A recent Ponemon Institute study has delved into the use and effectiveness of security analytics solutions. The study shows that while security analytics solutions can help organizations improve their security posture, there are many challenges with both deployment and day to day use.

The purpose of the study was to find out how – and how much – these solutions are helping organizations and where they are failing.

The study, which was sponsored by analytics firm SAS, was conducted on 621 IT and IT security professionals in the United States that are involved with security analytics in their respective organizations. 87% of respondents said they personally used security analytics solutions in their organization, while 80% of respondents said those solutions were fully deployed.

Most commonly, security analytics solutions are deployed after a cyberattack has been suffered. 68% of organizations said an attack was the main driver for implementing an analytics solution. 53% said it was fear of a cyberattack or a successful intrusion that spurred them to start using an analytics solution, while 44% said they deployed an analytics solution to meet compliance requirements.

The most common analytics solutions are tools that have been developed in house, which are used by half of organizations, while a Security Information and Event Management (SIEM) solution was used by 47% of respondents. Those solutions were deployed on premise and in the cloud by 40% of respondents. 33% said they only used the solution on premise, while 23% only used the solution in the cloud.

There are clear benefits to using a security analytics solution, although deployment is challenging. The solutions require extensive configuration and tuning before they are effective. 56% of respondents said they found deployment difficult or very difficult.

Other major problems were the sheer volume of data that needs to be analyzed – a problem for 51% of respondents – and getting access to the necessary data – rated as a problem by 45% of respondents.

Once access to the required data has been achieved, the challenges do not stop. 66% of respondents said they experienced problems with data quality, while integrating data was an issue for 65% of respondents.

The main purpose of security analytics solutions is to gain insight into security events as they happen. 72% of respondents wanted to see what was happening now, while 69% said they used the solutions to find out about past security events. 65% of respondents used the solutions to provide advance warnings about potential internal and external threats.

That said, many respondents were failing to detect the threats they most wanted to find. Half of respondents wanted their analytics solutions to detect data exfiltration, yet only 33% of respondents said their solution had that capability. 40% said they wanted to use their solution for adversary reconnaissance, but only 35% said their solution was capable of providing that information. 36% wanted their solution to detect lateral network movement, yet only 31% of respondents said their solution provided that information. Detecting malicious insiders and internal threats was important for 36% of respondents, yet only 23% said their solution had the necessary capability.

Information is needed quickly for it to be most beneficial, yet only 28% said their solution could provide information in real time or every few minutes. 40% of respondents said their solution only provided data hourly or daily.

The overwhelming feeling was the use of security analytics solutions had helped to improve security posture. One of the most important benefits was the reduction in false positives when analyzing anomalous traffic. Before the solutions were deployed, 80% of respondents said it was difficult to reduce false positives, although that figure fell to one third after a security analytics solution had been deployed.

There may be many challenges with deploying and using security analytics solutions, but 61% of organizations said their solution was critical to their cyber defenses. 71% of respondents said their organization is planning on increasing the use of security analytics in the next 12 months.

“Security analytics clearly isn’t as effective as security practitioners need it to be,” said Stu Bradley, Vice President of Cybersecurity Solutions at SAS. That said, “building analytic sophistication ultimately pays off in improving organizations’ ability to discover, detect, investigate and respond to security events in a reliable, repeatable way.”

As for the challenges in deploying security analytics solutions, Bradley offered some helpful advice

“Nearly all solutions require initial configuration and tuning for optimal performance,” however, “organizations can avoid many pitfalls by clearly defining workflows and project goals before starting an implementation.”

The post Security Analytics Solutions Can Improve Security Posture, but there are Challenges appeared first on HIPAA Journal.

The healthcare system in the United States has suffered a barrage of cyberattacks in recent years and there is no sign that those attacks will ease. In all likelihood, attacks will increase in both number and severity.

To counter the increased threat, healthcare organizations, government agencies, the private sector, and international network defense communities must collaborate, says the Department of Health and Human Services’ Office for Civil Rights in its February newsletter.

