Category: data security

Auto Added by WPeMatico

 

The Office of the National Coordinator Releases Guidance on Recent International Ransomware Campaign

With the news of the newest international ransomware campaign that is currently affecting some organizations within the Health Care sector, it is important to not only educate staff on necessary precautions, but also be aware of steps to take in the instance you are infected by a ransomware attack.

The following information was distributed  today by the Office of the National Coordinator (ONC).  Please take a moment to review the information and prepare your organization in the event that an attack occurs.

Be sure to review our preparedness recommendations and contact us with any questions.

Health and Human Services/Assistant Secretary of Preparedness and Response Critical Infrastructure Protection Program

If you are the victim of a ransomware attack

If your organization is the victim of a ransomware attack, HHS recommends the following steps:

  1. Please contact your FBI Field Office Cyber Task Force or US Secret Service Electronic Crimes Task Force immediately to report a ransomware event and request assistance. These professionals work with state and local law enforcement and other federal and international partners to pursue cyber criminals globally and to assist victims of cyber-crime.
  2. Please report cyber incidents to the US-CERT and FBI’s Internet Crime Complaint Center.
  3. **NEW**If your facility experiences a suspected cyberattack affecting medical devices, you may contact FDA’s 24/7 emergency line at 1-866-300-4374. Reports of impact on multiple devices should be aggregated on a system/facility level.
  4. For further analysis and healthcare-specific indicator sharing, please also share these indicators with HHS’ Healthcare Cybersecurity and Communications Integration Center (HCCIC) at HCCIC@hhs.gov

Mitigating against this threat

  • Educate users on common phishing tactics to entice users to open malicious attachments or to click links to malicious sites.
  • Patch vulnerable systems with the latest Microsoft security patches available here.
  • Verify perimeter tools are blocking Tor .Onion sites
  • Use a reputable anti-virus (AV) product whose definitions are up-to-date to scan all devices in your environment in order to determine if any of them have malware on them that has not yet been identified. Many AV products will automatically clean up infections or potential infections when they are identified.
  • Monitor US-CERT for the latest updates from the U.S. government. See below for current reporting.
  • Utilize HPH Sector ISAC and ISAO resources. See below for further information.

US-CERT Resources

Multiple Petya Ransomware Infections Reported

06/27/2017 12:56 PM EDT

Original release date: June 27, 2017 US-CERT has received multiple reports of Petya ransomware infections occurring in networks in many countries around the world. Ransomware is a type of malicious software that infects a computer and restricts users’ access to the infected machine until a ransom is paid to unlock it. Individuals and organizations are discouraged from paying the ransom, as this does not guarantee that access will be restored. Using unpatched and unsupported software may increase the risk of proliferation of cybersecurity threats, such as ransomware.

Petya ransomware encrypts the master boot records of infected Windows computers, making affected machines unusable. Open-source reports indicate that the ransomware exploits vulnerabilities in Server Message Block (SMB). US-CERT encourages users and administrators to review the US-CERT article on the Microsoft SMBv1 Vulnerability and the Microsoft Security Bulletin MS17-010. For general advice on how to best protect against ransomware infections, review US-CERT Alert TA16-091A. Please report any ransomware incidents to the Internet Crime Complaint Center (IC3).

Sector ISAO and ISAC resources

National Health Information-Sharing and Analysis Center has shared the following TLP-White Message and will continue to share information at nhisac.org.

HITRUST has shared the following Threat Bulletin for distribution.

ONC and OCR resources

  • ONC provides many helpful resources about Health IT Security to include cybersecurity guidance materials and training at here and here.
  • OCR provides cybersecurity guidance materials including a cybersecurity checklist, ransomware guidance and cyber awareness newsletters at here.

Powered by WPeMatico

17 Measures Every Health Care Organization Should Consider to Reduce the Risk of Cyber-Intrusions

cybersecurity

The importance of privacy in the health care industry starts at the most basic level between a patient, a doctor, and the doctor’s laptop computer. The levels of importance and complexity increase exponentially when you look at entire networks of payers and providers. The amount of data produced and stored in these organizations is staggering and keeping it secure is of the utmost importance. We have identified misconceptions about cybersecurity. We’ve covered some of the legal obligations the c-suite is under to secure its organization’s data. With the rise cyber-intrusions like ransomware, we know it’s important to effectively train employees and follow the guidelines provided by the Federal Department of Health and Human Services.

With the developments expected in this space under the Trump Administration, it is vital that every health care organization is prepared on the cybersecurity front.

Below is our list of 17 measures every health care organization should consider to reduce the risk of cyber-intrusions.

  1. Conduct internal compliance and risk assessments, to determine your organization’s vulnerability to cyber-attacks. This includes, but is not limited to, the security risk analysis required under the HIPAA Security Rule for covered entities and their business associates.
  2. Develop and implement corporate policies and procedures required for compliance with federal and state privacy and security laws.
  3. Develop quick-response teams to handle potential cyber-attacks, using pre-formulated decision trees and procedures so that you don’t have to develop them while under the fire of an ongoing attack.
  4. Establish secure data backup protocols to ensure that, even if your company is under attack, important company records are secure and available.
  5. Establish protocols to deal with common forms of cyber-attacks (denial of service, etc.).
  6. Line up outside experts, if necessary based upon the risk profile of your company, to swing into action if company processes are overwhelmed by a cyber-attack.
  7. Perform periodic audits of cybersecurity practices against industry norms, accepted best practices, and the risk profile of your organization.
  8. Implement information security best practices, reflect them in information security policies, records retention and management policies, and in internal controls/standard operating procedures.
  9. Make certain the CEO and executive leadership are properly informed about the cyber risks to your company and that they’re involved in oversight and the decision-making process related both to cyber-attacks and proactive cybersecurity measures.
  10. Review funding of all electronic security measures to ensure they are adequate to cover not only routine compliance measures but also to allow for proactive testing and probing of systems in light of increasingly sophisticated measures being used by hackers.
  11. Collect only that protected health information and personally identifiable information from clients, customers, or company personnel that is needed for identified business needs, with the retention of such information being only for as long as it serves those business needs, with storage being accomplished in a way that minimizes the chance of it being of any use outside the organization (encryption, etc.).
  12. Obtain cyber insurance and understand the coverage, including the legal counsel and other experts the company is permitted to engage under the policy.
  13. Coordinate cyber incident response planning across the entire company.
  14. Store sensitive information securely (encrypting where appropriate) and away from other data that does not require the same level of protection. Use a layered defense approach to protect “crown jewel” information.
  15. Conduct appropriate data security due diligence on third-party service providers with access to protected health information, personal identifiable information, and/or sensitive business information, and require them to enter into agreements that they are implementing robust data security procedures, following up to ensure these requirements are in fact implemented.
  16. Assess ways in which your company’s access vulnerabilities (website, VPNs, remote access, and so forth) are configured to minimize potential intrusion risk, with regular testing and probing to update and address identified risks.
  17. Perform companywide training, tailored to the personnel at issue, to ensure personnel understand the importance of following all security policies and procedures and reporting any suspected violations.

This list was generated as part of a Legal News: Cybersecurity newsletter by Greg Husisian, Chanley Howell and Jacob Heller titled, “Cybersecurity and the New Trump Administration: Your Top Ten Questions Answered.” Click here for the original publication.

Powered by WPeMatico