Category

Business Tips

Data with Lock

The Ransomware Plague in Hospitals and Healthcare

By | Backup News, Business Tips, HIPPA, Security, Small Business Computing, Tech Tips for Business Owners | No Comments
by Calyptix, June 1, 2016

The Ransomware Plague in Hospitals and HealthcareFrom pirates to mobsters to petty criminals, kidnapping for ransom is nothing new. We’re all familiar with the process – a person is abducted, the abductor demands a ransom, the ransom is paid, and then the person is released.

Now this age-old form of extortion has evolved into the technological world as ransomware.

Ransomware criminals employ the same principles as their predecessors but with a twist: the kidnappee is data.

The kidnapper in this scenario is crypto ransomware, a malware variant programmed to encrypt and lock data. After a company’s records are locked, the infected computer displays a note that demands ransom.

The perpetrator will only unlock the files once the ransom has been paid in full.

The Ransomware Plague in Hospitals and HealthcareRansomware in Healthcare

The healthcare industry in particular has been struck by a recent spate of ransomware attacks.

With few exceptions, the companies are reluctant to release specific details, leaving the investigating to the FBI.

UMASS Memorial Medical Center

An employee at UMass Memorial Medical Center in Worcester opened an email laced with ransomware last fall, resulting in dozens of locked hospital files on several different computers.

A ransom note was promptly displayed on the hospital monitors.

The hospital chose not to pay ransom, removing all of the encrypted files instead.

Security professionals later restored the system with backup files.

In response, Chief Information Security Officer Bruce Forman outlines his plan to install advanced, persistent threat software that will identify malware based on its behavior.

The Ransomware Plague in Hospitals and HealthcareHollywood Presbyterian Medical Center

On February 5, 2016, hackers locked patient files at Hollywood Presbyterian Medical Center and demanded ransom for access.

The hospital opted to shell out 40 bitcoins – approximately $17,000 – for the encryption key before calling the FBI.

The hospital was off-line over a week.

Emergency room systems, and computers used for CT scans, lab work and pharmacy needs were were all affected by the attack.

Some 911 patients were even sent to other hospitals.

The International Business Times later reported that a group of Turkish hackers had claimed responsibility for the attack via the text-sharing site Pastebin, threatening more attacks as long as the U.S. supports Kurdish rebels.

The claim is unverified however.

Prime Healthcare ManagementThe Ransomware Plague in Hospitals and Healthcare

The Los Angeles Times reported ransomware attacks on March 27, 2016 at two Prime Healthcare Management, Inc. hospitals: Chino Valley Medical Center in Chino, CA, and Desert Valley Hospital in Victorville.

Spokesperson Fred Ortega said the attacks were “immediately addressed and contained,” and no ransom was paid.

The FBI is still investigating.

A third Prime Healthcare facility, the 306-bed Alvarado Hospital in San Diego, was also infected by a crypto virus on March 31, 2016.

The Ransomware Plague in Hospitals and HealthcareMedStar Health

On March 28, 2016 Columbus, MD based provider MedStar Health shut down its database and email after a viral attack.

The provider operates 10 various hospitals, serves hundreds of thousands of patients, and has over 30,000 employees.

MedStar Health claims no information was stolen, and hasn’t labeled the culprit as ransomware, but The Washington Post reported they received a screen shot of a ransom demand for 45 bitcoins – or roughly $19,000 – from a MedStar employee.

The shutdown forced staff to go old-fashioned, relying on paper charts and records. Appointments and surgeries were also delayed.

Other healthcare organizations targeted by ransomware attacks since February, 2016 include the Los Angeles Health Department, Ottawa Hospital in Canada, Methodist Hospital in Henderson, Kentucky, and King’s Daughter’s Health in Madison, Indiana.

In each case, spokespeople reported the systems were shut down, but later restored with back-up files.

The Ransomware Plague in Hospitals and HealthcareWhy is healthcare a target?

In general, ransomware attacks are becoming more prominent because they are successful.

In 2012, a server of 5,700 computers was locked – all on the same day according to United States Computer Emergency Readiness Team.

Symantec analyzed the data and determined 2.9% of the users with locked computers had paid an average ransom of $200 per computer.

While this may be true of ransomware overall, many healthcare organizations claim they actually aren’t paying ransoms.

But some are.

Medical professionals rely on computer access for everything, from critical patient information like allergies and lab results to operating schedules.

The Ransomware Plague in Hospitals and HealthcareLocking access to records can literally be a life or death situation.

Healthcare organizations may be targets not because of their industry, but because of the types of applications they use according to Craig Williams of Talos Research in Arstechnica Report.

