Healthcare Cybersecurity

Updates to Cofense Phishing Simulation Platform Add Even More Opportunities for Automation

Posted by HIPAA Journal

Cofense has announced that further updates have been made to its award-winning phishing email simulation platform, Cofense PhishMe. The updates provide even greater opportunities for automating phishing simulation campaigns to save administrators even more time.

Security awareness and anti-phishing training is now an important part of healthcare organizations’ cybersecurity programs. In addition to investing in technology to block phishing and other email-based threats, end users require training. Even layered defenses will not stop all phishing threats from reaching inboxes. Without training, end users will remain the weakest link in the security chain.

Phishing simulation exercises are an important part of the training process. They allow security teams to assess how effective their training programs have been and identify weak points in the training program. They also allow security teams to identify individuals who have failed to understand certain parts of the training program.

While phishing simulation platforms include some opportunities for automation and scheduling, creating and running phishing simulations can still be a time-consuming process.

The latest updates to the Cofense PhishMe platform incorporate even more opportunities for automation. Whereas creating a program of 12 phishing scenarios and scheduling those campaigns over the course of a year would have taken an administrator about three hours to complete, the update shaves off 91% of that time. The same 12 campaigns can be created and scheduled in 15 minutes.

This has been achieved with the use of playbooks. The playbooks can be used to create, schedule, and launch phishing templates and schedule them over the course of a year. Additionally, administrators can automate the sending of reminders to end users based on the training programs they have competed – or not completed – saving even more time. The playbooks also incorporate the lessons learned from phishing simulation campaigns conducted by 400 of Fortune 1000 companies that have used the Cofense PhishMe platform.

“At Cofense we believe in automation as a way to relieve security operators of the repetitive tasks to allow them to focus on strategic, intelligent decision-making,” said Rohyt Belani, Co-founder and CEO of Cofense. “Playbooks are meant to allow both managed services providers and our end clients the ability to choose various programs just like one does on a treadmill in a gym, so they don’t need to focus on the metaphorical tasks of having to change speed and incline but can instead focus on designing and tracking the appropriate success criteria and presenting them appropriately to senior management.”

In addition to the Cofense PhishMe updates, the Leesburg, VA-based company has also recently launched its new phishing-specific Security Orchestration, Automation and Response (SOAR) platform, has incorporated board-level reporting, and has launched mobile Cofense Reporter and more accurate Microsoft attachment tracking. These updates and the continued high-level innovation have helped the company remain the market leader in phishing defense and attack disruption.

The post Updates to Cofense Phishing Simulation Platform Add Even More Opportunities for Automation appeared first on HIPAA Journal.

Only 30% of Healthcare Organizations Have Taken Out Cybersecurity Insurance

Posted by HIPAA Journal

A recent survey conducted by Ovum on behalf of analytics firm FICO has revealed there has been a major increase in companies taking out cybersecurity insurance, but the healthcare industry has been slow on the uptake.

In 2017 when the survey was last conducted, 50% of U.S. firms reported that they had not taken out a cybersecurity insurance policy. That percentage has fallen to 24% in 2018. While many businesses see the value in paying insurance premiums to cover the cost of mitigating cyberattacks and data breaches, that does not appear to be the case for healthcare companies.

Only 30% of healthcare organizations have taken out cybersecurity insurance policies. 70% have no cybersecurity insurance cover whatsoever, even though the industry is targeted by hackers. The financial services industry, which is also heavily targeted by hackers, has been quick to take advantage of cybersecurity cover. Only 10% of surveyed financial firms had no coverage for cyberattacks.

The survey was conducted on 500 companies in 11 countries including the U.S., Canada, India, and the UK. The figures for the United States were the exact average across all surveyed countries, which is a major improvement on last year when U.S. companies ranked bottom out of all 11 countries for cybersecurity insurance uptake.

