| | September 20218UTLOOKHealthcare Tech IN MY OPINIONData Encryption is the Way to Deal with RansomwareBy Randall Frietzsche, Enterprise Chief Information Security Officer (CISO), Denver HealthRansomware is malware that phones home to the criminal's server to retrieve an encryption key and then proceeds to encrypt the user's hard drive, along with anything the user has access to on the network. The main targets of ransomware are network file shares. These shares are available to many others on the network. Ransomware takes advantage of file sharing to encrypt as many files as possible. The motive of ransomware is to make you pay a ransom to get a decryption key so that you can decrypt the files. If you don't pay the ransom, ransomware promises that you will forever lose access to these important departments, organizational files, and even federally-regulated data like Protected Health Information (PHI.)The biggest attack vector for ransomware is email phishing. The attacker sends out thousands of phishing emails, hoping the recipients will click on a link or open an attachment. A connection is made to the attacker's server, and the ransomware is executed, encrypting data. The ransomware starts encrypting the user's device and reaches out to everything the user has access to. Consequently, this security event turns into a major incident, with data on the network becoming unavailable. This type of event is so critical because most organizations rely on that data to operate.In the most recent past, we have seen two major targets of Ransomware ­ Healthcare and Government Municipalities. Ransomware works in these organizations because they usually don't have the budget or human resources to have built-in protections to mitigate ransomware mostly. These organizations provide critical services, and when those services become unavailable due to ransomware, a critical situation ensues. In fact, for both types of organizations, people can die due to the absence of services such as healthcare imaging, 911 dispatch, etc. Therefore, if the organization cannot quickly mitigate the ransomware, they have no choice but to pay the ransom and hope they get the decryption key. The problem with paying the ransom is that the organization is now seen to the attackers as an easy mark. This ensures that the attackers will continue to attack these organizations.In my organization, we have PACS ­ PACS is the system that takes in all the images from the Biomedical devices ­ X-Rays, MRIs, CAT/CT scans, etc. PACS allows those images to be presented to a viewing station, where the Doctor can review and see any potential issues in the scans. Imaging is the most critical aspect of healthcare ­ if a Doctor cannot image and view that image on a patient, the Doctor cannot possibly help that patient. In healthcare, this absence means that the Doctor cannot possibly diagnose the patient. The result is that the hospital must go on Divert. Divert means that the hospital cannot take any new patients. In financial terms, a hospital can lose about $8,000/minute or about $80 Million per week. In patient terms, this means a patient has a critical healthcare issue that must be diverted to a hospital farther away. The risk is that patients may suffer more significant health issues, including death. Why would we allow any unnecessary traffic into our PACS network? The answer is convenience. It is easy for PACS administrators or Doctors to access the PACS network. If we Randall Frietzsche
< Page 7 | Page 9 >