[fusion_builder_container hundred_percent=”no” hundred_percent_height=”no” hundred_percent_height_scroll=”no” hundred_percent_height_center_content=”yes” equal_height_columns=”no” menu_anchor=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” enable_mobile=”no” parallax_speed=”0.3″ video_mp4=”” video_webm=”” video_ogv=”” video_url=”” video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” video_preview_image=”” border_size=”” border_color=”” border_style=”solid” margin_top=”” margin_bottom=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=””][fusion_builder_row][fusion_builder_column type=”1_1″ spacing=”” center_content=”no” link=”” target=”_self” min_height=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_position=”left top” background_repeat=”no-repeat” hover_type=”none” border_size=”0″ border_color=”” border_style=”solid” border_position=”all” padding=”undefined” dimension_margin=”undefined” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=”” last=”no”][fusion_text]

Healthcare organizations are more vulnerable to phishing attacks as the average maturity of security controls and training is less than that of other industries, such as banking. Successful phishing attacks rely heavily on emails with either spoofed or similar-looking domain names. Emails originating outside of an organization’s domain but with similar domains can be flagged as an external email to alert the end-user. Unfortunately, emails with spoofed domains require technical controls to identify and divert to a spam folder.

To address this, the US Department of Homeland Security (DHS) released a binding directive in mid-October of 2017 that mandated federal agencies to adopt Domain-based Message Authentication, Reporting and Conformance (DMARC) technology within 90 days. More simply, DMARC is an email-validation system that detects and prevents email spoofing designed to combat techniques used in phishing and spam, such as emails with forged sender addresses that appear to originate from legitimate organizations. That same week the National Health Information Sharing and Analysis Center (NH-ISAC) responded with a 90-day challenge of their own. The NH-ISAC challenge is called the 90-day DMARC challenge.

NH-ISAC reports that 57% of emails that purport to originate from a healthcare entity are fraudulent. This presents a problem larger than is generally realized inside of healthcare organizations. If any organization takes the time to dig into this issue they will quickly realize the advantage to protecting the organization from fraudulent emails impersonating their domains. This gives your organization the ability protect both patients and employees, as well as dramatically reduce the effectiveness of phishing and spam campaigns.

Why Should I Use DMARC?

The protections provided by DMARC can eliminate or at least severely reduce many of the threats that healthcare organizations face. For example, in conjunction with tools already in place like anti-virus, email filters, and others, DMARC can vastly improve the effectiveness of these tools. On top of all of these advantages, DMARC is free and relatively simple to implement.

Using DMARC to verify the authenticity of servers sending mail can significantly reduce malware and ransomware attacks as they are most often distributed via email. Additionally, the utilization of DMARC technology can also significantly reduce spam and phishing emails, which leads to saved time and possible cost savings on storage and bandwidth.

What is Missing?

Despite the alarming number of fraudulent emails and the obvious benefits, NH-ISAC estimates that over 77% of the healthcare industry is not using DMARC to protect their email. Significantly fewer, only 2%, are actively protecting their patients from phishing and spoofing through the use of protective policies on their domains. Almost equally alarming, nearly a quarter of organizations with DMARC technology still are not blocking phishing emails.

The biggest drawback to the use of DMARC or other similar Domain Name System (DNS) record such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), or DMARC is it needs to be used by a majority of the industry for it to be most effective. The larger the percentage of the industry that is using DMARC protections the more effective it becomes. This is because it only protects the target organization but those protections rely on DMARC working everywhere else.

It Ain’t Broke…

Because of the nature of the DMARC service, it has been traditionally very difficult to encourage healthcare organizations to adopt this type of protection. Unfortunately, there is little impact on day-to-day operations and certainly, nothing is broken without DMARC or similar DNS record verification in place.

The biggest reason we are not seeing more broadly implemented DMARC is caused by the knee-jerk remediation methods used by most of the sector. For example, in the scenario that malware or a virus affects an organization’s network, many upgrade their anti-virus software rather than address the root cause such as email authentication and user awareness. This same lack of vision can be applied to almost any issue that arises.

We need to, as an industry, come together and commit to implementing this free and relatively simple technology to significantly improve the privacy and security of not our organizations and more importantly, our patients and customers.

[/fusion_text][/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]