A major metropolitan hospital was recently hit with a devastating
cyberattack that crippled its operations and put patients lives at risk.
The response by hospital administrators took almost a week, but was
also wrong on many levels.
Salinas, CA, February 20, 2016 - The purpose of the attack on Hollywood Presbyterian Medical Center was not to steal medical records or personal health information, but rather to seize control of and lock down the hospital's entire computer system and all of its networks.
Known as “ransomware,” the attackers are demanding $3.6 million (or 9,000 in virtually untraceable BitCoins), to release control of its systems back to the hospital.
The hospital's CEO, Allen Stefanek, has responded by saying that the attack appeared to be random and that no patient or employee information is at risk.
According to one of country's leading cyberattack experts, Steve King, chief security officer for Netswitch Technology Management, Stefanek's response was inadequate at best and possibly dangerous.
King said there are four things never to do in case of a breach of this magnitude.
* “Never wait to acknowledge a breach,” says King “The longer you delay, the more it looks like you have something to hide and the less your customers will trust you. A week is crazy-long.”
* “Never insult the public's intelligence by saying that ‘no patient or employee information is at risk’ when it is obvious that if the attackers were clever enough to lock down the hospital's systems, they are certainly capable of stealing the medical records as well.”
* “Never suggest that you were attacked ‘randomly’ as if by some quirk of fate this horrible thing came your way simply out of the blue. It is likely that these hackers targeted the Hollywood Presbyterian Medical Center specifically because they knew their cyber-security defenses were weak or non-existent.”
* “Never pay the ransom,” says King. “Take the hit. Pay whatever you have to in order to re-create it all and button it up so it won't happen again. Then, walk back everything you have said and come clean.”
Mary Siero, an experienced CIO in Healthcare and a prior recipient of the Chief Information Security Officer (CISO) of the Year Award, concurs that companies need to be better prepared for ransomware, which is increasing at an alarming rate.
“Organizations should not assume that the breach is minor without an in-depth assessment and should also not assume that sensitive data has not been breached until they have their assessment,” says Siero. “Hopefully the organization has considered the seriousness of these and other breaches and developed an Incident Response Plan in advance of breaches.”
But Siero also acknowledges that the complexities of networks and organizational systems and the technology consumerization movement has made it difficult to protect from attack on all fronts.
“Security is not a perfect science, it is dependent upon people processes and technology,” Siero says. “It is a mistake for an organization to think they can prevent all types of breaches and as such, detective controls need to supplement preventive controls as part of a comprehensive security program.”
Kim Green, Chief Information Security Officer (CISO) for Zephyr Health Technology, agrees that preventative measures are the best defense against an attack, but that healthcare has always lagged behind other industries in implementing and assuring secure computing environments.
She says the reasons for this are well documented, i.e., inadequate security funding, ineffective security training, unpatched healthcare legacy systems, ability to provide secure systems that do not impact the continuum of care, and system integrations with suppliers and partners who have not undergone proper security assessments.
“First, all businesses should have a sound anti-ransomware policy in effect,” she says. “An anti-ransomware policy is a highly confidential document and differs from incident response and data breach communication policies.
Green says the policy should define: 1) How the business plans to communicate with the attacker. 2) Who the business plans to contact and communicate with during and after the attack, such as the FBI or a security consultancy firm specializing in ransomware cleanup. 3) Whether or not the business plans to pay. If so, how much? 4) Whether or not a data silo and/or offline backups must be maintained. 5) What type of cyber insurance coverage should be maintained.
Both Siero and Green agree that the attack on Hollywood Presbyterian is a wake-up call to the healthcare industry, and that nobody is immune.
“Hopefully they can learn that 1), it can happen to them, 2), an incident response plan is vital and 3) the value of a comprehensive cyber security program is worth every dollar,” says Siero.
Green says implementation of an anti-ransomware policy and defenses are vital, but also providing employees with hands-on, real-world security scenario training in tactics like phishing, baiting and tailgating, are also imperative.