One of the main problems highlighted by the survey was unfair premiums which had not been accurately calculated based on the level of risk. Only a quarter of surveyed firms said their insurers had set premiums based on an accurate analysis of their company’s risk profile. A majority believed the premiums were calculated on industry averages, inaccurate analyses, or unknown factors.

The increased risk of cyberattacks and the litigation that usually follows has spurred many companies to take out policies, but in many cases the cover provided is not comprehensive cover. Only a third of U.S. companies (32%) said their policy covered all cybersecurity risks. Even though policies have been taken out, they may not pay out in the event of a breach.

“Given the number of large-scale and very public breaches in recent years, it’s not surprising that we’ve seen a big increase in US organizations investing in it over the past 12 months, but there’s still some way to go,” said Doug Clare, vice president for cybersecurity solutions at FICO. “As the insurance market matures and the litigation and fines increase we expect more firms will also go beyond basic coverage to seek insurance that is more comprehensive.”

However, that may not tell the whole story. Maxine Holt, research director at Ovum, suggested it may be a case of companies having a risk profile that that insurers are not prepared to cover comprehensively.

The post Only 30% of Healthcare Organizations Have Taken Out Cybersecurity Insurance appeared first on HIPAA Journal.

Survey Reveals Lack of Anti-Phishing Measures at U.S. Businesses

Posted by HIPAA Journal

Phishing is now the number one cyber threat faced by businesses but in spite of a high risk of phishing attacks occurring, businesses have been slow to respond to the threat and implement cybersecurity solutions to reduce the risk of email-related data breaches.

A recent survey Valimail sponsored survey has shown that anti-phishing defenses are lacking at many U.S. businesses. The survey was conducted on 650 IT/IT security professionals by the Ponemon Institute. The companies had an average of 1,000 employees with average annual email security and fraud prevention budget of $2.5 million.

The high risk of email-based attacks was made abundantly clear. 79% of respondents said that they had experienced a data breach or cyberattack in the past 12 months that certainly or likely involved email, such as a business email compromise attack or a phishing incident.

80% of respondents said they were very concerned about their organization’s ability to prevent or reduce email-based attacks and 53% of respondents admitted that preventing phishing attacks was very difficult.

Even though the risk of attack is high and breaches have been experienced, only 29% of respondents said their organization had taken significant steps to tackle the threat from phishing and email impersonation attacks. More than one fifth of firms (21%) said they had taken no steps to reduce the risk of phishing attacks.

When asked about the anti-phishing defenses that had been implemented, 69% of respondents said they had implemented anti-spam or anti-phishing filters and 56% used secure email gateway technology. Only a third of respondents (34%) said they provide anti-phishing training for employees. Even fewer (29%) have implemented Domain-Based Message Authentication and Conformance (DMARC) and Sender Policy Framework (27%) to detect and prevent email impersonation attacks.

The high number of phishing attacks and data breaches appears to have spurred many businesses to make improvements to email security. In the next 12 months, 65% of respondents said their company will be investing in anti-spam filters, 63% will be using secure email gateway technology, 47% will be using SIEM technology, and 57% will be providing anti-phishing training to employees.

Only 35% will be adopting DMARC and 23% said they planned to implement SPF. Approximately two thirds of companies would consider implementing an automated DMARC enforcement solution if it could completely stop impersonation attacks that spoof email domains and block inbound email from unknown and untrustworthy senders.

39% of respondents said their company was not spending enough on email security to stop phishing and email impersonation attacks with budget constraints a major hurdle that must be overcome.

56% of respondents said that it would likely take a serious hacking incident to get a budget increase to pay for improvements to email security. 65% said that the board would likely be swayed by concern over the loss of customers due to a security incident and 47% said concern over loss of revenue due to a security incident could result in a budget increase.

When asked how much difference a 20% increase in their email security budget would make, respondents estimated it would improve the email threat detection rate by 45% and the phishing/impersonation attack prevention rate by 33%. Without sufficient investment in email security, costly email-related data breaches are likely to continue.

