Healthcare Cybersecurity

Verizon Data Breach Investigations Report Reveals 2021 Data Breach Trends

Posted by HIPAA Journal

For the past 15 years, Verizon has been publishing annual Data Breach Investigation Reports (DBIR), with this year’s report confirming just how bad the past 12 months have been. Verizon described the past 12 months as representing an unprecedented year in cybersecurity history. “From very well-publicized critical infrastructure attacks to massive supply chain breaches, the financially motivated criminals and nefarious nation-state actors have rarely, if ever, come out swinging the way they did over the last 12 months,” explained Verizon.

The 2022 DBIR was compiled in conjunction with 87 partner organizations using data from 23,896 security incidents, of which 5,212 were confirmed data breaches, 849 of the security incidents analyzed in the report occurred in the healthcare sector, with 571 of those incidents resulting in confirmed data breaches.

The report confirms there was a major increase in ransomware attacks in 2021, increasing 13% from the previous year. To add some perspective, the increase is greater than the combined increases over the previous five years. As Verizon points out in the report, ransomware is just a way of taking advantage of access to victims’ networks, but it has proven to be particularly successful at monetizing illegal access to networks and private information. Ransomware was involved in 25% of data breaches in 2021.

The most common vectors in ransomware attacks were the use of stolen credentials, mostly for desktop sharing software, which provided initial access in 40% of attacks. Phishing was the second most common vector in attacks, providing initial access in 35% of ransomware attacks followed by the exploitation of vulnerabilities in web applications and direct installs. The high percentage of attacks involving remote desktop software and email highlights the importance of locking down RDP and securing email.

The increase in ransomware attacks is alarming, as is the number of supply chain attacks, which account for 62% of system intrusions. Supply chain attacks may be conducted by financially motivated cyber actors, but oftentimes they are used by nation-state actors to gain persistent access to systems for espionage purposes.

Protecting against cyberattacks requires action to be taken to address the four main avenues that lead to initial access to networks being gained, which are credentials, phishing, exploitation of vulnerabilities, and botnets. While insiders can and do cause data breaches, by far the main cause is external actors. Breaches due to external actors outnumber insider breaches by four to 4. While external attacks are much more likely, the median number of records involved in insider breaches is far higher.

Human error continues to play a large part in data breaches. 13% of breaches involved misconfigurations, mostly of cloud storage facilities, and 82% of all data breaches analyzed in the past 12 months involved a human element. 25% of all breaches in 2021 were the result of social engineering attacks, highlighting not only the importance of implementing advanced email defenses but also providing regular security awareness training to the workforce.

The top three attack methods were the same as last year, albeit changing position. System intrusions took the top spot, followed by web application attacks, and social engineering. In healthcare, the leading causes of data breaches were web application attacks, miscellaneous errors, and system intrusions, which accounted for 76% of all data breaches.

Verizon reports that while insiders have long been a leading cause of data breaches in healthcare, the increase in web application attacks has meant external threats have overtaken insiders. Healthcare employees caused 39% of breaches in 2021, which is considerably higher than the 18% across all other industry sectors. While there will always be malicious insiders in healthcare, employees are 2.5 times more likely to make an error than to maliciously abuse their access to data, with misdelivery and loss the most common errors made in healthcare.

Healthcare data breach trends

Patterns in Healthcare data breaches. Source: Verizon DBIR 2022

 

The post Verizon Data Breach Investigations Report Reveals 2021 Data Breach Trends appeared first on HIPAA Journal.

HHS Shares Information on Advanced Persistent Threat Groups Linked with the Russian Intelligence Services

Posted by HIPAA Journal

The U.S. Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) has issued a threat brief providing information on the cyber organizations of the Russian Intelligence Services which pose a threat to organizations in the United States, including the healthcare and public health (HPH) sector.

The threat brief provides information on four key advanced persistent threat actors which conduct offensive cyber activities and espionage within the Russian Intelligence Services. These APT actors have been linked to the Federal Security Service (FSB), the Foreign Intelligence Service (SVR), and the Main Intelligence Directorate of the General Staff of the Armed Forces (GRU). The FSB is equivalent to the Federal Bureau of Investigation in the U.S and is mostly concerned with domestic intelligence and foreign intelligence from Russia’s near abroad. The SVR is equivalent to the U.S. Central Intelligence Agency (CIA) and collects foreign intelligence from military, strategic, economic, scientific, and technological targets. The GRU is the equivalent of the Defense Intelligence Agency (DIA) and collects foreign intelligence related to military issues through espionage and is also responsible for conducting destructive cyberattacks.

Turla

Turla, aka Venomous Bear/Iron Hunter/KRYPTON/Waterbug, operates under the direction of the FSB and mostly targets industries such as academic, energy, government, military, telecommunications, research, pharmaceutical companies, and foreign embassies, and has been active since at least 2004. The group is known to use malware and sophisticated backdoors and is mostly focused on diplomatic espionage activities in former Eastern Bloc countries, although was responsible for the attack on U.S. Central Command in 2008, G20 attendees in 2017, and the government computer network in Germany in 2018.

