Category

Security

Data with Lock

The Ransomware Plague in Hospitals and Healthcare

By | Backup News, Business Tips, HIPPA, Security, Small Business Computing, Tech Tips for Business Owners | No Comments
by Calyptix, June 1, 2016

The Ransomware Plague in Hospitals and HealthcareFrom pirates to mobsters to petty criminals, kidnapping for ransom is nothing new. We’re all familiar with the process – a person is abducted, the abductor demands a ransom, the ransom is paid, and then the person is released.

Now this age-old form of extortion has evolved into the technological world as ransomware.

Ransomware criminals employ the same principles as their predecessors but with a twist: the kidnappee is data.

The kidnapper in this scenario is crypto ransomware, a malware variant programmed to encrypt and lock data. After a company’s records are locked, the infected computer displays a note that demands ransom.

The perpetrator will only unlock the files once the ransom has been paid in full.

The Ransomware Plague in Hospitals and HealthcareRansomware in Healthcare

The healthcare industry in particular has been struck by a recent spate of ransomware attacks.

With few exceptions, the companies are reluctant to release specific details, leaving the investigating to the FBI.

UMASS Memorial Medical Center

An employee at UMass Memorial Medical Center in Worcester opened an email laced with ransomware last fall, resulting in dozens of locked hospital files on several different computers.

A ransom note was promptly displayed on the hospital monitors.

The hospital chose not to pay ransom, removing all of the encrypted files instead.

Security professionals later restored the system with backup files.

In response, Chief Information Security Officer Bruce Forman outlines his plan to install advanced, persistent threat software that will identify malware based on its behavior.

The Ransomware Plague in Hospitals and HealthcareHollywood Presbyterian Medical Center

On February 5, 2016, hackers locked patient files at Hollywood Presbyterian Medical Center and demanded ransom for access.

The hospital opted to shell out 40 bitcoins – approximately $17,000 – for the encryption key before calling the FBI.

The hospital was off-line over a week.

Emergency room systems, and computers used for CT scans, lab work and pharmacy needs were were all affected by the attack.

Some 911 patients were even sent to other hospitals.

The International Business Times later reported that a group of Turkish hackers had claimed responsibility for the attack via the text-sharing site Pastebin, threatening more attacks as long as the U.S. supports Kurdish rebels.

The claim is unverified however.

Prime Healthcare ManagementThe Ransomware Plague in Hospitals and Healthcare

The Los Angeles Times reported ransomware attacks on March 27, 2016 at two Prime Healthcare Management, Inc. hospitals: Chino Valley Medical Center in Chino, CA, and Desert Valley Hospital in Victorville.

Spokesperson Fred Ortega said the attacks were “immediately addressed and contained,” and no ransom was paid.

The FBI is still investigating.

A third Prime Healthcare facility, the 306-bed Alvarado Hospital in San Diego, was also infected by a crypto virus on March 31, 2016.

The Ransomware Plague in Hospitals and HealthcareMedStar Health

On March 28, 2016 Columbus, MD based provider MedStar Health shut down its database and email after a viral attack.

The provider operates 10 various hospitals, serves hundreds of thousands of patients, and has over 30,000 employees.

MedStar Health claims no information was stolen, and hasn’t labeled the culprit as ransomware, but The Washington Post reported they received a screen shot of a ransom demand for 45 bitcoins – or roughly $19,000 – from a MedStar employee.

The shutdown forced staff to go old-fashioned, relying on paper charts and records. Appointments and surgeries were also delayed.

Other healthcare organizations targeted by ransomware attacks since February, 2016 include the Los Angeles Health Department, Ottawa Hospital in Canada, Methodist Hospital in Henderson, Kentucky, and King’s Daughter’s Health in Madison, Indiana.

In each case, spokespeople reported the systems were shut down, but later restored with back-up files.

The Ransomware Plague in Hospitals and HealthcareWhy is healthcare a target?

In general, ransomware attacks are becoming more prominent because they are successful.

In 2012, a server of 5,700 computers was locked – all on the same day according to United States Computer Emergency Readiness Team.

Symantec analyzed the data and determined 2.9% of the users with locked computers had paid an average ransom of $200 per computer.

While this may be true of ransomware overall, many healthcare organizations claim they actually aren’t paying ransoms.

But some are.

Medical professionals rely on computer access for everything, from critical patient information like allergies and lab results to operating schedules.

The Ransomware Plague in Hospitals and HealthcareLocking access to records can literally be a life or death situation.

