CynergisTek has heard from several hospitals across the nation of attempted malware attacks.  Last month one incident in particular provided another example of the threat and there were some key things to learn from it. Last month a large hospital began receiving a series of email messages indicative of a malware issue. The email messages were only being sent to system administrators, so the attack was not quickly identified and the email messages were not discovered until nearly six hours later. As a result, the organization’s help desk was added to the email distribution list to get more eyes on future email alerts. A few things to know about the attack:

• The attack was identified as occurring on February 9 and 11, 2016, and was traced back to two user accounts that had clicked on a malicious link on two virtual desktops. The malicious link was not identified.
• Two servers were compromised as a result of not having anti-virus installed. The EHR vendor had recommended that anti-virus not be installed to increase performance. The hospital has since decided to go ahead and install anti-virus software which resulted in a 45 second login time. After additional configurations were made, this was reduced to 30 seconds. No complaints have been made from the staff as a result of the increased login time.
• The hospital had contacted their anti-virus vendor regarding how the ransomware had not been identified by the anti-virus solution. The vendor told them that the variant of the ransomware had changed before they could update their virus definitions.
• An attempt to encrypt 34,000 files on a file server had taken place. It was determined that the file server folders that were compromised during the attack had incorrect configurations in that the two user accounts had write-access to three folders that they should not have had in place. This was corrected.

Several contributors to this incident include:

• Insufficient notification protocols were in place. Alerts should be distributed to all key personnel, even the help desk, to have more eyes on the situation. The timeframe from when the attack began to when it was discovered allowed sufficient time for the organization to be compromised.
• Vendor recommendations are just that – recommendations. At the end of the day, the covered entity is responsible for securing and protecting their ePHI. They should not automatically default to a vendor recommendation but should sufficiently test configurations to decide if that recommendation fits the security goals of the covered entity.
• Compliance with security policies and ensuring that staff apply the appropriate security measures when assigning user permissions is very important. Auditing user access can help identify inappropriate user permissions.
• User training and awareness of the latest security threats and how to identify them can help reduce security incidents. In this situation, two users clicked on malicious links. Training on these types of attacks can help users to identify malicious links and reduce the chances of being subject to ransomware attacks.

[fusion_builder_container hundred_percent=”yes” overflow=”visible”][fusion_builder_row][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_button link=”https://cynergistek.com/wp-content/uploads/2016/03/Malware-Incident-3.8.16.pdf” color=”default” size=”” stretch=”” type=”” shape=”” target=”_blank” title=”” gradient_colors=”|” gradient_hover_colors=”|” accent_color=”” accent_hover_color=”” bevel_color=”” border_width=”1px” icon=”” icon_divider=”yes” icon_position=”left” modal=”” animation_type=”0″ animation_direction=”down” animation_speed=”0.1″ animation_offset=”” alignment=”center” class=”” id=””]Download PDF Version[/fusion_button]

Jeremy Molnar published this blog post on behalf of the author, Ryan Stewart, Compliance Consultant.[/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]