The post Survey Reveals Lack of Anti-Phishing Measures at U.S. Businesses appeared first on HIPAA Journal.

Significant Vulnerabilities Identified in Maryland’s Medicaid Management Information System

Posted by HIPAA Journal

The Department of Health and Human Services’ Office of Inspector General (OIG) has published the findings of an audit of Maryland’s Medicaid system.

The audit was conducted as part of the HHS OIG’s efforts to oversee states’ use of various Federal programs and to determine whether appropriate security controls had been implemented to protect its Medicaid Management Information System (MMIS) and Medicaid data.

The audit consisted of interviews with staff members, a review of supporting documentation, and use of vulnerability scanning software on network devices, servers, websites, and databases that supported its MMIS.

The audit uncovered multiple system security weaknesses that could potentially be exploited by threat actors to gain access to Medicaid data and disrupt critical Medicaid operations. Collectively, and in some cases individually, the vulnerabilities were ‘significant’ and could have compromised the integrity of the state’s Medicaid program.

Details of the vulnerabilities uncovered by auditors were not disclosed publicly, although OIG did explain that the vulnerabilities were present due to the failure to implement sufficient controls over MMIS data and information systems. While the flaws were serious, OIG did not discover any evidence to suggest the flaws had previously been exploited.

OIG has recommended Maryland make several improvements to its Medicaid program to ensure its information systems and Medicaid data are appropriately secured to a standard that meets Federal requirements.  Maryland concurred with all of the recommendations made by OIG and has submitted a plan that addresses all of the vulnerabilities that have not yet been corrected.

The audit was one of several conducted on various states over the past few months and the findings were similar to other state’s MMIS audits. While it is a concern that serious vulnerabilities exist, the audits ensure that vulnerabilities are identified and are addressed before they are exploited by threat actors, thus helping to prevent serious data breaches.

The post Significant Vulnerabilities Identified in Maryland’s Medicaid Management Information System appeared first on HIPAA Journal.

ICS-CERT Warns of Vulnerabilities in Philips IntelliSpace Cardiovascular Products

Posted by HIPAA Journal

ICS-CERT has issued and advisory about two vulnerabilities that have been identified in Philips IntelliSpace Cardiovascular products, one of which has been given a high severity rating and could allow a threat actor to elevate privileges and gain full control of a vulnerable device.

The improper privilege management vulnerability (CVE-2018-14787) is present in IntelliSpace Cardiovascular cardiac image and information management software version 2.x and earlier releases and Xcelera V4.1 and earlier versions.

The vulnerability could not be exploited remotely. Local access is required, and an authenticated user would need to have write privileges. If exploited, privileges could be escalated and access gained to folders containing executables. Arbitrary code could be executed to give the attacker full control of the system. The vulnerability has been assigned a CVSS v3 severity score of 7.3.

An unquoted search path or element vulnerability (CVE-2018-14789) is present in IntelliSpace Cardiovascular Version 3.1 and earlier versions and Xcelera Version 4.1 and earlier versions. This flaw would allow an attacker to execute arbitrary code and escalate privileges. The vulnerability has been assigned a CVSS v3 severity score of 4.2 (medium).

Philips discovered the vulnerabilities and self-reported them to the National Cybersecurity and Communications Integration Center (NCCIC).

The improper privilege management vulnerability has been addressed in version 3.1 of IntelliSpace Cardiovascular software. Any user running IntelliSpace Cardiovascular version 2.x or prior versions or Xcelera V4.1 or prior versions should contact their Philips service support team to receive information on how they can upgrade to version 3.1.

Philips will be addressing the unquoted search path or element vulnerability in the next release of IntelliSpace Cardiovascular – V3.2 – which has been scheduled for release in October 2018. Until that point, interim mitigations can be implemented to reduce the potential for the vulnerability to be exploited. Philips suggests reviewing file permission policies and restricting available permissions where possible.