Healthcare organizations may be targets not because of their industry, but because of the types of applications they use according to Craig Williams of Talos Research in Arstechnica Report.

He suspects ransomware perpetrators scan the internet for vulnerable servers, finding many in the healthcare trade.

The increase in crypto virus attacks is also caused by the antiquated security systems employed by many companies according to Zach Forsyth at Comodo.

Healthcare organizations are relatively new to the digital game, and their security systems lack the maturity of those in the financial and technology industries.

Criminal attacks on healthcare organizations increased 100 percent between 2009 and 2013 according to the Ponemon Institute.

The trend of attacks against the vulnerable healthcare industry shows no signs of slowing. In fact, ransomware is emerging as a popular crime , states Ben Desjardin’s post on Radware.

The Ransomware Plague in Hospitals and HealthcareHow do ransomware attacks happen?

Some ransomware attacks gain access through phishing, or luring a user to click on a contaminated email or link. Vulnerable servers can also be targeted remotely.

A recent ransomware campaign against the healthcare industry in March, 2016 was under the scope of Cisco Talos Research.

Perpetrators used the open source tool JexBoss to gain traction in a server. Upon access, a ransomware variant named SamSam encrypyted multiple Window systems.

Another malware distribution method, Ransom as a Service (RaaS), emerged in 2015.

Criminals download the ransomware app builder and customize it according to the Microsoft Malware Protection Center.

Ransom MLIS/Samas also emerged early in 2016, with criminals using a penetration testing attack server that searches to exploit vulnerable networks, and uses a publicly available tool called reGeorg for tunneling.

The Ransomware Plague in Hospitals and HealthcareMSPs and VARs Beware!

It’s not just healthcare providers who should worry about their records being locked. Managed Service Providers and Value Added Re-sellers that service the healthcare industry are also at risk.

HIPAA Regulations for IT Compliance instruct that any business involved in the creation, maintenance or monitoring of electronic protected health information (ePHI) is subject to the Security Rules of HIPAA.

Compliance requires that the confidentiality and integrity of ePHIs remain intact.

Because ransomware locks files rather breaching their integrity, the jury is currently out on whether HIPAA-affected organizations have to report crypto virus attacks to the Department of Health and Human Services’ Office for Civil Rights.

It’s possible that attackers have determined ransomware victims might pay up if they can be assured the data has not been stolen, and therefore they may not have to report the breach.

The Ransomware Plague in Hospitals and HealthcareWhat can you do?

A simple solution is to back up your files. If you can access what a criminal has encrypted, you can continue to do business.

Train your employees to never click on suspicious emails or links. In addition, a strong password policy should be implemented throughout the company.

Third Tier produced a ransomware protection kit they’ll mail to you in return for a donation that supports females who want to work in the IT field.

Other remedies include installing a multi-tier defense architecture that checks software multiple times for vulnerabilities.

Web scanning can stop your system from accessing malicious sites as well.

Whitelisting is an effective tool that only allows specific, approved programs to run.

Employees can be granted a “least privilege user account,” which means they are not given administrative privileges to their computers.

Ransomware Prevention can also include blocking malicious TOR IP addresses, and testing restores.
Once your security system is set up, do not ignore it – maintain it. The Red Hat-supported JBoss server application was reported vulnerable in 2007 according to The HIPAA Journal.

A patch to correct the vulnerability has existed for almost ten years, and had it been applied, a number of ransomware attacks could have been prevented.

Data with Lock

Top 5 Sources of Security Incidents in Retail

By | Security, Tech Tips for Business Owners | No Comments
by Calyptix, April 13, 2016

computer-security-incident-oopsPeople tend to assume that hackers or other malicious actors are behind the security incidents and data breaches we hear about in the news.

While it’s true – thousands of criminals try to steal data every day – it’s also true that many security incidents are caused by employees.

Employees are the number-one cause of security incidents in the retail and consumer industries, according to the results of the Global State of Information Security Survey (GSISS) 2016 from PwC.

The survey, conducted from May to June 2015, is comprised of responses from more than 10,000 executives of security practices from 127 countries.

Before we dive in, it’s worth noting that the chart applies to security incidents and not data breaches. The terms are slightly different:

  • Security incident – An event that violates a security policy or otherwise puts an asset (such as customer data) at risk. This is a general term and can include network scans, malware infections, or a breach of customer data.
  • Data breach – A confirmed disclosure of sensitive data to an unauthorized party.

security-incident-sources-retail-chart

The top 5 sources of security incidents

Source #1. Employees

Current employees were reported as the greatest perpetrators of security incidents in the retail and consumer industries by those surveyed. The number was 30%, down 12% from 2014.

