The IT Nerd

Claroty has reported in its 2023 Global Healthcare Cybersecurity Study that 78% of surveyed healthcare professionals reported experiencing at least one cybersecurity incident with 60% of those having a moderate or substantial impact on care delivery and 30% having sensitive data impacted in the past year.  

Also noteworthy is that more than 25% of organizations that experienced ransomware attacks paid the ransom, with more than a third reporting upwards of $1 million in recovery costs.

Meanwhile, 51% of respondents globally reported an increase in security budgets over the last year and intend to prioritize the following threats:

1. Patching medical device vulnerabilities  
2. Improving asset inventory management  
3. Segmenting medical devices

“As healthcare organizations undergo digital transformation and technological innovation revolutionizes the industry, regulatory requirements become increasingly complex and are frequently evolving. Keeping up with standards and understanding guidelines can be challenging, but the survey shows that organizations hold these regulations in high regard and value the guidance,” the report noted.

Jan Lovmand, CTO, BullWall had this to say:

   “With 78% of healthcare operators reporting at least one cybersecurity incident in the past year, this is a full-on battle. Ransomware attacks on healthcare facilities pose a grave threat to public health and safety. These assaults not only shut down delivery of critical medical services, causing delays in essential surgeries and treatments that jeopardize patients’ lives, but they also breach the sanctity of sensitive patient data. The aftermath of such attacks can be catastrophic, leaving hospitals grappling to recover their data and regain control over their systems. Whether the ransom is surrendered or not, the toll in both financial losses and compromised patient care deals a crippling blow to these already strained institutions.”

   “Hospitals and healthcare organizations have a bullseye painted on them in the eyes of cybercriminals. A heavy reliance on technology to manage a huge range of functions, from patient records to surgical equipment, provides a vast attack surface of uniquely susceptible targets. This vulnerability is further exacerbated by their meager resources allocated for bolstering cybersecurity defenses. However, with ransomware showing no sign of abating, it is imperative to invest in countermeasures that can stop these attacks without necessitating a complete shutdown of IT systems and healthcare services. A good Ransomware containment defense and off-site backups are table stakes.”

Dave Ratner, CEO, HYAS adds this comment:

   “This attack further proves that no one should consider themselves safe from being targeted. We live in a world where every organization can and will be breached, and the only solution is to focus on proper operational resiliency, business resiliency, and business continuity.  As part of this, visibility and observability into anomalies on the network and the early detection of the digital exhaust from a breach is critical so that an attack can be detected, mediated, and rendered inert before widespread damage ensues. CISA and the NSA don’t just recommend Protective DNS for governments and critical infrastructure — it’s increasingly clear that this is a vital component for every organization and network.”

This report paints a very scary picture. And it’s a picture that needs to change before 78% of healthcare organizations getting pwned goes to 100% of healthcare organizations getting pwned.

The Healthcare and Public Health Sector Coordinating Council Cybersecurity Working Group issued an updated version of its “Health Industry Cybersecurity Information Sharing Best Practices” guide (HIC-ISBP) to help healthcare organizations build and support their cybersecurity threat information sharing programs.  

“Threat intelligence is one of the most important data types to information-sharing programs.

  “[…] threat intelligence data truly comes in a variety of forms and should encompass all risk vectors that could impact the healthcare industry, such as third-party risks, insider threats, cybersecurity risks, regulatory risks, and geopolitical risks,” the document states.  

The updated guide identifies a new information sharing category, called “Threat Defender Content and Resources Sharing,” and various other categories of threat intelligence designed to help organizations frame their internal information sharing programs:   

• Strategic intelligence  
• Tactical intelligence 
• Operational intelligence  
• Open-source intelligence 

 The HIC-ISBP is a companion document to the recently updated “Matrix of Information Sharing Organizations,” which provides healthcare organizations with a matrix database of reputable information sharing entities.  

“Information sharing programs, when done properly, produce significant benefit at low risk for the organizations that participate,” said Errol Weiss, chief security officer of Health-ISAC, in an accompanying press release.

