| | September 20219UTLOOKHealthcare Tech implement restrictions, the organization must spend additional money and resource time to isolate traffic only to that which is necessary. However, the alternative is to have PACS encrypted by ransomware ­ using the most conservative estimates ­ the organization has to consider being on Divert for 2-4 weeks, at the cost of $160 - $320 Million.The answer is that we must have the relationships, trust, and expertise to influence change ­ to be able to put roadblocks on multi-million-dollar initiatives or retrofit existing infrastructures. That means we have the trust of the organization and can translate this risk into something our executives and Board understand. Once we have organizational support, we must undertake several critical actions. First, we must stop servers from phoning home. Ransomware must be able to phone home to get the encryption key. This control, by default, allows only those Internet addresses required, and by default, blocks anything else. Ransomware becomes inert if it cannot phone home.While TCP/IP is a very technical concept, we must engage or hire staff that understands the technical concepts, so that we can determine how ransomware works. Ransomware uses file share browsing, called Server Message Block (SMB) ­ and that protocol happens over port 445. Do you allow all users to use SMB to browse into the PACS network? If so, any user infected with ransomware will eventually encrypt your PACS images. The answer is to isolate the PACS network so that users cannot access PACS over SMB 445. Users must be on an isolated network and device to access these file shares and images. This solution seems to be easy; however, retrofitting isolation on an existing network/application infrastructure can be risky and difficult.Besides proper isolation, the most important action to mitigate ransomware is data backup. If you cannot access the data, and you cannot decrypt it, you must be able to restore the data from backup. This action requires a lot of pre-planning and some cost in terms of budget and resources. If you cannot restore the encrypted data, you limit your choices greatly. If you properly backup your data and protect those backups from ransomware, you should be able to restore the impacted data without having to pay the ransom. However, as previously mentioned, you must understand how much time it will take to restore the data and use that in the equation of overall impact to the organization.Often the question arises ­ should I just pay the ransom? This question is very valid; however, it misses some important points. The ransom cost is often more than it would have cost to put in the proper security controls to protect against ransomware. Additionally, having the right backup plan will, in most cases, alleviate the need to pay the ransom. Finally, even if you pay the ransom, you are not guaranteed that the attacker will honor the arrangement. Instead, they will likely see your organization as an easy mark and will continue to attack you.In conclusion, ransomware is the biggest threat many organizations face today. If everyone properly isolated their networks and had great backup/restore plans, ransomware would not be a big deal. It is the absence of these common-sense controls that allow ransomware to be such a threat.We must take ransomware seriously and address it properly. It can be an existential threat to your organization. HTRansomware is the biggest threat many organizations face today. If everyone properly isolated their networks and had great backup/restore plans, Ransomware would not be a big deal. It is the absence of these common-sense controls that allow Ransomware to be such a threat
< Page 8 | Page 10 >