Employees pose both an intentional and accidental security risk.   They have an insider advantage if they choose to steal data.  But they often compromise their company’s cybersecurity unknowingly.

spear-phishing-security-incidentSpear phishing

Many retail and consumer industry cyber-attacks are initiated when an employee opens an email sent from a villainous source, who tries to trick the recipient into providing personal information, such as logins and passwords.  The act is called spear-phishing, and it arrives as an email that appears to be sent from someone an employee knows.

When the employee opens an attachment, or clicks on a link embedded in the email, associated malware instigates a cyber-attack.  When high-level employees are targeted by this technique it is sometimes called “whaling.”

Spear-phishing has been the point of entry for cyber-attacks on Anthem and Sony.  Stolen data included personal health information, employee social security numbers, and thousands of leaked internal documents.

A 2012 paper by Trend Micro Incorporated found that spear-phishing was involved in 91% of targeted attacks.

Careless or poorly trained?

In 2013 Deloitte reported that up to 90% of user passwords were easily hackable. Splashdata’s 2015 “Worst Password List,” comprised of the 25 most common passwords on the internet, are easily guessable, and therefore highly vulnerable.  They include “123456,” “baseball,” and “password.”

Employees of retail and consumer organizations often put their company’s data at risk by performing work tasks on their own personal devices, often accessed through unsecure WIFI.  They might send work documents to personal email accounts, bypassing security precautions initiated by their employers.

A perceived decrease in retail and consumer employee security incidents could be due to increased employee training.  In addition, more companies are paying vigilance to firewalls, and many businesses require employees to change their passwords on a regular basis.

former-employee-security-incidentSource #2. Former Employees

Former employees are ranked 2nd in the GSISS for security incidents in retail and consumer organizations. Down to 26% in 2015 from 30% in 2014, its share fell 13%.

If employment ends on unhappy terms, it’s easy to imagine an employee with inside information, a grudge to bear, and a lack of morality could be a danger to the company’s security.

A 2009 survey by the Poneman Institute found that 59% of ex-employees surveyed claimed to have taken company data with them when they left their position.

The phenomenon is not limited to retail organizations.

In January 2015 a former employee of the U.S. Nuclear Regulatory Commission and the Department of Energy (DOE) was charged with sending 80 spear-phishing emails to DOE employees seeking sensitive information in exchange for money from a foreign embassy.  He had been terminated by the NRC in 2010.

A former employee of the U.S. Embassy in London was charged in August 2015 with seven counts of computer hacking to extort, one count of wire fraud and nine counts of cyber-stalking.

Those surveyed could be responding to increased company diligence to eliminate logins and passwords of employees immediately upon their termination.  Companies are also improving their data encryption, and many have dedicated IT security personnel that help prevent former employees from taking information with them when they leave.

Source #3. Service Providers, Consultants, Contractors

The survey respondents reported a 21% increase, from 19% to 23%, in retail security incidents caused by current service providers, consultants, and contractors, also known as third parties.

Third party contractors include any outside organization hired by a company.  Third parties run the gamut from lawyers, to electricity providers, to security providers.

As reported by Krebs on Security, the 2013 Target heist that compromised the credit and debit accounts of millions of people was orchestrated through network credentials stolen from one of their Heating, Ventilation and Air Conditioning Contractors.

Cloud security risks can also rise when a retailer uses a third party vendor, since the retailer rarely knows the veracity of the vendor’s employees and partners.

security-incident-source-hackersSource #4. Hackers

The GSISS attributes 21% of retail security incidents to hackers in 2015, up from 20% in 2014.

Hackers perpetrate direct attacks.  Their goals are as numerous as they are varied.  They can be nation-states, lone wolves, and hacktivists, who break into databases on what they see as benevolent missions.

Hackers break into databases to steal personal identities and financial information as an act of theft. Most hacking is done for profit, but some people hack for the personal challenge of breaking into systems that are thought to be secure.

The collective “Anonymous” hacks to fight perceived internet censorship. Hackers might have political motivations, and target electrical grids or other civic infrastructure.

In 2015, 21.5 million people had information stolen from the U.S. Office of Personnel Management by hackers.  The New York Times reported the suspect is China, but it is unknown whether the crime was committed by the government or individuals.

Hackers also target intellectual property, or business secrets.  As various segments of government and corporations have become more sophisticated in their ability to fend off cyber-attacks, hackers have sought to invade industries with less sophisticated cyber defenses.

