Ransomware

Some of the most well-publicized healthcare ransomware attacks last year, including an attack in Ottawa, involved hospitals. Indications are that with increasingly sophisticated exploit techniques, hackers are moving towards data-intensive businesses, including medical practices, hospitals, financial services and legal services industries.

It is not difficult to imagine why healthcare data breaches are far more dangerous to victims than other breaches. Even small 1-2 physician medical clinics can host 3,000-6,000 confidential electronic medical records. While privacy risks are serious and could jeopardize your clinic’s compliance to PIPA if breached, ransomware can, in addition, hold computer systems and medical data hostage by encrypting files and locking out access until a ransom is paid. Frequently the ‘hostage note’ will indicate data will be destroyed unless this is done within a given time. The disruption to patient care could be significant. And ransomware software is rapidly evolving. One of the latest variants, Doxware, lets hackers hold computer systems hostage like other ransomware, but takes the attack further by threatening to release personal information publicly unless the ransom is paid.

How many clinics have already been affected in western Canada? We don’t know. It is quite possible that some clinics, like many Canadian businesses, have quietly paid ransoms to get control over their systems. According to one study, Canadian companies are 75% more likely to pay ransoms compared to the US, UK and Germany, and that if they didn’t pay, 82 percent lost files. The cost to pay ransomware extortionists has ranged from $1,000 to $50,000. And it is not uncommon for the same businesses to be hit more than once, by the same hacker or by others.

How can you protect your clinic? The following 10 recommendations are based on suggested actions by Public Safety Canada and others.

1. Backups: Backup and regularly test them to make sure you can recover your data. Having encountered very unfortunate cases where owners thought their backups were working, we cannot say enough how important this is. Backups must be secure, encrypted, and not connected to your computers or network. If cloud-based (and this, of course, could be questioned from a privacy perspective), avoid persistent synchronization techniques that could be locked by some ransomware variants. This includes Dropbox, Google Drive and One Drive.
2. Good Email Hygiene: Do not open ANY email attachments from unknown senders, and treat ALL with suspicion. Inspect the URLs or any links inside email body copy before clicking. Don’t click on ‘URL shortened’ links as it is impossible to know where you are being directed. Don’t click on any email that seems ‘out of the ordinary’, especially from a CEO, president or managing partner. Instead, confirm it through a new email you create, or by phone or in person. If you can, configure your email server to block suspicious email attachments similar to that done by UBC, and destroy emails with known malicious URLs.
3. Application whitelisting: Implement application whitelisting, an IT technique used to prevent malicious software and unapproved programs from running.
4. Security patches: Keep your computers up to date with the latest patches. Vulnerable systems and applications are the targets of most attacks. This, of course, includes servers hosting clinic data. A compromised client computer is often just the entry point from where exploits are launched to attack other systems inside a secure network.
5. Anti-virus: Make sure antivirus is kept up to date and running on all of your systems. Scan all downloaded software before executing it.
6. Basic Computer Security: Limit access. Never use an admin profile as a user. Apply the principle of ‘Least Privilege’ to all systems and services to help prevent malware from spreading. Never download software from unknown sites. Be extremely critical of ‘free’ software.
7. Macros: Disable macros unless absolutely required. Consider using Office Viewer software instead of MS Word when viewing email from clients or vendors. Receiving malware from unknowing senders you trust is a well-known technique.
8. Web Browsing: Use safe practices when browsing the web not only within the clinic but when you take your laptop or mobile device home. A laptop can by itself become a trojan horse if taken from an untrusted home environment or public internet location and connected back into your secured, carefully managed medical clinic.
9. Network Security: Install a commercial grade firewall with active web filtering. The cost will more than pay for itself if it prevents a breach. Physically segregate critical data on different systems to limit risks.
10. Focus on awareness and training: Make sure your staff knows the risks involved, and what to do to prevent ransomware from hitting your clinic. The most common contributor to successful phishing attacks is a lack of knowledge and human behavior. To protect your clinic from ransomware, an intelligent human firewall is one of the best defenses you can have.

The Doctors Technology Office (DTO) at Doctors of BC has a technical bulletin entitled Malware/ Virus Security Risks that may be of help. Further advice can be found on the RCMP website, in advisories by Public Safety Canada (2013and 2016), advisories issued last September by the US-CERT , the FBI , and No More Ransom, a site built through the work of several European police agencies, Kaspersky and Intel.

Update 20190715: More information has been emerging since this post as published. Please see our updates, Ransomware Revisited, and most recently, New Ransomware Threats.

If you need help, contact us. Prevention is much less costly.

In the next post in our series of privacy and data security best practices, we will discuss what you can do to reduce risks to your clinic in case of a security breach.