Earlier this year, the newsletter highlighted the three most common cybersecurity threats, and outlined measures required by HIPAA to prevent or mitigate them substantially. The newsletter targets all covered entities, including healthcare providers and business associates.
As cybersecurity and compliance experts with a core practice in healthcare, the 24By7Security team felt duty-bound to help disseminate this information as extensively as possible throughout the community. Today’s blog is based largely on the OCR newsletter.
The most common cyberattack vectors threatening healthcare covered entities today are (1) phishing schemes, (2) the exploitation of known vulnerabilities, and (3) taking advantage of weak cybersecurity practices. Below we describe each of these vectors, followed by OCR recommendations for addressing each one.
These popular schemes are called phishing because the cybercriminal is like an angler trying to lure a fish into taking the bait. In the ocean that is healthcare, there are plenty of bites.
In phishing attacks, a hacker or other cybercriminal impersonates a trustworthy source in order to trick employees into divulging sensitive information via email or other electronic communication. By similar definition, phishing is a technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in an email or on a website in which the attacker masquerades as a legitimate business or reputable person.
Phishing escalates to whaling when the scheme targets the bigger fish in an organization, such as executives or other senior members.
Hackers can penetrate a covered entity’s network and gain access to electronic protected health information, or ePHI, by exploiting vulnerabilities that are publicly known or acknowledged. The National Institute of Standards and Technology (NIST) maintains the National Vulnerability Database (NVD), which is the U.S. government repository for information about known vulnerabilities.
Exploitable vulnerabilities can exist in many parts of a covered entity’s IT infrastructure, including server, desktop, and mobile device operating systems; application, database, and web software; and router, firewall, and other device firmware. ePHI obtained through the exploitation of a known vulnerability can be readily sold on the dark web, and subsequently exploited by those who purchase it.
Weak, poor, or non-compliant cybersecurity practices are the low-hanging fruit of cybercrime and make an organization a very attractive target. Weak authentication practices enable attacks to be successful with high frequency. Citing a recent Verizon Data Breach Investigations Report, OCR noted that more than 80% of data breaches that result from hacking involve compromised or brute-forced login credentials.
Weak password rules, unenforced password rules, and single factor authentication are among the poor cybersecurity practices that contribute to successful attacks. And once an attacker is inside an organization, weak access controls can enable them to exploit privileged accounts, move at will among multiple computer systems, deploy malicious software, and steal ePHI.
Citing these three attack vectors as the most common and successful within the healthcare industry, the OCR notes that some attacks may be sophisticated and exploit previously unknown vulnerabilities, which are called zero-day attacks.
However, the OCR emphasizes that most cyberattacks could be prevented or substantially mitigated if HIPAA covered entities and business associates implemented HIPAA Security Rule requirements to address the most common types of attacks.
More simply put, failure to comply with HIPAA Security Rule requirements allows the most common types of attacks to be successful.
The OCR newsletter recommends that covered entities take the actions detailed below. And knowing that the OCR is responsible for investigating and imposing penalties for non-compliant practices, this advice is ignored at your own peril.
The OCR notes that the “HIPAA Security Rule requires implementation of a security awareness and training program for all workforce members” because every employee plays an important role in protecting the ePHI held by their organization. That role includes being able to detect a phishing attempt and take appropriate action.
In addition to ongoing training and reminders, the OCR recommends implementing anti-phishing tools or technologies, noting that these can take several forms.
These solutions can be helpful in preserving the integrity and availability of ePHI, as required by HIPAA. The OCR further emphasizes that combining an engaged, educated workforce with technical solutions offers the best opportunity to reduce or prevent phishing attacks.
Known vulnerabilities can often be addressed by applying vendor patches or upgrading to a new software version. If not available, vendors may recommend modifying configuration files or disabling affected services. In addition, the OCR recommends the following actions to prevent or reduce the exploitation of known vulnerabilities.
Another approach to preventing known vulnerabilities exploitation is to “implement a security management process to prevent, detect, contain, and correct security violations,” per the HIPAA Security Rule. The OCR emphasizes that the process must include conducting a risk analysis, as per 45 CFR 164.308(a)(1)(ii)(A)-(B).
Once the risk analysis has identified, assessed, and prioritized all known vulnerabilities, the healthcare organization or business associate must implement appropriate measures to mitigate these vulnerabilities—such as applying patches, hardening systems, retiring or upgrading equipment, and various other mitigations.
Covered entities are required to comply with authentication and access safeguards as described in 45 CFR 164.312(d), 164.312(a)(1), and 164.306(e). The OCR offers the following guidance to strengthen authentication and access controls, noting that a risk analysis should guide the implementation of appropriate authentication and access measures to reduce the risk of unauthorized access to ePHI.
Password policies and enforcement can also help prevent unauthorized access to ePHI and other sensitive information. Extensive advice is available in this area from a variety of sources, including the 24By7Security blog.
The U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) publishes a variety of newsletters, including one offering cybersecurity guidance for members of the healthcare industry, including business associates. A recent newsletter highlighted the three most common cybersecurity threats in healthcare and outlined measures required by HIPAA to prevent or mitigate them substantially.
The most common cyberattack vectors threatening healthcare covered entities today are phishing schemes, the exploitation of known vulnerabilities, and taking advantage of weak authentication and access control practices. Actions required to prevent or seriously reduce these malicious exploits are not complicated or new. Instead, they are proven techniques that work effectively when actually implemented.
For covered entities who prefer professional assistance in implementation, help is a phone call away at 844.55.CYBER. That’s 844.552.9237.