Several vulnerabilities have been identified in the IntelliSpace suite of products in recent months. In March 2018, ICS-CERT issued a warning about several vulnerabilities affecting all versions of iSite and IntelliSpace PACS, some of which were assigned a CVSS v3 severity score of 10 – The maximum score possible. If exploited the vulnerabilities could compromise patient confidentiality, system integrity, and/or system availability.

In February, ICS-CERT issued a warning about a slew of vulnerabilities in the IntelliSpace Portal that were assigned severity scores ranging from 3.1 to 8.1. In total, 35 vulnerabilities were detected, some of which could be exploited remotely and allowed remote code execution.

In January, a warning was issued about an insufficient session expiration vulnerability in IntelliSpace Cardiovascular that was assigned a CVSS v3 score of 6.7. Exploiting the vulnerability would require only a low skill level. If exploited, an attacker could gain access to sensitive patient information.

The post ICS-CERT Warns of Vulnerabilities in Philips IntelliSpace Cardiovascular Products appeared first on HIPAA Journal.

Microsoft ADFS Vulnerability Allows Bypassing of Multi-Factor Authentication

Posted by HIPAA Journal

A vulnerability has been discovered in Microsoft’s Active Directory Federation Services (ADFS) that allows multi-factor authentication (MFA) to be bypassed with ease. The flaw is being tracked as CVE-2018-8340 and was discovered by Andrew Lee, a security researcher at Okta.

ADFS is used by many organizations to help secure accounts and ADFA is used by vendors such as SecureAuth, Okta, and RSA to add multi-factor authentication to their security offerings.

To exploit the vulnerability an attacker would need to obtain the login credentials of an employee and have a valid second factor authentication token. That token could then be used as authentication to access any other person’s account if their username and password is known.

A threat actor could easily obtain a username and a password by conducting a phishing campaign. The number of phishing attacks on healthcare organizations that have been reported recently show just how easy it is to fool employees into disclosing their login credentials. A brute force attempt on an account with a weak password would also work.

Obtaining the second factor token is a little more difficult. The second factor is often a mobile phone number or email address or a smart card PIN number. That information could also potentially be obtained through phishing or through a successful attempt to get the IT help desk to reset a user’s MFA token.

The vulnerability would be easy to exploit by an insider, since that person would already have a valid MFA token registered on the system. All that would be required to access the account of another employee would be their username and password.

The vulnerability is due to the way ADFS communicates during a login. When an attempt is made to login, the server sends an encrypted context log which contains the MFA token. However, the context log does not include the username, so no check is performed to ensure the MFA token is being used by the correct individual. If an attacker used a browser to gain access to an account using a known username/password and MFA token, and a second browser with just a username and password but no MFA token, a single MFA token could be used to gain access to both accounts.

Two-factor authentication is an important security control that can prevent unauthorized account access even if a threat actor has successfully obtained login credentials, although this vulnerability shows that the system is not infallible.

The flaw has now been fixed in Microsoft’s Patch Tuesday updates on August 14. Healthcare organizations should ensure that the patch is applied promptly to ensure their MFA controls cannot be easily bypassed.

The post Microsoft ADFS Vulnerability Allows Bypassing of Multi-Factor Authentication appeared first on HIPAA Journal.

Vulnerabilities in Patient Monitors Allow Vital Signs to be Altered in Real Time

Posted by HIPAA Journal

A security researcher at McAfee (Douglas McKee) has identified a vulnerability in the communications protocol used by patient monitoring equipment. The flaw could be exploited by a threat actor allowing patients’ vital signs to be falsified and sent to central monitoring systems.

Patient monitors record patients’ vital signs and communicate the information to central monitoring systems. The central management systems collect data from many bedside patient monitors, allowing healthcare professionals to monitor multiple patients simultaneously. Information is usually sent over TCP/IP through wired or wireless connections and includes information such as blood pressure, blood oxygen levels, and heart rates. Decisions about treatment are made based on the information provided through those monitoring systems.