It is the responsibility of healthcare organizations to keep abreast of the latest cyber threats to enable them to take timely action to mitigate risk. Threat intelligence is available from many organizations, although as a minimum, healthcare organizations should be regularly checking the cyber threats published by the United States Computer Emergency Readiness Team (US-CERT).

OCR explains that US-CERT – one of the four branches of the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) – provides actionable threat intelligence to the public and private sector, government agencies and critical infrastructure owners. US-CERT collects and analyses its own data, but also intelligence submitted by its partners.

Information on the latest threats is published on its website, along with recently discovered vulnerabilities, mitigations for known vulnerabilities, and details of the latest patches. Organizations can also sign up for e-mail alerts from US-CERT via its website.

The value of the information provided by US-CERT was highlighted by a report on Grizzly Steppe activity, published on February 10, 2017. Grizzly Steppe is the name given to a campaign run by Russian civilian and military intelligence services targeting the U.S government and private sector organizations, including healthcare organizations. The activity report details the methods used by the threat actors to gain access to systems along with techniques that can be adopted to mitigate the threat and defend against spear phishing and webshell attacks.

Armed with this information and intelligence on other network and data security threats, healthcare organizations can ensure action is taken to counter threats to the confidentiality, integrity, and availability of ePHI. OCR recommends US-CERT reports and alerts should be obtained by all covered entities and their business associates as part of the HIPAA Security Management Process.

Healthcare organizations should also play a part in improving awareness of the latest cybersecurity threats by sharing reports of suspicious activity with US-CERT. OCR suggests “Covered entities should report to US-CERT any suspicious activity, including cybersecurity incidents, cyber threat indicators and defensive measures, phishing incidents, malware, and software vulnerabilities.”

While threat intelligence and details of security incidents should be submitted, covered entities are not permitted to share any ePHI with US-CERT unless the disclosure is otherwise permitted under HIPAA Rules (Details of allowable disclosures of ePHI are available on this link).

The post OCR Urges Covered Entities to Monitor and Report Cyber Threats appeared first on HIPAA Journal.

The 2017 Thales data threat report published earlier this week shows the healthcare industry is responding to the increased threat of data breaches and cyberattacks by committing more funds to improving cybersecurity defenses.

After two record breaking years of healthcare data breaches – 2015 in terms of the number of records exposed or stolen, and 2016 in terms of the number of breaches reported – it is clear that the healthcare industry is under attack.

2016 also saw a record number of settlements reached with the Department of Health and Human Services’ Office for Civil Rights. Last year there were 12 HIPAA settlements and one Civil Monetary Penalty issued to resolve HIPAA violations discovered during healthcare data breach investigations.

Healthcare organizations are certainly feeling the heat. In the US, 90% of healthcare organizations feel vulnerable to data threats. There was also a 2% increase in the number of healthcare organizations that experienced a data breach in the past 12 months. 20% said they had a data breach in the past 12 months and 55% of healthcare organizations say they have had a historic data breach.

In the past, the healthcare industry has lagged behind other industry sectors when it comes to cybersecurity. That is now starting to change. Healthcare organizations have responded to the increased threat level by committing more funds to their cybersecurity programs; considerably more this year than other industry sectors.

Last year, only 60% of healthcare organizations increased cybersecurity spending. According to the Thales threat report, 81% of healthcare organizations will be increasing their cybersecurity budgets this year, compared to the overall industry average of 73% and the global healthcare industry average of 76%.

94% of healthcare organizations are now using advanced technologies to protect sensitive data. 61% use SAAS, 50% IAAS, 39% PAAS, 59% use Big Data, 19% use containers, and 5% are now using blockchain.

The biggest spending priorities for healthcare organizations is to comply with industry regulations. 57% of healthcare organizations say their main spending priority is compliance, 40% say it is to prevent data breaches, 34% say it is to adopt best practices, and 27% say spending has increased in response to increased cloud use.

How is the money going to be spent? 69% of healthcare organizations are increasing spending on network security, 61% are investing in endpoint and mobile protection measures, 62% are increasing spending on analysis and corrections, 51% on technologies to protect data in motion, and 47% on technologies to protect data at rest.

