Health care is considered a critical national infrastructure, along with services such as electricity and water. This creates an attractive target for cybercriminals who want to wreak havoc like what was recently aired on the fall finale of “Grey’s Anatomy,” on The ABC Television Network.
While the episode showcased a dramatic worst-case scenario of all systems being compromised, the reality is that when a cyber incident occurs, medical devices and equipment connected to a network can be taken over and exploited. Health data is the most common type of theft, but as more devices become connected, hospitals become vulnerable to more persistent threats on patients.
The WannaCry ransomware attack that struck on May 12 and quickly spread around the world was anything but routine. Heretofore, most ransomware attacks were initiated after a successful phishing effort; that wasn’t the case with WannaCry. Ransomware attacks are generally confined and targeted; this one, to date, has hit more than 100,000 organizations in over 150 countries.
With that kind of impact, you’d think the attackers made off with quite a haul. Not quite — IBM X-Force research has been tracking bitcoin wallet payments associated with WannaCry, and as of May 18, the fraudsters have accumulated less than $70,000 in bitcoin.
Additionally, most ransomware attacks are carried out by relatively amateurish criminals in the cybercrime community. We believe that there is a highly talented group behind the WannaCry attacks, possibly one of several global organized crime groups that routinely distribute malware.
Download the Ransomware Response Guide from IBM INCIDENT RESPONSE SERVICES
Health Care and Ransomware: A Marriage Made in Hades
However, there is one aspect of this attack that may well become disturbingly routine: The targeting of hospitals and health care providers with ransomware onslaughts. What started as a few isolated ransomware attacks against health care organizations in 2015 grew to several more last year.
The widespread proliferation of WannaCry has only solidified ransomware as a formidable threat to the health care industry. This malware has hit several health care providers, none harder than the U.K.’s National Health Service, which had to decline outpatient visits on May 12. To a lesser extent, other organizations in India and China were among the targets.
Ransomware attacks in general are growing exponentially. More than 4,000 ransomware attacks occur daily in the U.S., and health care is the largest target, as reported by Healthcare IT News. Cybercriminals have clearly found a sweet spot in health care, with the industry now plagued by cyberattacks of a scope, severity and variety unimaginable even a few years ago. Such an unwanted relationship seems like a marriage made in Hades. This sharp increase is driven by the relatively low cost of launching most ransomware attacks and the great difficulty law enforcement faces in finding perpetrators.
Health Care: A Prime Target for Ransomware
There are several good reasons for ransomware attackers to target health care organizations. The most obvious is the mission-critical administrative and clinical systems within them. If those systems are compromised or rendered useless by ransomware encryption, the entire care delivery work processes can be interrupted, and patients will adversely suffer. The consequences are far different from a business that counts lost revenue when systems go down or are taken down. Faced with the choice of paying relatively little money in hopes of getting their systems back or facing possibly dire consequences, health care professionals often pay attackers when they fail to take adequate steps in anticipation of such an incident.
Second, health care organizations are still lagging in their adoption of data security solutions. In fact, a KPMG report found that hospitals invest as little as one-tenth the amount spent by other industries on data security. This is a real conundrum, given the high value of medical records and the fact that health care professionals need this data to continue serving patients. However, decision-makers in executive boards face hard choices for capital investment and can easily short-shift security spending in favor of revenue-producing investments, such as a new MRI device. Ransomware attackers are quickly becoming aware of such investment deficiencies.
Inadequate funding also means that health care organizations often have a relatively high volume of older infrastructure, including software. Moreover, many health care organizations find it challenging to maintain their critical infrastructure while ensuring no downtime for patching and data backup. Network segmentation, high availability and disaster recovery planning are key to protecting sensitive data. It was unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems that opened the door for WannaCry.
According to John Halamka, the noted chief information officer (CIO) of Boston’s Beth Israel Deaconess Medical Center, “Some mission critical systems were created years ago and never migrated to modern platforms. In 2017, there are still commercial products that require Windows XP, for which few patches are available.”
Despite these and other factors that make health care a prime target for ransomware attackers, U.S. organizations were largely spared the wrath of WannaCry, except for a few labs and users of certain medical devices. One reason is that the attack first unfolded in Europe before spreading elsewhere, giving U.S. organizations a bit more time to double down their defenses. Also, it appears that U.S. health organizations may have applied Microsoft patch MS17-010 more aggressively than did their international counterparts.
Minimizing the Threat of Ransomware
Now that the spread of WannaCry appears to have dissipated, security professionals must ask what they can do to mitigate ransomware.
IBM has been reaching out to clients and taking calls every day to make sure they know the steps to take to significantly minimize the threat of ransomware attacks. These steps include:
- Patching: All health care organizations should to be sure to patch the vulnerability right away. We use an automation tool, which has kept our customers pretty safe since the malware, in this case, needs an unpatched vulnerability. This is critical to stop the ransomware when it reactivates.
- Blocking: For any unpatched systems, blocking is the next line of defense. Health care organizations should ensure that all signatures are up to date on their antivirus systems and network blocking technologies.
- Monitoring: We’re getting accurate reads from our security operations centers (SOCs), which leverage deep security analytics and Watson, which can help detect these patterns emerging.
- Response: Organizations should consult with security advisers to devise an optimal response playbook that aligns with business processes and strict compliance requirements.
These steps are pragmatic and can be implemented in each facility, given the right skills and valid action plan. Had more organizations victimized by WannaCry followed these practices, fewer of them would have suffered severe damages or had to pay for the safe return of their data.
Learn More
IBM published a comprehensive, free Ransomware Response Guide that is a good read for all CIOs, CISOs and others responsible for data security in health care. To learn more about the WannaCry outbreak, listen to our on-demand webinars.
Health care organizations should use a holistic enterprise approach to implement their security strategy. IBM developed a health care security immune system to address the major pain points in the industry. Additionally, cognitive and augmented intelligence in the core of each enterprise security system has become essential to transform defense capabilities and help win the war on cybercrime.
The post Why Has Health Care Become Such a Target for Cyberattacks? appeared first on Security Intelligence.
Article Link: https://securityintelligence.com/health-care-and-ransomware-a-marriage-made-in-hades/