Vital signs are integral to clinical decision making. If vital signs are misreported, decisions could be made that could cause patients to come to harm – incorrect doses of medications could be provided, the choice of drug could be influenced by bad data, an incorrect diagnosis could be made, or there could be delays providing medical assistance.

Incorrect data could also lead to patients staying in hospital for far longer than necessary and additional unnecessary tests may be performed, which would come at a cost to the healthcare provider, insurer, or patient.

For the study, McAfee purchased a patient monitor and a central monitoring station on eBay that were manufactured in 2004 and ran Windows XP Embedded. While the devices were old, McAfee confirmed that the monitor and central monitoring station are still in use in several hospitals in the United States.

The researchers were able to create a simple device to emulate vital signs using a Raspberry Pi and conduct a replay attack. The researchers were able to send heart rate data to the central monitoring system indicating a steady heart rate of 80 bpm, when the patient monitor was no longer connected to the system. The researchers were able to do the same with other vital signs. This just involved a short loss in connection, which would likely go unnoticed.

For such an attack to be pulled off, the attacker would need access to the patient to disconnect the patient monitor and plug in the emulation device. The replay attack could allow normal heart rate data to be provided to the central monitoring station when the patient was actually flatlining.

The researchers were also able to devise an attack method that allowed vital signs data to be modified in real time. In this attack, access to the patient was not required. The attacker simply needed to be on the same network. The attacker posed as the central monitoring station, intercepted data from the targeted patient’s monitor, and then falsified the data and sent it to the real central monitoring station. This attack was possible due to a flaw in the Rwhat protocol that is used to send data over wired or Wi-Fi connections. Since data is sent over unencrypted User Datagram Protocol (UDP), data packets can easily spoofed and modified.

Conducting such an attack is not straightforward. Knowledge of the equipment and networking protocol is required, and the attack could only be performed on single or possibly small groups of patients. Some medical knowledge would be required, as the vital signs would need to be believable to a physician. The attack also only caused falsified data to be displayed on the monitoring station – The patient monitor continued to display the correct readings.

Such an attack may be unlikely but could be a threat for certain patients – Those testifying in trials or politicians for example.

If communications between patient monitors and central monitoring stations are encrypted and additional authentication checks are incorporated, such an attack would be much harder to pull off. It is also important for the equipment to be located on isolated networks with very strict access controls to reduce the potential for such an attack to occur.

The post Vulnerabilities in Patient Monitors Allow Vital Signs to be Altered in Real Time appeared first on HIPAA Journal.

Vulnerabilities in Fax Machines Can Be Exploited to Gain Network Access and Exfiltrate Sensitive Data

Posted by HIPAA Journal

Despite many alternative communication methods being available, healthcare organizations still extensively use faxes to communicate. Some estimates suggest as many as 75% of all communications occur via fax in the healthcare industry.

While fax machines would not rank highly on any list of possible attack vectors, new research shows that flaws in the fax protocol could be exploited to launch attacks on businesses and gain network access.

The flaws were detected by researchers at Check Point who successfully exploited them to create a backdoor into a network which was used to steal information through the fax. The researchers believe there are tens of millions of vulnerable fax machines are currently in use around the world.

To exploit the flaw, the researchers sent a specially crafted image file through the phone line to a target fax machine. The fax machine decoded the image and uploaded it to the memory and the researchers’ script triggered a buffer overflow condition that allowed remote code execution. The researchers were able to gain full control of the fax machine and, using the NSA exploits Eternal Blue and Double Pulsar, spread malware to a vulnerable PC that was connected to the same network.

The malware was programmed to search for files of interest. When a file was located, it was sent back to the Check Point via fax.

