Ransomware is quickly becoming one of the biggest risks for health care organizations in 2016. In response to ransomware’s prevalence, the Department of Homeland Security (DHS) issued an alert on March 31 to educate health care organizations about ransomware risks and provide guidance for how to combat it. Since the beginning of 2016, ransomware has hit several hospitals around the U.S.. DHS’s alert informs all organizations, including health care organizations, of the severity of the ever-growing threat.
The threat, ransomware, is a type of malware that restricts access to an infected computer, requiring the user to pay a ransom in order to regain access to the computer. It’s often spread through emails with attachments or infected websites that users visit without realizing they are infected. Ransomware can also infiltrate a computer through vulnerable Web Servers.
As a result of its invasive nature, ransomware has many ramifications for all health care organizations, regardless of size. Hospitals and smaller offices can lose access to patient records, significantly impacting patient care. If an organization has to pay the attackers to gain access to patient records, it could suffer significant monetary losses.
As the attackers manage to get more ransoms paid, the ransom amounts will most certainly increase. Also, by paying the ransom, the attackers may be able to gain banking information. The domino effect continues.
In addition to the potential ransom expense, an organization would most likely have to deal with the costs necessary to make sure systems are once again operational, and potentially the cost of hiring consultants if current employees don’t have the necessary technical experience.
Worse than the initial financial burdens, the biggest cost of ransomware can be the loss of trust. Patients may think twice about obtaining care from an organization that had to shut down operations due to ransomware. Protect your patients’ trust by taking steps to protect your organization from ransomware.
So what can be done about ransomware?
The best line of defense against ransomware comes from preplanning and training. Consider implementing the following steps to defend your organization from ransomware:
- Train end-users in the many different ways malware and ransomware is spread.
- Don’t follow links in unsolicited emails.
- Conduct Social Engineering to find the individuals in your organization who may need additional training.
- Lock down system access and make sure most users cannot execute files on the systems without permission.
- Think about application whitelisting, which is approving only certain programs that are allowed to run on the systems.
- Conduct backups and test them frequently; ensure they are available offline.
- Make sure anti-virus and anti-malware software is included on each system and the databases are up-to-date.
- Scan all downloaded programs with anti-virus software before executing.
- Install patches and updates regularly for software, operating systems, and web servers.
- Conduct a risk assessment, especially if one hasn’t been completed in over a year.
- Update the Contingency Plan and determine how to react in the event of ransomware; test it regularly.
- Conduct frequent vulnerability scans and penetrations tests.
While this exhaustive list will not guarantee a ransomware attack won’t occur, it will help protect against such an encounter and help organizations prepare for the possibility of such an attack.
If you’d like to learn more about protecting your organization from ransomware and other patient-privacy threats, check out the HIPAAgps system today and start protecting your patients and your budget.
Recent Comments