According the U.S. Department of Health and Human Services' Office for Civil Rights (OCR) January 2018 Cybersecurity Newsletter, incidents of cyber extortion have risen steadily over the past couple of years and will continue to be a major source of disruption for many organizations, including healthcare providers. Cyber extortion typically involves demanding money to put a stop to criminals' malicious activity. Healthcare organizations are often a target of this type of cyber attack due to the sensitive nature of the information they possess.
To help prevent your organization from falling victim to this type of cyber attack, the OCR has provided the following examples of activities organizations should consider to reduce the chances of being a victim of cyber extortion:
- Implementing a robust risk analysis and risk management program that identifies and addresses cyber risks holistically, throughout the entire organization;
- Implementing robust inventory and vulnerability identification processes to ensure accuracy and thoroughness of the risk analysis;
- Training employees to better identify suspicious emails and other messaging technologies that could introduce malicious software into the organization;
- Deploying proactive anti-malware solutions to identify and prevent malicious software intrusions;
- Patching systems to fix known vulnerabilities that could be exploited by attackers or malicious software;
- Hardening internal network defenses and limiting internal network access to deny or slow the lateral movement of an attacker and/or propagation of malicious software;
- Implementing and testing robust contingency and disaster recovery plans to ensure the organization is capable and ready to recover from a cyber-attack;
- Encrypting and backing up sensitive data;
- Implementing robust audit logs and reviewing such logs regularly for suspicious activity; and
- Remaining vigilant for new and emerging cyber threats and vulnerabilities (for example, by receiving US-CERT alerts and participating in information sharing organizations).
For more cyber security resources from OCR, please click here.
To access the OCR's fact sheet "Ransomware and HIPAA" for guidance on preventing and responding to ransomware attacks for HIPAA covered entities and business associates, click here.
To read the full January 2018 OCR Cybersecurity Newsletter, click here.
Free Resources for LAMMICO Policyholders
In partnership with our cyber risk experts, NAS Insurance, LAMMICO is proud to offer our insureds complimentary access to CyberNET®, the most advanced cyber risk management solutions inclusive of sample policies, incident response plans and other compliance and training materials. Registered LAMMICO.com Members are encouraged to log in and access the NAS CyberNET portal through LAMMICO Practice Solutions.