APT29

APT29, aka Cozy Bear, YTTRIUM, Iron Hemlock, and The Dukes, operates under the direction of the SVR and mostly targets the academic, energy, financial, government, healthcare, media, pharmaceutical, and technology industries and think tanks. The APT actor has been active since at least 2008 and uses a range of malware variants and backdoors. The APR actor mostly targets European and NATO countries and is known to conduct spear phishing campaigns to gain stealthy, long-term access to targets networks, and is especially persistent and focused on specific targets. The APT actor steals information but does not leak that information. APT29 is known to be behind the attack on the Pentagon in 2015, the SolarWinds Orion attack in 2020, and targeted COVID-19 vaccine developers during the pandemic.

APT28

APT28, aka Fancy Bear, STRONTIUM, Sofacy, Iron Twilight, operates under the direction of the GRU and has been active since 2004. APT28 targets the aerospace, defense, energy, government, healthcare, military, and media industries and dissidents. The group uses a variety of malware, a downloader for next-stage infections, and collects system information and metadata to distinguish real environments from sandboxes.

APT28 primarily targets NATO countries and is known to use password spraying, unique malware, phishing and credential harvesting, and tends to conduct noisy rather than stealthy attacks. The group steals and leaks information to further Russia’s political interests. The group was behind the attack on the World Anti-Doping Agency in 2016, the cyberattack and leaking of data from the U.S. Democratic National Committee and the Clinton Campaign in 2016, and the German and French Elections in 2016 and 2017.

Sandworm

Sandworm, aka Voodoo Bear, ELECTRUM, IRIDIUM, Telebots, and Iron Viking, operates under the direction of the GRU and has been active since at least 2007. Sandworm mainly targets the energy and government sectors and is the most destructive of all ‘Bear’ threat groups. SAndworm targets ICS and computer systems for destructive purposes, such as conducting wiper malware attacks, especially in Ukraine. The group appears unconcerned with 2nd and 3rd order effects of attacks, such as those of NotPetya, and uses malware such as BadRabbit, BlackEnergy, GCat, GreyEnergy, KillDisk, NotPetya, and Industroyer.

Sandworm was behind the multiple attacks on the Ukrainian government and critical infrastructure in 2015-2016 and 2022, attacks on Georgian websites before the Russian Invasion in 2008, and the NotPetya attacks in 2017.

Mitigations

The tactics, techniques, procedures, and malware used by each of these groups are diverse, but some mitigations can be implemented to improve resilience and block the main attack vectors. These are detailed in the HC3 report and include updating software, patching promptly, enforcing MFA, segmenting networks, and reviewing CVEs for all public-facing systems.

The post HHS Shares Information on Advanced Persistent Threat Groups Linked with the Russian Intelligence Services appeared first on HIPAA Journal.

CISA Issues Emergency Directive to Patch Vulnerable VMWare Products

Posted by HIPAA Journal

An emergency directive has been issued by the Cybersecurity and Infrastructure Security Agency (CISA) to all federal agencies, requiring them to take steps to address two vulnerabilities in certain VMware products that are likely to be rapidly exploited in the wild, and two previous vulnerabilities in VMWare products that were disclosed in April which are being exploited by multiple threat actors, including Advanced Persistent Threat (APT) actors.

The latest vulnerabilities, tracked as CVE-2022-22972 (critical) and CVE-2022-22973 (high severity), and the two vulnerabilities from April affect 5 VMWare products:

  • VMware Workspace ONE Access (Access) Appliance
  • VMware Identity Manager (vIDM) Appliance
  • VMware vRealize Automation (vRA)
  • VMware Cloud Foundation
  • vRealize Suite Lifecycle Manager

CVE-2022-22972 is an authentication bypass vulnerability affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation that affects local domain users. If a malicious actor has network access to the UI, the flaw can be exploited to gain administrative access without authentication. The vulnerability has been assigned a CVSS severity score of 9.8 out of 10.

CVE-2022-22973 is a local privilege escalation vulnerability in VMware Workspace ONE Access and Identity Manager with a CVSS severity score of 7.8. If a malicious actor has local access, the flaw can be exploited to escalate privileges to root. Both flaws also affect VMware Cloud Foundation and vRealize Suite Lifecycle Manager.

The two vulnerabilities known to have been exploited in the wild are tracked as CVE 2022-22954 (critical) and CVE 2022-22960 (high severity). CISA says both vulnerabilities have been exploited in real-world attacks, individually and in combination, by multiple threat actors.