In 2014 hackers compromised the point of sale system at Home Depot with custom built malware that breached the integrity of 56 million unique payment cards.  It’s estimated the cost to Home Depot will be approximately $62 million.

In addition to retail and consumer firms, U.S. law firms have suffered increased hacker attacks in the United States because they are in possession of potentially lucrative information, and lag other professions in cyber security.

In a recent survey reported by Legal Tech News, less than half the law firms surveyed had intrusion detection systems, email encryption on all their services, or logs of employees who accessed public health information.

Source #5. Organized Crime

Those surveyed identified a minor increase, from to 18% in 2015 from 17% in 2014, of retail and consumer organization security incidents by organized crime, the final group identified in the GSISS report.

According to the report, some in the financial industry believe that increasingly, cybercrime is a collaborative effort between foreign nation states and organized crime.

The FBI reports a sampling of the organized criminal threats to the U.S. include groups from Africa who perpetrate financial schemes, Russian mobsters who moved to the U.S. after the collapse of the USSR, and Asian groups including the Japanese Boryokudan.

A white paper written by The RAND Corporation notes that black markets where data is sold are growing in complexity and size, and that hackers are morphing from random individuals to sophisticated, financially driven groups, often associated with traditional crime groups such as mafias and drug cartels.

The dangers are real, and the smart money is on those who exercise continuous vigilance on the cyberfront.

KIT Expands Network Security Services with Calyptix Partnership

By | HIPPA, Security, Tech News | No Comments

“Our clients’ security needs are ever changing in today’s world of cybercrime. With the influx of remote workers, outsourced services and client access, KIT’s Clients needed a solid, robust, but yet easy to maintain security platform that will continue to evolve with technology and business needs. Calyptix Security brings all this and more to table,” said Jim Kubicek, President & COO, Kubicek Information Technologies.

Read More
Data with Lock

What is a Firewall & Why do you need it?

By | Security | No Comments

According to a study by NCSA Cyber Security, only 4% of Americans say they understand firewalls “completely”, while more than 44% don’t understand firewalls at all – or know if they have one enabled on their PC. So for those of you who feel a little unsure – below is a brief overview of why you might need a firewall.

If your PC is connected to the Internet, you are a potential target to an array of cyber threats, such as hackers, keyloggers, and Trojans that attack through unpatched security holes. This means that if you, like most people shop and bank online, are vulnerable to identity theft and other malicious attacks.

A firewall works as a barrier, or a shield, between your PC and cyber space. When you are connected to the Internet, you are constantly sending and receiving information in small units called packets. The firewall filters these packets to see if they meet certain criteria set by a series of rules, and thereafter blocks or allows the data. This way, hackers cannot get inside and steal information such as bank account numbers and passwords from you.

Basic firewalls such as the one included in Windows, only monitor incoming traffic by default. This may give you a false sense of security. Keep in mind, outgoing traffic, with your credit card information, bank accounts, and social security number is not protected. A good firewall will monitor traffic in both directions. That is, both your incoming data and your outgoing data, keeping your private information safe. In addition to preventing unauthorized access to your PC, it also makes your PC invisible when you’re online, helping prevent attempted intrusions in the first place.

Most sophisticated firewalls also include a feature that continuously updates the list of known good and known malicious applications. This way, the amount of questions relating to Internet access is minimized and your computer protection is always up-to-date.

Although a firewall provides critical protection to keep your PC safe from unauthorized access, it cannot remove malware from a system that has already been infected. Therefore, a firewall should be used in conjunction with other proactive measures, such as anti-malware software, to strengthen your resistance to attacks.

Data with Lock

6 Password Tips to Protect Against Business and Identity Theft

By | Security, Tech Tips for Business Owners | No Comments

Ah, those pesky passwords. If you work in the corporate world or in an office, you have one for your PC/Network and, unless there is a password synchronization application that combines them, you probably have more than one for other applications. Add those to the ones that you have for your home Internet, your banking and other websites that require passwords, and before you know it you have a nightmare on your hands in trying to manage them. How easy a target are you for business and identity theft?

Part of the frustration has to do with the different requirements for password formatting. Some systems only require four characters, some require eight. Some need a combination of alpha and numeric characters and others do the same with the addition of a few capital letters thrown in for extra security. It can be positively maddening.

The worst thing you can do with your passwords is to place them in a text document which can be accessed on the hard drive of your computer. Your files are vulnerable to business and identity theft- even if you think they are not. If someone is intent on finding them, they can. Even if you place them into a password protected document, those can be cracked, too.