Emily Phelps, Director, Cyware has this to say:   

“Threat intelligence is necessary to take a more proactive security posture. The types of threat intelligence outlined are important. How intelligence is managed, prioritized, and shared is also critical to understand. We must ensure threat intelligence gets to the right people at the right time so as not to delay meaningful action.”

Stephen Gates, Principal Security SME, Horizon3.ai follows up with this:   

“Information sharing among healthcare organizations makes a great deal of sense, but the challenge with any threat intelligence is how to put it into action. Most would agree that raising the situational awareness of security practitioners, leaders, and decision makers can influence their security-related decisions in a positive fashion.    

“However, we see healthcare organizations wanting to gain more intelligence about their “own” exploitable attack surface. They want to know where their most critical vulnerabilities are, lying in wait, ready to be exploited, and leveraged for a successful breach or ransomware attack. Gaining “internal exploitability intelligence” is high on the radar for the healthcare industry since this form of intelligence can be put into action to measurably reduce risk.” 

Ted Miracco, CEO, Approov Mobile Security concludes with this comment:   

“Healthcare organizations are facing a wide range of cybersecurity threats, including phishing attacks, ransomware attacks, unsecured APIs connected to medical devices, and supply chain attacks.    

“The HIC-ISBP guide is a significant step towards improving cybersecurity in the healthcare industry. By addressing barriers to threat intelligence sharing this guide can help healthcare organizations to maintain a robust cybersecurity program by more rapidly responding to incoming threat information.”

The more info that is shared means that attacks could be less successful. Thus this is a good thing. But only if this information is actioned effectively.

Critical Insight has released its 2023 H1 Healthcare Data Breach Report, which despite an overall decrease of 15% in total breaches during the first half of 2023, there was a 31% increase in the number of individuals impacted by those breaches compared to the 2nd half of 2022.  

The decline in the number of breaches is a positive development and suggests a potential downturn in overall breaches for 2023, the lowest breach count since 2019. Unfortunately, the positivity is counterbalanced by the 40 million individuals impacted within six months, which is 74% of the total affected in 2022.  

• 73% of the primary causes of the breaches were centered around hacking and IT incidents while unauthorized access and disclosure followed as the second most prominent
• 97% of the compromised individual records were a result of exploited network server vulnerabilities

Also noteworthy is the increased targeting of the industries third-parties (48%) which surpassed those directly impacting the healthcare providers and health plans (43%). Also, of individuals affected, 50% were connected to a third party.

George McGregor, VP, Approov had this to say:   

“The percentage increase in breaches of healthcare business associates rather than core healthcare providers is in fact a worrying trend.  This may be related to increased adoption of open APIs (e.g. FHIR) to healthcare data. The security of the mobile apps and separate entities accessing healthcare APIs  has been previously flagged in a number of reports as a potential entry point for hackers.”

Healthcare is one of those prime targets for threat actors. Thus those in that sector need to do everything possible to make sure that they do not continue to be a prime target.

On Friday, the FBI, the National Counterintelligence and Security Center and the Air Force Office of Special Investigations published an advisory warning that unnamed, foreign intelligence entities see U.S. space-related innovations and assets as potential threats as well as valuable opportunities to acquire vital technologies, and they will inevitably target the private space sector to steal sensitive data from satellite payloads and disrupt US satellite capabilities.

“Foreign intelligence entities recognize the importance of the commercial space industry to the U.S. economy and national security, including the growing dependence of critical infrastructure on space-based assets,” the agencies said.

The advisory noted that threat actors are seeking to degrade the country’s ability to provide critical services during emergencies and times of conflict by identifying and exploiting vulnerabilities in U.S. commercial space infrastructure. Another key concern highlighted is that foreign intelligence agencies are looking to siphon intellectual property and proprietary data from space firms to benefit their own national security programs.

The advisory also said the U.S. financial sector estimates that the global space economy is projected to more than double to more than $1 trillion by 2030 from 2021.

Emily Phelps, Director, Cyware had this to say:  

“The importance of securing our critical infrastructure – including U.S. space infrastructure –cannot be overstated. It’s not just securing technology – it’s securing our way of life and the investments in our future. It requires a combination of policy-driven, technological, and human-centered strategies. We will need public-private collaborations, regulatory oversight, advanced encryption and collaborative intelligence, as well as a broad and robust cybersecurity culture.  