He suspects ransomware perpetrators scan the internet for vulnerable servers, finding many in the healthcare trade.

The increase in crypto virus attacks is also caused by the antiquated security systems employed by many companies according to Zach Forsyth at Comodo.

Healthcare organizations are relatively new to the digital game, and their security systems lack the maturity of those in the financial and technology industries.

Criminal attacks on healthcare organizations increased 100 percent between 2009 and 2013 according to the Ponemon Institute.

The trend of attacks against the vulnerable healthcare industry shows no signs of slowing. In fact, ransomware is emerging as a popular crime , states Ben Desjardin’s post on Radware.

The Ransomware Plague in Hospitals and HealthcareHow do ransomware attacks happen?

Some ransomware attacks gain access through phishing, or luring a user to click on a contaminated email or link. Vulnerable servers can also be targeted remotely.

A recent ransomware campaign against the healthcare industry in March, 2016 was under the scope of Cisco Talos Research.

Perpetrators used the open source tool JexBoss to gain traction in a server. Upon access, a ransomware variant named SamSam encrypyted multiple Window systems.

Another malware distribution method, Ransom as a Service (RaaS), emerged in 2015.

Criminals download the ransomware app builder and customize it according to the Microsoft Malware Protection Center.

Ransom MLIS/Samas also emerged early in 2016, with criminals using a penetration testing attack server that searches to exploit vulnerable networks, and uses a publicly available tool called reGeorg for tunneling.

The Ransomware Plague in Hospitals and HealthcareMSPs and VARs Beware!

It’s not just healthcare providers who should worry about their records being locked. Managed Service Providers and Value Added Re-sellers that service the healthcare industry are also at risk.

HIPAA Regulations for IT Compliance instruct that any business involved in the creation, maintenance or monitoring of electronic protected health information (ePHI) is subject to the Security Rules of HIPAA.

Compliance requires that the confidentiality and integrity of ePHIs remain intact.

Because ransomware locks files rather breaching their integrity, the jury is currently out on whether HIPAA-affected organizations have to report crypto virus attacks to the Department of Health and Human Services’ Office for Civil Rights.

It’s possible that attackers have determined ransomware victims might pay up if they can be assured the data has not been stolen, and therefore they may not have to report the breach.

The Ransomware Plague in Hospitals and HealthcareWhat can you do?

A simple solution is to back up your files. If you can access what a criminal has encrypted, you can continue to do business.

Train your employees to never click on suspicious emails or links. In addition, a strong password policy should be implemented throughout the company.

Third Tier produced a ransomware protection kit they’ll mail to you in return for a donation that supports females who want to work in the IT field.

Other remedies include installing a multi-tier defense architecture that checks software multiple times for vulnerabilities.

Web scanning can stop your system from accessing malicious sites as well.

Whitelisting is an effective tool that only allows specific, approved programs to run.

Employees can be granted a “least privilege user account,” which means they are not given administrative privileges to their computers.

Ransomware Prevention can also include blocking malicious TOR IP addresses, and testing restores.
Once your security system is set up, do not ignore it – maintain it. The Red Hat-supported JBoss server application was reported vulnerable in 2007 according to The HIPAA Journal.

A patch to correct the vulnerability has existed for almost ten years, and had it been applied, a number of ransomware attacks could have been prevented.

Be Realistic About Cross-Referrals And Your CRM

By | Business Tips | No Comments

As you build your business, you naturally explore different avenues of networking for new opportunities. One such source is the cross-referral. A powerful formula for success in lead generation outcomes and accelerating sales velocity is the proper use of cross-referrals and your CRM solution.

Cross-referrals are strategic agreements, whether formal or informal, between companies serving like markets to trade their clients’ contact information to the other for marketing their complimentary products or services. For instance, web designers may build referral resources from freelance writers, marketing and branding companies or web developers and other businesses that do things that the designers don’t, but offer complimentary services to their end-customers.

Cross-referrals are a great way to use free, word of mouth advertising though referral agreements may not always be free. There will be some arrangements where a commission can be earned based on a prearranged percentage or a flat-rate referral fee; but many startups are happy to give free referrals in return for the same courtesy. While these referral arrangements may seem like promotional gold, you cannot always rely on other companies to sell you to their customers. There may never be more than a passing comment made to the occasional client. If you are relying heavily on referrals from others, you need to make a change in your approach. While paid referral agreements may offer more of an incentive, it is your responsibility to provide your referral sources with adequate materials to help them promote your business.

Some ideas include:

Professional-looking brochures and business cards that contain your website, contact information, and a blurb about your services or products. If the situation warrants, you can regularly provide referral sources with discount offers and coupons they can pass along to their own clients that are exclusive to referral clients or customers

Promotional items such as pens and magnets that can be passed along to others.