Check Point’s research was mainly focused on HP’s OfficeJet Pro all-in-one fax printers, although the same flaws exist in many other manufacturers’ fax machines including those manufactured by Epson and Canon. Check Point alerted HP to the issue, which has now been patched, although other manufacturers’ devices remain vulnerable. In many cases, software on the all-in-one-printers cannot be updated. Correcting the flaw will only be possible by upgrading to newer devices.

Check Point suggests all businesses that still use fax machines, including healthcare organizations, should determine whether their fax machines are capable of being updated and ensure all software is kept up to date. If updates are not possible, upgrading the devices is recommended and the printer-fax machines should be located on secure networks separate from those on which protected health information is stored.

While the research was focused on all-in-one printers, the researchers note that attacks would not be limited to those devices. Potentially, stand-alone fax machines could also serve as an entry point into a business network as could fax-to-mail services.

At this stage there have been no reports of this method of attack being used in the wild, although the Check Point researchers note it will only be a matter of time before others determine how the attacks can be conducted.

The post Vulnerabilities in Fax Machines Can Be Exploited to Gain Network Access and Exfiltrate Sensitive Data appeared first on HIPAA Journal.

APWG Detects 46% Rise in Phishing Websites in Q1, 2018

Posted by HIPAA Journal

The Anti-Phishing Working Group has released its Q1, 2018 Phishing Activity Trends Report which shows there was a substantial increase in unique phishing sites detected in the first few months of 2018 compared to the final quarter of 2017.

The report explores phishing attacks and methods used between January 1 and March 31, 2018.

In Q1, 263,538 unique phishing sites were identified – a 46% increase from the 180,577 unique sites identified in Q4, 2017 and a 38% increase from the 190,942 sites detected in Q3, 2017. There were 60,887 unique phishing sites detected in January 2018 which was on a par with December 2017, although a substantial increase in February (88,754) and a further major increase in March (113,897).

The number of unique phishing campaigns reported by APWG customers remained broadly the same in January (89,250) and February (89,010) with a slight fall in March (84,444). 235 brands were spoofed in January, rising to 273 in February, and falling to 238 in March.

APWG member MarkMonitor tracked the industry sectors that were most heavily targeted in phishing campaigns. Its figures show online payment services topped the list in Q1, 2018, accounting for 39% of all reported phishing attacks. Attacks involving SAAS and webmail providers accounted for 18.7% of the total, following by financial institutions (14.2%) and file hosting and cloud storage services on 11.3%.

As businesses have moved over to HTTPS sites, the phishers have followed. Each quarter has seen a substantial rise in the percentage of phishing sites that use HTTPS and secure the connection between the site and the browser. APWG member PhishLabs has been tracking the use of HTTPS on phishing sites and its figures show a third (33%) of all phishing sites were on HTTPS infrastructure in Q1, 2018 compared to just 10.5% in Q1, 2017.

Many consumers still believe that a website starting with HTTPS means the site is legitimate, when that is certainly not the case. It only means that the connection between the browser and the site is secured. If the site is owned by a phisher, or if a legitimate site has been hijacked, any information entered can be captured. Many phishers are registering their own domains and are taking advantage of the free SSL certificates that are offered to make their sites look more legitimate.

RiskIQ’s figures show that the phishing URLs used by phishers closely match TLD market share, with .com’s the most widely used TLD’s by phishers. .Coms accounted for 6,608 of the 13,594 unique domains used in phishing attacks in Q1, 2018. Those domains were widely distributed among different domain registrars.

Brazilian cybersecurity firm Axur provided a breakdown of internet-based attacks on individuals and companies in Brazil. The firm’s data show scam websites were the leading threat and accounted for 9,061 of the 17,065 attacks in Q1, 2018. They were followed by social media scams (4,209), mobile app scams (1,840) and phishing scams (1,816). 350 redirection URLs were detected that sent visitors to exploit kits and phishing sites and 257 URLs were being used to deliver malware.

The post APWG Detects 46% Rise in Phishing Websites in Q1, 2018 appeared first on HIPAA Journal.