Writing them down has its own vulnerabilities, too, and there are varying opinions on this practice. If you do write them down on a piece of paper, put the document in a locked location whether it is in your home or at work.

Here are 6 tips on how to handle your passwords to protect against business and identity theft:

1. Make them complex. People who use easy to remember or short passwords are inviting disaster. Use a little imagination and pick a password that is very difficult to attach to your life. Stay away from birth dates, phone numbers, house numbers, or any other number that is associated with your life.

2. Keep passwords unique. When you change your passwords, make them unique from each other. Do not use the same password on all of your sites. If you do, then you are open to having every site that you have a password to being vulnerable to hackers to log on and steal your identity, money or destroy your reputation.

3. Be obscure. Use a combination of letters, numbers, capital letters and special characters if possible. The more you do this, the more secure your passwords will become. Create an alphanumeric version of a term you can remember. Using this technique the word “Spaceship” becomes “Sp@ce5h!p”.

4. Change regularly. This is the singular tip that can save you if you do not heed any of the other tips. How often should you change your password? How secure do you want to be? The frequency with which you change your password will determine how secure you are from becoming a victim. The more often you change it, the better you are. The longer you leave it the same, the more vulnerable you become. Three months is a good cycle for a password, but certainly if you fear for the security of your identity, then a monthly change is not out of the question.

5. Password-protect your PC. Be sure to give your PC a password on power-up. This will help protect your files unrestricted access to your PC.

6. Password-protect your wireless home network. If you have a wireless home network, be sure to password protect it as well. Use the same principles above in order to secure your wireless network. This will prevent others from accessing your connection and using it maliciously to hack the personal or business PCs and laptops you and your family use at home.

Finally, there are password programs that can help with this important task, but the best advice is to start with the tips above right away. Password software can be useful as an organizational tool, but it is no match for using sound methods to manage and make your passwords difficult to crack.

 

Identity Theft

The High Cost of Recovery from a Security Breach

By | Security | No Comments

Small to medium size businesses are what keep this country moving. Unfortunately, for many of these business owners, budgetary needs force them to make cuts that the mammoth corporations do not have to consider. These budget cuts can often result in reduced security and sub par IT services that in the long run can end up costing the company even more money. Reacting to; and the recovery from, a security breach or attack always costs more after it has happened than what it would have cost to prevent it.

This fact has been supported by recent surveys, and may come as a surprise to many small and mid-size companies who are under the false impression that hackers and other security threats target larger corporations. It has been discovered that companies that have less than 500 employees are actually more likely to be at risk of an attack or security breach than a larger corporation. Of course, this becomes a problem when the larger corporation has the resources to maintain higher levels of security at a time when smaller companies are dealing with restricted or; in some cases, frozen IT budgets.

The benefits of hiring a Managed IT Services Provider in preventing attacks and security breaches

With a security breach a real concern for small business owners, many are making the decision to bring on outside providers to address their IT needs. Managed services providers can offer an affordable solution to small business owners who are struggling to manage an internal IT staff. In some cases there isn’t even an IT person on staff, which can be just as costly for the small business when they have to bring in a professional on an as needed basis. Considering the money and time spend recovering from a security attack or breech, more business owners are realizing the cost of not having this level of protection is too high to pay. Here we look at how managed services providers can help business owners level the playing field against those who would infiltrate their security systems.

  • Increased knowledge- Managed services providers are in the business of technology. They have trained staff who are able to prevent security breeches and spot any activity that could be perceived as a threat. Moreover, they have the expertise to stop threats and prevent the loss of sensitive and private information that can lead to costly recovery measures.
  • Less expensive than in-house IT- Other IT professionals can provide the same security but it will cost much more to the business owner. What many owners are realizing is paying a flat monthly fee for security and other services provided by msp’s is actually much more cost effective than paying an internal IT staff or outsourcing based on incident.
  • Proactive is better than reactive- The biggest benefit of having a quality managed services provider in your corner is the fact that you are acting in a proactive manner to ensure all of your systems are managed properly. This is less expensive and less time consuming than waiting for something bad to happen and then reacting.

Any small business can benefit from the security provided by a Managed IT Services provider. They can do so at a fraction of the cost, therefore eliminating the fear and unnecessary cost of trying to recover from a breech in security or attack.

Click here to learn how Kubicek Information Technologies can help you prevent attacks and security breaches with our Network Security Services for your business in Cumming, Suwanee, Alpharetta, Johns Creek and surrounding Metro Atlanta.