Say Thanks

When the referrals do begin to come in, make sure your cross-referring business partners know how much you appreciate them. Courtesy thank you notes are crucial after referrals made bring you business. Keep a stack of personalized thank you cards to drop in the mail after a referral pans out. You may consider a small gift basket of cookies or snacks to say thanks from time to time. A nice lunch meeting can also help reinforce your gratitude for the referral assistance. This is a great opportunity to leverage reciprocating for your cross-referrals and your CRM’s power to manage the entire process.

Referrals Aren’t For Everyone

Don’t expect everyone to be open to engaging in free referrals. You can quickly become tiresome to others if you are constantly asking for help in getting business. You should have a strong marketing system in place, so that you aren’t relying exclusively on referrals for new business, making any referral that comes in icing on the cake. It is good practice to touch base with your cross-referring sources to keep them up to date on what is new with your business.

Remember – it’s a two way street, and you should be working as hard to make referrals to your cross-referring business partners as you expect them to in exchange. The more often you make referrals, the more likely the favor will be returned.

Don’t Forget Your Clients

One of your biggest resources for referrals may not be from other businesses. In fact, it is your clients’ praise that will warrant consistent word of mouth advertising for you. This is one of the reasons that excellent customer service is vital to your referral success. Clients who have consistently had a good experience with your company will be more than willing to spread the word to others who are in need of your product or service. While there is no obligation to reward these acts, you might provide something in return for their advertising on your behalf. The better you take care of the clients you already have, the more likely you are to expand your client base. For those clients who are particularly good to you, a token of appreciation like a gift basked of cookies or treats sometimes goes a longer way than a discount on a service or a referral commission, and it humanizes the relationship between you beyond a business one.

Referrals can be a great source of business for you, especially when you are just getting started. You cannot expect everyone to cooperate, but you certainly cannot be a wallflower when approaching the situation. Be direct but flexible – and always offer to return the favor.

Benefits of Outsourcing for Technology Services

By | Business Tips, Tech Tips for Business Owners | No Comments

Most business entrepreneurs have great talent and the means to run a very successful business. The snag they most often run into is the belief that they can do it all. This mindset can be detrimental to the overall success of their business. Trying to do it all can lead to hindered growth, lower profit margins and in some cases failure. Outsourcing for things like technology services creates an opportunity for both the business entrepreneur to focus on what they do best.

In order to create a business that is structurally sound, expandable and profitable, business owners should focus the majority of their time and energy on their personal talents and skills that are most important to the growth of their business and those skills that will most help in the generation of income. Instead of trying to do it all they can most benefit by delegating certain tasks – and outsourcing for technology services is one of them.

Outsourcing has become very popular and with technology today like the Internet, outsourcing is easy and accessible. Companies can find extremely qualified candidates from around the world right at their fingertips. Many highly trained individuals have left the corporate world and are available for hire as contractors. Expertise in just about any area a business may need is available. Examples include virtual assistants, graphic designers, IT specialists, accountants, marketers, Public Relation specialist, writers and so much more.

Some of the best tasks to outsource include those that are highly skilled tasks or those have that require trained expertise. For example if you have no knowledge of your IT needs or how to build and maintain a company website, hiring a specialist will be much more cost effective that you spending hours trying to teach yourself. Initially, your cost for this type of work might be a bit high, while the contractor helps to access your needs and builds your site. Down the road however, you most likely will be able to outsource our IT needs on a maintenance basis.

Highly repetitive tasks are also good ones to outsource. Data entry or accounts payable and receivable are jobs that you most likely can do, but they will only slow down your own productivity. Many times you can hire a virtual assistant to help you in these areas for just a few hours a week. This will not be overly costly and will inevitably free you up to work on other areas of the business that would most benefit from your attention.

Executive expertise is another area to consider outsourcing, especially if the business owner does not have great knowledge in this area. Someone that can take a hard look at your business plan, profitability margin and any ideas you have for expansion can be of great insight. Many times businesses will hire someone to come in and look over these items just once a month, quarterly or yearly. Their consultations can lead to new innovative ideas that could lead your business to new expansions, higher productivity and higher profit margins.

Most often, the cost advantage far outweighs what you will actually pay out to contractors. Most companies that rely on outsourcing do much better than their competitors.

Click here to learn how Kubicek Information Technologies can help you focus on running your business with our Staff Augmentation and Onsite Placement Services for your business in Cumming, Suwanee, Alpharetta, Johns Creek and surrounding Metro Atlanta.