CVE 2022-22954 is a code injection vulnerability with a CVSS score of 9.8 that affects VMware Workspace ONE Access and Identity Manager products. Exploitation of the flaw allows threat actors to trigger server-side template injection, which can lead to remote code execution. CVE 2022-22960 is an improper privilege management issue with a CVSS score of 7.8 that affects VMware Workspace ONE Access, Identity Manager, and vRealize Automation products, and allows threat actors to escalate privileges to root.

In one attack, a threat actor with network access to the web interface exploited CVE 2022-22954 to execute a shell command as a VMWare user, then exploited the second flaw to escalate privileges to root. After exploiting both flaws, the threat actor could move laterally to other systems, escalate permissions, and wipe logs. In another case, a threat actor deployed the Dingo-J-spy web shell after exploiting the flaws. Exploits for the two April vulnerabilities were developed by reverse-engineering the patches released by VMWare. Now patches have been released to fix the latest two vulnerabilities, similarly rapid exploitation of the flaws in the wild can be expected.

While the emergency directive only applies to Federal agencies, all organizations that are using vulnerable VMWare products should patch immediately or implement the recommended mitigations. The deadlines for Federal agencies to complete the required actions are May 23 and May 24, 2022.

The post CISA Issues Emergency Directive to Patch Vulnerable VMWare Products appeared first on HIPAA Journal.

Cybersecurity Agencies Share Most Common Attack Vectors for Initial Access and Recommended Mitigations

Posted by HIPAA Journal

According to a recent security advisory issued by the Five Eyes Cybersecurity agencies in the US, UK, Canada, Australia, and New Zealand, the most common attack vectors used by cyber threat actors for initial access to networks are exploits of public-facing applications, external remote services, trusted relationships, phishing, and compromised credentials for valid user accounts.

These attack methods often succeed due to poor security practices, bad cyber hygiene, weak controls, and poor security configurations. The security advisory details the most commonly exploited controls and practices and provides recommendations for mitigations to strengthen security and block these attack vectors.

Top 10 Security Weaknesses Exploited by Hackers

The top ten security weaknesses exploited by hackers consist of poor security practices, weak security controls, and misconfigurations and unsecured systems, which allow the most common attack vectors to be used.

Slow software updates and patching

The failure to update software promptly and apply patches for known vulnerabilities gives attackers a window of opportunity for exploiting the vulnerabilities. Exploits for vulnerabilities are often released publicly within days or weeks. Vulnerabilities can be exploited to gain access to sensitive information, conduct denial-of-service attacks, or take full control of vulnerable systems. Slow patching is one of the commonest poor security practices.

Open ports and misconfigurations that expose services to the Internet

Another commonly identified vulnerability is the failure to close open ports. Hackers continuously scan for open ports and misconfigured services that expose systems to the Internet. The compromising of these services can provide attackers with initial access. RDP, Server Message Block (SMB), Telnet, and NetBIOS are high-risk services.

Failure to enforce multifactor authentication

Multifactor authentication should be enforced on all accounts to block attempts to use stolen credentials. This is especially important for Remote Desktop Protocol, other remote services, and accounts with administrative privileges. The lack of multifactor authentication for RDP is commonly exploited in ransomware attacks.

Use of default credentials and configurations

The failure to change default credentials provides attackers with easy access, as default credentials are often in the public domain. Default configurations are typically excessively permissible to ensure they are user-friendly, and the failure to change configurations can give attackers an avenue for exploitation.

Insufficient controls for remote access

Remote services are commonly targeted by threat actors who exploit a lack of sufficient authentication controls, such as no multifactor authentication. In addition to enforcing MFA, network defenders should consider implementing a boundary firewall in front of a VPN and IDS/IPS sensors to detect anomalous activity.

Incorrectly applied privileges or permissions, and errors within access control lists

Incorrectly applied privileges or permissions can prevent access control rules from being enforced, which could allow system processes or unauthorized users to be granted access to objects.

Poor password policies

Many different methods can be used to exploit weak, leaked, or compromised passwords to access victims’ systems. Policies should be set and enforced requiring strong, unique passwords to be used. Weak RDP passwords are commonly exploited.

Unprotected cloud services

Misconfigurations and poor security configurations can leave cloud services unprotected, giving threat actors easy access to sensitive data and permitting cryptojacking using cloud servers.

Insufficient phishing defenses

Phishing is one of the leading ways that threat actors gain a foothold in networks. Email security solutions should be used that have strong antivirus controls, use behavioral analysis to identify malware, and have the capability to scan embedded links. Security awareness training should be regularly provided to the workforce.

Poor endpoint detection and response

Endpoint detection solutions should be implemented that go beyond signature-based detection methods as threat actors commonly use obfuscated malicious scripts and PowerShell to bypass endpoint security solutions such as antivirus software.