“Just as astronauts must prepare for space travel, we must fortify our defenses against threat actors who seek to disrupt our public and private space programs.”

At this point, one should assume that everything is fair game when it comes to a cyberattack. Thus everything must be secured so that they don’t become a headline when threat actors come calling.

The Advanced Research Projects Agency for Health (Arpa-H), said that it is launching an initiative dubbed the Digital Health Security project (Digiheals), to find and help fund the development of cybersecurity technologies that can specifically improve defenses for digital infrastructure in US health care.  

Running through September 7, Arpa-H, an agency within the US Department of Health and Human Services, will review proposals from researchers and technologists for cybersecurity tools aimed specifically to health care systems, hospitals and clinics, and health-related devices.

“We’re looking for rapid and stupendous progress. We want to ensure that the impact we have is significant but also equitably distributed. It doesn’t matter if we develop a perfect cure that makes a network completely impenetrable if a rural hospital can’t adopt it because of light IT staff or minimal or no security budget,” said Digiheals program manager Andrew Carney. 

Digiheals is seeking a broad range of submissions related to vulnerability detection, software hardening, system patching, and the development of security protocols with the goal of fostering new and inventive solutions. Digiheals is also encouraging researchers to make submissions related to the types of security tools that are not working in health care settings and the reasons for these failings.

“Currently, off-the-shelf software tools fall short in detecting emerging cyber threats and protecting our medical facilities, resulting in a technical gap we seek to bridge with this initiative,” Arpa-H director Renee Wegrzyn said in a statement.  

Ted Miracco, CEO, Approov Mobile Security had this to say:  

“We believe the Digital Health Security project (Digiheals) is an important effort that is coming at the right time, with so many of our healthcare facilities under attack or in the crosshairs of bad actors.    

“Andrew Carney is absolutely correct in identifying the resource limitations and budgets as a prime factor to address, and we are optimistic that rapid improvements can be made by deploying both existing technologies more broadly, and sharing information rapidly when new threats emerge. Many of the recent attack are not new, so a component of the solution must be better information sharing across the complex healthcare ecosystem.

This is a great idea and I hope it results in better security for not just healthcare, but for all of us.

Recently, the DHS has announced a investigation into cloud security:

“Organizations of all kinds are increasingly reliant on cloud computing to deliver services to the American people, which makes it imperative that we understand the vulnerabilities of that technology,” said Secretary of Homeland Security Alejandro N. Mayorkas. “Cloud security is the backbone of some of our most critical systems, from our e-commerce platforms to our communication tools to our critical infrastructure. In its reviews of the Log4j vulnerabilities and activities associated with Lapsus$, the CSRB has proven itself to be ready to tackle and examine critical and timely issues like this one. Actionable recommendations from the CSRB will help all organizations better secure their data and further cyber resilience.”  

Ani Chaudhuri, CEO, Dasera had this to say:

The recent announcement by the Department of Homeland Security regarding the Cyber Safety Review Board’s (CSRB) upcoming review on cloud security highlights the criticality and urgency of bolstering defenses in our modern digital landscape. Cloud environments have become ubiquitous, supporting myriad facets of public and private sector activities. Given this backdrop, we can go into the questions presented.

Significance/Implications for Cloud Providers:

• Reputation and Trust: Cloud Service Providers (CSPs) have long championed the security of their platforms. This review will highlight their claims’ robustness and scrutinize their methodologies. Those proactive in their security strategies will find validation, while others might face a reckoning.
• Evolution of Best Practices: The CSRB’s recommendations will likely lead to an industry-wide shift in best practices, nudging CSPs to adopt innovative strategies, especially concerning identity management and authentication.
• Collaborative Efforts: This initiative underscores the need for public-private collaboration. CSPs should be primed to work closely with governmental agencies, benefiting from a broader pool of expertise.