“If you are in the healthcare space and are fortunate enough to have avoided a breach thus far, take a lesson from this event and start investing in your own cyber-defenses right now,” says King “I am sure you are on someone's list somewhere.”
ABOUT STEVE KING
Steve King, COO, Netswitch Technology Management, Inc. was selected for Nine Lives Media’s sixth annual MSPmentor 250. The global list identifies the world’s leading Managed Services Provider (MSP) executives, entrepreneurs, experts, coaches and community leaders. You can see the entire list at: http://www.mspmentor.net/top250
“I am honored to be selected,” said King, COO, Netswitch. “We are pleased that our innovative Managed Security Services platform MADROC, has received so much attention and acknowledgement. MADROC is the first integrated Advanced Threat Defense solution available as a SaaS and we have been overwhelmed by the market response. We will continue to innovate with new advanced threat protections in order to maintain our leadership position and stay ahead of the cyber-criminals and the continually evolving nature of malware.”
The sixth annual MSPmentor 250 list is richer and deeper with MSP executives from across the globe. An associated list, called Locked in the NOC (network operations center), honors MSP Hall of Famers who have made a lifetime impact in the market (http://www.mspmentor.net/top250/noc).
About Netswitch:
Netswitch is a global technology solutions provider, serving businesses of all sizes whose model for success relies upon secure, smoothly running, and fully integrated IT systems.
Netswitch provides next generation Managed Security Services and IT Infrastructure Support in the US and Asia with offices in San Francisco, Chicago, Thailand, Beijing, Hong Kong and Shanghai.
The MADROC® Integrated Security Platform is in use at over 3,000 client sites around the world providing intrusion detection and prevention, advanced behavioral analytics, preemptive breach detection, monitored and managed web firewalls and gateways, security information and event management, managed incident response and remediation and complete audit-ready regulatory compliance.
For more information, please visit us at http://www.netswitch.net/
Contact:
Marci Bracco Cain
Chatterbox PR
Salinas, CA 93901
(831) 747-7455
http://www.netswitch.net/
Salinas, CA, February 20, 2016 - The purpose of the attack on Hollywood Presbyterian Medical Center was not to steal medical records or personal health information, but rather to seize control of and lock down the hospital's entire computer system and all of its networks.
Known as “ransomware,” the attackers are demanding $3.6 million (or 9,000 in virtually untraceable BitCoins), to release control of its systems back to the hospital.
The hospital's CEO, Allen Stefanek, has responded by saying that the attack appeared to be random and that no patient or employee information is at risk.
According to one of country's leading cyberattack experts, Steve King, chief security officer for Netswitch Technology Management, Stefanek's response was inadequate at best and possibly dangerous.
King said there are four things never to do in case of a breach of this magnitude.
* “Never wait to acknowledge a breach,” says King “The longer you delay, the more it looks like you have something to hide and the less your customers will trust you. A week is crazy-long.”
* “Never insult the public's intelligence by saying that ‘no patient or employee information is at risk’ when it is obvious that if the attackers were clever enough to lock down the hospital's systems, they are certainly capable of stealing the medical records as well.”
* “Never suggest that you were attacked ‘randomly’ as if by some quirk of fate this horrible thing came your way simply out of the blue. It is likely that these hackers targeted the Hollywood Presbyterian Medical Center specifically because they knew their cyber-security defenses were weak or non-existent.”
* “Never pay the ransom,” says King. “Take the hit. Pay whatever you have to in order to re-create it all and button it up so it won't happen again. Then, walk back everything you have said and come clean.”
Mary Siero, an experienced CIO in Healthcare and a prior recipient of the Chief Information Security Officer (CISO) of the Year Award, concurs that companies need to be better prepared for ransomware, which is increasing at an alarming rate.
“Organizations should not assume that the breach is minor without an in-depth assessment and should also not assume that sensitive data has not been breached until they have their assessment,” says Siero. “Hopefully the organization has considered the seriousness of these and other breaches and developed an Incident Response Plan in advance of breaches.”
