Jack Skinner

 

 

Companies should get ready as crime rings plan to take their data hostage when employees slip up

 

By Jack Skinner

President and Founder

Oversee My IT

Small healthcare companies need to rethink their network security as criminal groups use new tactics to take their sensitive data

Ransomware, which was already a problem, is getting worse because technology tools that health businesses are adding, such as remote work, create new places to attack their systems.

In a study of 127 ransomware attacks against healthcare companies between 2016 and 2019, 70 percent were directed at shops with fewer than 500 employees, according to a report from security provider RiskIQ.

That’s because small providers typically have limited safety measures for their data.

Direct patient care facilities like hospitals “are more likely to pay (ransoms) to prevent disruption to patient care,” RiskIQ reported.

 

 

Mistakes a growing problem

As Covid-19 makes smaller shops put more data on the Internet, criminals are stealing credentials to break into their web applications.

And while internal actors account for many healthcare breaches, employee error is increasingly how bad guys get their hands on key information.

Some 31 percent of healthcare breaches this year are due to staff mistakes, compared with 22 percent across all industries, according to a Verizon study.

Covid is partly to blame because of stress and fatigue it is causing for people in the field.

 

But like industries such as finance, security glitches in healthcare often start with problems in workflow, communication, judgment, corporate culture – things that can’t be solved by buying a new technology tool.

 

 

How hackers get in

Employees are often unaware of miscues they have made that expose sensitive data to law breakers.

The most common oversight in 2020 is sending emails or paper documents to the wrong people, according to Verizon.

Some 14 percent of cybersecurity professionals say attacks that exploit short-staffed tech and security departments are the elements of the Covid-19 crisis that are most likely to increase risk to their enterprises.

Another is losing track of where key data is stored, such as putting medical records in a file and forgetting where it is.

Technology staffers since 2017 have increasingly left data-storage devices vulnerable on the Internet, according to Verizon.

Researchers forecast a rise phishing emails aimed at stealing credentials from overworked information-technology professionals.

The U.S. Secret Service has warned of emails from criminals posing as officials of the Centers for Disease Control and the World Health Organization.

 

 

Ransoms may replace inside jobs

Ransomware will likely rise as organizations add more connections to their networks, whether mobile devices, patient portals and other ways to interact with those they do business with.

As errors open more doors to intruders, healthcare may be seeing a decline in thefts caused by insiders like executives or doctors.

Privilege misuse accounted for 23 percent of attacks on healthcare organizations in 2019, versus 8.7 percent this year.

That may be partly because some companies are getting better at detecting breaches.

This year, organizations with fewer than 1,000 employees have been more likely to discover breaches in days, where big companies more often have taken months or years, according to Verizon data.

 

How to protect your company

 

 

Addressing security gaps on a network requires understanding:

• Devices and technology connected to it
• What data is located where within it
• Protective measures it needs
• Changes or upgrades necessary for regulatory compliance

Even at businesses with fewer than 10 employees, managers are often surprised what security evaluations find in their information systems.

Technology improvements should coincide with updated training for both lay and IT staffers on recognizing criminal behavior and what to do about it.

Audits on how information moves from one employee to another can help spot gaps that hoodlums may target.

These steps should extend to cloud services that providers may use going forward.

Contact Jack Skinner at Info@OverseeMyIT.com.

 

About Jack:

• President and Founder of Oversee My IT, an Irving-based company that works with small and mid-sized businesses to make their technology trains run on time.
• Launched in 2007, Oversee helps organizations with 10 to 200 employees to run their computers, secure their data and handle compliance.