Top Takeaways From The Airway Oxygen Ransomware Attack On The OCR Wall Of Shame

[fusion_builder_container hundred_percent=”no” equal_height_columns=”no” menu_anchor=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” enable_mobile=”no” parallax_speed=”0.3″ video_mp4=”” video_webm=”” video_ogv=”” video_url=”” video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” video_preview_image=”” border_size=”” border_color=”” border_style=”solid” margin_top=”” margin_bottom=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=””][fusion_builder_row][fusion_builder_column type=”1_1″ layout=”1_1″ spacing=”” center_content=”no” hover_type=”none” link=”” min_height=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_position=”left top” background_repeat=”no-repeat” border_size=”0″ border_color=”” border_style=”solid” border_position=”all” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” dimension_margin=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=”” last=”no”][fusion_text]

Airway Oxygen reported the largest ransomware attack to date to OCR’s wall of shame on June 16^th, 2017. It affected 500,000 individuals, making it the second largest breach so far in 2017. I believe there are several takeaways from this incident that the industry show know about.

Ransomware Attacks are on the Rise

First, I believe that we will continue seeing more ransomware attacks that cause a breach this year because the pace of these types of attacks are increasing and the targets are not just the big systems. The smaller organizations are more susceptible, as many of them have fewer resources for security, are more likely to have older systems no longer supported, and less sophisticated detection and alert capabilities. It is a regular occurrence now, the good news is that only a few actually require notification, but the disruption caused is always costly.

Determining Ransomware Attack Versus Breach

Many organizations are still not clear when a ransomware considered a breach and are confused on what OCR’s ransomware guidance means. However, based on the incidents CynergisTek has been involved in is more common that they do not require notification. Regardless, you have to assess if information was compromise before notification. Identifying what the attacker accessed can be difficult and often organizations are hesitatnt to report the breach until determining.

What You Can Do to Protect Yourself

There are several things I would suggest on protecting yourself based on the incidents we’ve seen and this one, but a critical piece of information that is missing here. How did the attackers gain access? Many of these attacks are remote so first off employ two-factor authentication on any remote connections or web based access. More often than not, the attacker needs access to the system to download the malware. Where appropriate, organizations should remove administrative privilege via vaulting, and at a minimum deploy two-factor authentication for anyone with elevated privileges.

Additionally, organizations should increase the level of segmentation to protect critical systems and databases with real access restrictions. Deploy advanced malware detection both on the network and the end-point. Engage a Tier 1 SOC partner to increase visibility and alerting from log activity. Generally, enhance hygiene; update obsolete operating systems and software, improve vulnerability management, eliminate unnecessary services, etc. Evaluate vendor access and security.

Hackers Continue to Lead the Reported Breaches

I do not see any abatement in the hacking incidents we’re seeing right now. As long as they are successful and as long as organizations pay the ransom, bad actors will continue to carry out their attacks.

Making Progress but We Still Have a Long Ways to Go

Generally areas where we are making the most improvement of in combatting ransomware includes education of users and investment in advanced malware detection. However, we still lagging in the basic hygiene of the network, detection and alerting, response, and recovery.

Click here to read the entire story included in HealthcareInfoSecurity.com article, “Ransomware Attack Affects 500,000 Patients.”

[/fusion_text][/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]