But Siero also acknowledges that the complexities of networks and organizational systems and the technology consumerization movement has made it difficult to protect from attack on all fronts.
“Security is not a perfect science, it is dependent upon people processes and technology,” Siero says. “It is a mistake for an organization to think they can prevent all types of breaches and as such, detective controls need to supplement preventive controls as part of a comprehensive security program.”
Kim Green, Chief Information Security Officer (CISO) for Zephyr Health Technology, agrees that preventative measures are the best defense against an attack, but that healthcare has always lagged behind other industries in implementing and assuring secure computing environments.
She says the reasons for this are well documented, i.e., inadequate security funding, ineffective security training, unpatched healthcare legacy systems, ability to provide secure systems that do not impact the continuum of care, and system integrations with suppliers and partners who have not undergone proper security assessments.
“First, all businesses should have a sound anti-ransomware policy in effect,” she says. “An anti-ransomware policy is a highly confidential document and differs from incident response and data breach communication policies.
Green says the policy should define: 1) How the business plans to communicate with the attacker. 2) Who the business plans to contact and communicate with during and after the attack, such as the FBI or a security consultancy firm specializing in ransomware cleanup. 3) Whether or not the business plans to pay. If so, how much? 4) Whether or not a data silo and/or offline backups must be maintained. 5) What type of cyber insurance coverage should be maintained.
Both Siero and Green agree that the attack on Hollywood Presbyterian is a wake-up call to the healthcare industry, and that nobody is immune.
“Hopefully they can learn that 1), it can happen to them, 2), an incident response plan is vital and 3) the value of a comprehensive cyber security program is worth every dollar,” says Siero.
Green says implementation of an anti-ransomware policy and defenses are vital, but also providing employees with hands-on, real-world security scenario training in tactics like phishing, baiting and tailgating, are also imperative.
“If you are in the healthcare space and are fortunate enough to have avoided a breach thus far, take a lesson from this event and start investing in your own cyber-defenses right now,” says King “I am sure you are on someone's list somewhere.”
ABOUT STEVE KING
Steve King, COO, Netswitch Technology Management, Inc. was selected for Nine Lives Media’s sixth annual MSPmentor 250. The global list identifies the world’s leading Managed Services Provider (MSP) executives, entrepreneurs, experts, coaches and community leaders. You can see the entire list at: http://www.mspmentor.net/top250
“I am honored to be selected,” said King, COO, Netswitch. “We are pleased that our innovative Managed Security Services platform MADROC, has received so much attention and acknowledgement. MADROC is the first integrated Advanced Threat Defense solution available as a SaaS and we have been overwhelmed by the market response. We will continue to innovate with new advanced threat protections in order to maintain our leadership position and stay ahead of the cyber-criminals and the continually evolving nature of malware.”
The sixth annual MSPmentor 250 list is richer and deeper with MSP executives from across the globe. An associated list, called Locked in the NOC (network operations center), honors MSP Hall of Famers who have made a lifetime impact in the market (http://www.mspmentor.net/top250/noc).
About Netswitch:
Netswitch is a global technology solutions provider, serving businesses of all sizes whose model for success relies upon secure, smoothly running, and fully integrated IT systems.
Netswitch provides next generation Managed Security Services and IT Infrastructure Support in the US and Asia with offices in San Francisco, Chicago, Thailand, Beijing, Hong Kong and Shanghai.
The MADROC® Integrated Security Platform is in use at over 3,000 client sites around the world providing intrusion detection and prevention, advanced behavioral analytics, preemptive breach detection, monitored and managed web firewalls and gateways, security information and event management, managed incident response and remediation and complete audit-ready regulatory compliance.
For more information, please visit us at http://www.netswitch.net/
Contact:
Marci Bracco Cain
Chatterbox PR
Salinas, CA 93901
(831) 747-7455
http://www.netswitch.net/