Implications for Cloud Customers:

• Enhanced Security Posture: As the CSRB crystallizes its findings into actionable recommendations, cloud customers stand to benefit directly. These guidelines can fortify their defense mechanisms, making them less susceptible to breaches.
• Clarity and Education: Often, the intricacies of cloud security remain nebulous for many users. This review will bring much-needed clarity, helping organizations comprehend potential vulnerabilities and the ways to mitigate them.
• Shared Responsibility Realignment: Cloud security operates on a shared responsibility model. This review will sharpen the contours of this model, helping customers discern their part in the grander security schema.

The Outcome of the Review and Potential Changes:

• While the CSRB doesn’t have regulatory or enforcement powers, its influence stems from its collective expertise and the gravitas of its recommendations. Past reviews, like those into the Log4j vulnerabilities and the activities of Lapsus$, have been instrumental in reshaping cyber defense strategies.
• Given the recent Microsoft Exchange Online intrusion, we can expect a renewed emphasis on strengthening identity management and authentication in the cloud. This might lead to the inception of new technologies or the broader adoption of extant yet underutilized solutions.
• More importantly, the findings will likely foster a culture of proactive security vigilance rather than a reactive stance. The cloud industry might see an acceleration in the integration of advanced threat detection, response mechanisms, and continuous security education.

The DHS’s initiative, steered by the CSRB, couldn’t be more timely. In a world where our reliance on cloud infrastructure is deepening, such proactive measures herald a shift from merely responding to threats to preemptively identifying and plugging vulnerabilities. This is not just about technology; it’s about trust and ensuring the cloud remains a haven for innovation and growth.

Seeing as “the cloud” is central to businesses, this is a good move by the DHS. Because everyone needs to make sure that whatever infrastructure that people use are safe and secure 100% of the time.

According to research provided by The Record, the number of ransomware attacks posted on extortion websites in July reached a record high, with ransomware groups publicly claiming over 15 attacks per day on average.

Recorded Future’s data reveals a total of 484 ransomware attacks in July, up from 408 the previous month. The surge was largely driven by the Russia-based Clop ransomware group, which exploited a vulnerability in the MOVEit file transfer tool to breach global computer networks.

Those attacks accounted for 35% of all publicly reported victims in July, including Shell, Siemens Energy, and a major U.S. public pension fund, with the education sector being particularly impacted. However, there were a total of 484 attacks spread across 38 different groups in July 2023, compared to 214 attacks across 24 groups in July 2022.

Emily Phelps, Director, Cyware had this to say:  

“With ransomware, cybercriminals don’t need to be sophisticated hackers to execute sophisticated attacks. Ransomware has a low barrier for entry, and with the emergence of Ransomware-as-a-Service, it requires virtually no technical skills to execute a successful attack. It’s profitable and harder to trace, with many adversaries dealing in cryptocurrencies.  

“Preventing successful ransomware attacks requires organizations to take multiple actions, which include keeping software and systems patched and updated; regularly maintaining and isolating backups; conducting regular security awareness training; and investing in threat intelligence and detection systems that enable security teams to proactively defend against these types of attacks.”

Carol Volk, EVP, BullWall follows with this: 

“Ransomware attacks continue to rise and the battle continues. We must learn from every event, improving our security posture, as the fallout from such attacks can be devastating to a business in terms of lost revenue, business disruption and long-term reputational damage.  

“While the hope of a magical AI silver bullet to protect us is still just a dream, we have to own our own protection and apply the best defense available within the resources available to us. There are good defensive options, from on-prem teams to Security as a Service (SECaaS) that can provide the full range for a good defense, including detection, backup and containment solutions. Stay current!”

Ransomware is not going away. Organizations need to wrap their heads around this and do whatever is required to make sure that they are not going to be the next victim of a ransomware attack.

There’s new research that is out detailing hackers targeting smaller websites to take them over and set up phishing pages:

Abandoned websites end up captured by cybercriminals fairly often. A lack of maintenance and security patches means they are easy to compromise using a known exploit. Besides, on a long-neglected site, phishing pages can stay up for long periods of time, as no one monitors what gets published, which is exactly what scammers look for.

This does not mean malicious actors do not attack actively maintained sites, though. Smaller websites attracting little traffic are among those exposed to the hacking threat. Their owners may not be able to afford to spend enough money on information security or hiring a security professional, they may be unfamiliar with security settings, or they may be confident that their website is too small to be of any interest to hackers. However, to a phisher, the possibility of hacking the website is more important than its popularity, as links to scam pages are likely to be emailed or sent via instant messaging platforms. Therefore, even smaller websites are an attractive target for scammers.

