“Healthcare organizations are no stranger to cyberattacks, as private health information has become a valuable commodity for hackers. But the threat of a ransomware infection can go beyond a conventional data breach and cause a hospital’s operations, for example, to grind to a complete halt. The first article in this series described the threat of ransomware attacks and explained what it means for healthcare organizations. This article offers advice to those organizations on how to prevent and respond to ransomware infections.
The general guidance from the FBI in its trifold brochure on ransomware, from KnowBe4 in its Ransomware Hostage Rescue Manual and in the National Institute of Standards and Technology’s Computer Security Incident Handling Guide is to place primary focus on preparation and prevention, and then on response.
Users: First and foremost, companies need to recognize that their first line of defense against a ransomware infection includes every one of their users — employees, vendors, contractors and volunteers who use networked computers for email and internet browsing. Companies need to educate their users about ransomware, phishing attacks and subtle malware attacks. Otherwise, they can probably expect continuing issues with attacks or near-misses with ransomware and other viruses or worms attempting to infect their systems.
Account privileges: Manage and limit the number and scope of privileged accounts in your enterprise’s user base. This way, an attack would most likely be against a user with limited privileges and its impact would be minimized, as opposed to an attack on a system administrator or highly privileged computer user which could lead to substantial damage and greater “depth” of the ransomware infection on your systems.
Backups: A key defense for malware is having recent backups of all working files and data readily available. If you don’t have these backup files segregated from your network but available when ransomware hits, you may wind up paying the ransom rather than rebuilding your systems without payment to the evildoer. Therefore, ensure all possible data you will need access to run your hospital or enterprise is backed up and segregated from the network — this includes USB and mobile storage.
Be certain your backups are not connected permanently to computers and networks being backed up or they will be subject to the ransomware’s scans and attack paths.
You can probably skip this step in some incident response scenarios but it may be helpful for the FBI or law enforcement response — and even your antivirus or cybersecurity vendor — to know what type of ransomware they are dealing with. One ready asset you can immediately examine is the Bleeping Computer website, where you can view examples of different ransom note screens and make a more educated guess as to the type of ransomware you have been infected with.
In this step, your focus is on restoring your systems to normal. Ensure all traces of the ransomware infection are removed — even from old backups and backups of backups.
With everything else going on let us ease your mind when it comes to your Telecom, Data, Security and Maintenance needs.
Visit our website www.trivatechgroup.com or call us at 888-352-6563 for more information on how TTG can help you.
Previous Article Trivatatech Group. Telecom, Data, Security and Maintenance Consulting.