92% of healthcare organizations believe network security is very or extremely effective at preventing data breaches – and increase of 14% year on year – while 67% believe endpoint protection is very or extremely effective – an increase of 3% year on year.

Garrett Bekker, Senior analyst at 451 Research points out that healthcare organizations need to think carefully about the technologies they use to keep data secure, “Oorganizations keep spending on the same solutions that worked for them in the past but aren’t necessarily the most effective at stopping modern breaches.” Bekker also said “Spending on securing internal networks from external threats is less and less effective – and relevant – as both the data and the people accessing it are increasingly external.”

When it comes to barriers preventing the adoption of better cybersecurity defenses, 53% said complexity is a major issue. 39% said they lack the staff to manage those defenses, 36% said performance concerns, 33% lack the budget, while 26% said they lacked organizational buy in.

48% of healthcare organizations believe cybercriminals are the main external threats, but internal threats are also a major concern. Privileged users are rated as the biggest internal threat according to 61% of organizations, followed by executive management (46%), contractors (33%) and service providers (26%).

Peter Galvin, VP of strategy, Thales e-Security says “For healthcare data to remain safe from cyber exploitation, security strategies need to move beyond laptops and desktops to encompass an ‘encrypt everything’ approach that best suits a world of internet-connected heart-rate monitors, implantable defibrillators and insulin pumps. Adhering to the security status quo will create vulnerabilities that lead to breaches, and further erode customer trust.”

The post 81% of U.S. Healthcare Organizations Have Increased Security Spending in 2017 appeared first on HIPAA Journal.

In 2015, security researchers discovered MEDJACK malware: A form of malware developed specifically to attack medical devices such as heart monitors, MRI machines, and insulin pumps. While medical devices have long been a potential target for cybercriminals, until the discovery of MEDJACK, the threat of cyberattacks on medical devices was largely theoretical.

While MEDJACK could have been a one off, evidence emerged suggesting it was being actively developed. A second version of the malware – discovered last summer – was being used for advanced persistent attacks on hospitals via medical devices running on legacy systems.

Vulnerable medical devices were being used as a springboard to gain access to networks used to store the electronic protected health information of patients. TrapX security discovered that at least three attacks on healthcare providers had occurred using MEDJACK.2 by the summer of 2016.

MEDJACK.2 was capable of bypassing security controls as the malware used was old and was no longer deemed to be a threat by security solutions. More recent versions of Windows were protected against attacks using the malware so in many cases no alarms were triggered.

However, the attackers simply used an old malware wrapper to hide a range of cybersecurity tools. Tools that enabled them to install backdoors and move laterally within healthcare networks virtually undetected.

Now, security researchers at TrapX have discovered a third version of the malware. MEDJACK.3 is even more advanced and poses an even bigger threat to hospitals. The new version of the malware was discovered during an investigation of the medical infrastructure at ten UK hospitals.

As part of the investigation, TrapX created a number of fake medical devices such as MRI scanners. They noticed that those devices were being probed and that attackers were using a new method to discover and infect devices. While the method was new to MEDJACK, it had been seen before – many years previously. The attackers were using an old malware spreader to find and attack devices on older operating systems.

According to Anthony James, VP of marketing at TrapX, “Attackers are leveraging legacy malware-spreading tools that bypass a lot of today’s operating systems and target older systems.” The latest attacks are more targeted, with the attackers searching for specific devices that can be attacked rather than the more random approach seen last year.

Any device connected to an older, unpatched operating system was discovered to be vulnerable to attack and would accept the hacker’s tools. That included older operating systems such as Windows XP and Windows Server 2003, but also Windows 2008 and 2012. As was the case with MEDJACK.2, because the malware used was not perceived to pose a threat, the hackers were able to infect devices undetected.

TrapX has warned that many healthcare providers may already have been attacked with MEDJACK.3 and access may have been gained to their medical devices; possibly also the networks to which those devices are connected.

TrapX will be releasing a new white paper on MEDJACK.3 shortly.

The post Beware of Medical Device Hijack Attacks! Medjack.3 Discovered appeared first on HIPAA Journal.