happen in the first place. However, if an attack does occur – or if your computers are damaged in a fire or a natural disaster – a backup can mean the difference between reopening your doors immediately and your company being shuttered for days, weeks, even months. Because ransomware is often programmed to snake its way through an enterprise’s entire network, make sure that your backup drives are isolated from your main systems. Even better, partner with a secure cloud backup provider that is, at a minimum, compliant with AT-101 SOC 2.

Update, Update, Update

For all the havoc it wreaked on government entities and private-sector organizations, the WannaCry ransomware left nearly all home computers unscathed. This is because individuals, unlike organizations, are more likely to be running modern operating systems, and WannaCry took advantage of vulnerabilities in old versions of Windows, some of which Microsoft stopped supporting years ago. About 98% of victims were running Windows 7, which was first released in 2009. Yet none of these infections had to happen. Windows 7 is still being supported by Microsoft, and the company issued a patch for the OS in March. Apparently, though, a lot of users never downloaded it. In some cases, this may have been due to a mysterious flaw in Windows 7 that causes some machines to spontaneously stop auto-updating.

In today’s threat environment, clinging to antiquated operating systems and software is downright dangerous, as is not regularly updating modern systems. Software and OS updates often contain important security patches addressing new and emerging threats.

You’re Probably Better off Outsourcing Your Cyber Security

Cyber security moves at the speed of technology, and technology is advancing at the speed of light. New threats are emerging daily, and just keeping up with it all is a full-time job. Most businesses simply don’t have the in-house expertise, time, or budget to handle all of their cyber security needs in-house. Outsourcing your cyber security, risk management, and compliance to an experienced, reputable firm such as Continuum GRC is cheaper and far safer than attempting to protect your systems on your own.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]

Why Your Employees Keep Clicking on Phishing Emails, and How You Can Stop It

The 2017 Verizon Data Breach Report is out, and it’s full of great news – if you’re a hacker. The study, which examined over 1,900 breaches and more than 42,000 attempts in 84 countries, showed that cyberespionage and ransomware are on the rise. The manufacturing industry is particularly vulnerable to having intellectual property and company secrets stolen by cyber spies. How do these spies and garden-variety hackers get into enterprise systems? Quite often, the Verizon report found, it all starts with a social engineering attack, most commonly a phishing email.

“Business Email Compromise” Scams Costing Firms Billions of Dollars

Verizon found that social engineering methods were used in 43% of reported breaches, and of those, 93% were in the form of a phishing email. Once hackers have successfully phished their way into an organization’s network, the next step is usually (95% of the time) to install malware.

Not long after the Verizon DBIR hit the virtual stands, the FBI came out with its own damning statistics regarding a phishing variant known as a “business email compromise” (BEC). In a BEC scam, hackers get hold of the login credentials for an email account belonging to a high-ranking company executive – once again, this is usually accomplished through phishing – and use it to send what appear to be legitimate emails requesting that employees or vendors make wire transfer payments. BEC scams, the FBI reported, saw an astounding 2,370% spike in “exposed losses” over a two-year period ending December 2016, totaling $5 billion.

Keep in mind that this $5 billion figure doesn’t count losses from other types of phishing emails, such as email spoofing or the compromise of personal email accounts. The brazen Google Docs phishing scam that ensnared approximately one million victims last week cost the state of Minnesota alone an estimated $90,000, as state employees scrambled to deal with the attack instead of doing their jobs.

The Hacks Will Continue Until Proactive Cyber Security is Prioritized

Why do employees keep clicking on phishing emails? In most cases, it’s because they don’t know any better. Despite living in an increasingly connected world, the majority of Americans have little or no understanding of cyber security best practices, especially how to identify phishing emails. They aren’t learning about cyber security best practices on their own time, and their employers aren’t teaching them, either. Companies are handing their employees login credentials, maybe installing a firewall and anti-virus package, and hoping for the best.

While technical controls such as anti-spam filters, network segmentation, and avoiding private email servers unless your organization has the in-house staff and expertise to manage them are important, the best way to protect an organization against phishing is to address the human factor and teach employees about cyber safety. Some points to remember:

• All employees must be trained on cyber security best practices, not just certain groups. Too often, enterprises will comprehensively train their IT staff and other upper-level staff members, only to have a receptionist or an intern get phished. White-collar workplaces need to take cyber safety as seriously as blue-collar environments take physical safety; anyone in the organization who touches a computer for any reason needs to know how to operate it safely, including part-time workers, temps, and interns.
• Cyber awareness training requires continuous education. The threat environment changes daily, and employees must be kept up-to-date on the latest dangers and how to avoid them.
• Penetration testing is an important part of training. By sending fake phishing emails to employees and seeing who clicks on them, enterprises will know where their weak spots are, and employees who fall victim to the fakes will learn from the experience.
• Companies must have a specific procedure for reporting suspicious emails. If an employee receives an email that looks suspicious, they should know exactly who they are to alert and how. Employees must feel comfortable reporting any activity that doesn’t look quite right so that security personnel can investigate further.

There is no such thing as an organization that is “too small” or “unimportant” to be hacked. Some small organizations think they cannot afford proactive cyber security, but can they afford to lose tens, even hundreds of thousands of dollars to a breach? Securing your enterprise systems is just as important as locking your building’s doors at night; you cannot afford not to protect your network. Until everyone realizes this, the hacks will continue, and the losses will keep mounting.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]