According to W3Techs, 43.1% of all websites on the internet are powered by the WordPress content management system. There is a huge number of third-party plugins designed for extending the functionality of this popular platform. New vulnerabilities exploited by hackers are discovered both in plugins and in WordPress itself on a regular basis. The rest of this article will deal with phishing pages on hacked websites that are powered by WordPress.

Jack Nicholsen, CISO, Inversion6 had this to say:

Everyone should be concerned about the growing threat of phishing attacks on WordPress sites. These attacks can have a significant impact on businesses, both financially and reputationally. Hackers are increasingly targeting WordPress sites because they are a popular content management system (CMS) that is used by millions of websites. WordPress sites are also often less secure than other websites, as they may not be properly maintained or updated. Kaspersky found that hackers are using a variety of techniques to target WordPress sites, including: 

• Exploiting vulnerabilities in outdated software and plugins. WordPress plugins are a common way for hackers to gain access to a website. It is important to keep all plugins up to date and to only install plugins from trusted sources. 
• Phishing emails and social engineering attacks. Hackers will often send phishing emails that appear to be from a legitimate source, such as a bank or credit card company. The emails will often contain a link that, when clicked, takes the victim to a fake website that looks like the real website. Once the victim enters their personal information on the fake website, the attacker can steal it.
• Brute-force attacks. Hackers will often use brute-force attacks to try to guess the passwords for WordPress accounts. It is important to use strong passwords and to enable two-factor authentication.

 Security teams can take a number of steps to protect their WordPress sites from these attacks, including:

• Keeping their websites up to date with the latest security patches. WordPress releases security patches regularly, and it is important to install these patches as soon as possible. 
• Using strong passwords and two-factor authentication. Strong passwords should be at least eight characters long and include a mix of letters (uppercase and lowercase), numbers, and symbols. Two-factor authentication adds an extra layer of security by requiring users to enter a code from their phone in addition to their password.
• Installing a security plugin for WordPress. There are a number of security plugins available for WordPress that can help to protect your site from attacks.
• Monitoring their websites for suspicious activity. Security teams should monitor their websites for suspicious activity, such as unusual login attempts or changes to the website’s code. 
• Training employees on how to identify and avoid phishing emails. Employees should be trained on how to identify and avoid phishing emails. They should be taught to never click on links in emails from unknown senders and to never enter their personal information into websites that they do not trust.

My advice would be that if you have a website that isn’t being maintained, take it down. And for everyone else, you should do everything possible to secure those websites so that they don’t get leveraged by threat actors for evil.

The ONCD / CISA has issued a Request for Information on security areas in open source software, and seeking insights on their long-term focus and prioritization:

The security and resiliency of open-source software is a national security, economic, and a technology innovation imperative. Because open-source software plays a vital and ubiquitous role across the Federal Government and critical infrastructure, vulnerabilities in open-source software components may cause widespread downstream detrimental effects. The Federal Government recognizes the immense benefits of open-source software, which enables software development at an incredible pace and fosters significant innovation and collaboration. In light of these factors, as well as the status of open-source software as a free public good, it may be appropriate to make open-source software a national public priority to help ensure the security, sustainability, and health of the open-source software ecosystem.

Allen Drennan, Co-Founder & Principal, Cordoniq had this comment on this initiative:

It is critical that we prioritize the primary open-source, security software infrastructure that runs the Internet. A significant portion of the Internet uses open-source security stacks such as OpenSsl for cryptography and PKI for both clients and server, and history has shown that major vulnerabilities in these components have wide-spread implications (think Heartbleed).  Ideally ONCD and CISA need to derive a overall plan that not just involves how to identify and rectify issues in open source security stacks, it needs to come up with a plan to react to issues in the event they arise so widespread malware attacks can be mitigated.

Open source software can’t become the Wild West as that will simply end badly. Thus this is a good move to make sure that this does not happen and open source software can be used safely regardless of the use case.