Suggested Mitigations

The security alert includes several mitigations that can help network defenders strengthen security and protect against these commonly exploited weak security controls and practices. The suggested mitigations are concerned with controlling access, credential hardening, establishing centralized log management, deploying antivirus and other detection tools, conducting vulnerability scans, establishing a robust patch management program, and maintaining a rigorous configuration management program.

The post Cybersecurity Agencies Share Most Common Attack Vectors for Initial Access and Recommended Mitigations appeared first on HIPAA Journal.

Five Eyes Intelligence Alliance Warns of Increase in Cyberattacks Targeting Managed Service Providers

Posted by HIPAA Journal

The Five Eyes intelligence alliance, which consists of cybersecurity agencies from the United States, United Kingdom, Australia, New Zealand, and Canada, has issued a joint alert warning about the increasing number of cyberattacks targeting managed service providers (MSPs).

MSPs are attractive targets for cybercriminals and nation-state threat actors. Many businesses rely on MSPs to provide information and communication technology (ICT) and IT infrastructure services, as it is often easier and more cost-effective than developing the capabilities to handle those functions internally.

In order to provide those services, MSPs require trusted connectivity and privileged access to the networks of their clients. Cyber threat actors target vulnerable MSPs and use them as the initial access vector to gain access to the networks of all businesses and organizations that they support. It is far easier to conduct a cyberattack on a vulnerable MSP and gain access to the networks of dozens of businesses than to target those businesses directly.

When MSP systems are compromised, it may take several months before the intrusion is detected, during which time threat actors may conduct cyber espionage on the MSP and its customers or prepare for other follow-on activities such as ransomware attacks.

The Five Eyes agencies provide recommendations for baseline security measures that MSPs and their customers should implement and also recommend customers review their contracts with MSPs to ensure that the contracts specify that their MSPs must implement the recommended measures and controls.

Steps need to be taken to improve defenses to prevent the initial compromise. Cyber threat actors commonly exploit vulnerable devices and Internet-facing services and conduct phishing and brute force attacks to gain a foothold in MSP networks. The Five Eyes agencies recommend MSPs and their customers:

  • Improve the security of vulnerable devices
  • Protect internet-facing services
  • Defend against brute force and password spraying
  • Defend against phishing

It is vital to enable or improve monitoring and logging processes to allow intrusions to be rapidly detected. Since threat actors may compromise networks for months, all organizations should store their most important logs for at least six months. “Whether through a comprehensive security information and event management (SIEM) solution or discrete logging tools, implement and maintain a segregated logging regime to detect threats to networks,” suggest the agencies in the alert.

It is important to secure remote access applications and enforce multi-factor authentication as far as possible, and ensure MFA is implemented on all accounts that allow access to customer environments. Customers of MSPs should ensure that their contracts state that MFA must be used on accounts that are used to access their systems.

The Five Eyes agencies also suggest

  • Managing internal architecture risks and segregating internal networks
  • Applying the principle of least privilege
  • Deprecating obsolete accounts and infrastructure
  • Applying software updates and patches promptly
  • Backing up systems and data regularly and testing backups
  • Developing and exercising incident response and recovery plans
  • Understanding and proactively managing supply chain risk
  • Promoting transparency
  • Managing account authentication and authorization

MSPs and their customers will have unique environments, so the recommendations should be applied as appropriate in accordance with their specific security needs and appropriate regulations.

The post Five Eyes Intelligence Alliance Warns of Increase in Cyberattacks Targeting Managed Service Providers appeared first on HIPAA Journal.

Bill Introduced that Seeks to Improve Medical Device Cybersecurity

Posted by HIPAA Journal

A new bill has been introduced that seeks to address the cybersecurity of medical devices that will require manufacturers of medical devices to meet certain minimum standards for cybersecurity for the entire lifecycle of the products.

The medical device cybersecurity provisions of the bill – H.R. 7667 Food and Drug Amendments of 2022 – call for device manufacturers to “have a plan to appropriately monitor, identify, and address in a reasonable time postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and procedures,” and to “design, develop, and maintain processes and procedures to ensure the device and related systems are cybersecure.”

The processes and procedures should include making “updates and patches available to the cyber device and related systems throughout the lifecycle of the cyber device.” Those patches and updates are required on a reasonably justified regular cycle to address known vulnerabilities, and, as soon as possible out of cycle, to address critical vulnerabilities that could cause uncontrolled risks.

The bill also calls for manufacturers of medical devices to provide a cyber device software bill of materials in the labeling that states all commercial, open-source, and off-the-shelf software components that have been used in the devices, and manufacturers will need to comply with other requirements that may be introduced, such as being able to “demonstrate reasonable assurance of the safety and effectiveness of the device for purposes of cybersecurity.”

H.R. 7667 was proposed by Rep. Anna Eshoo, (D-CA), and was co-sponsored by Reps. Brett Guthrie, (R-KY), Frank Pallone, (D-NJ), and Cathy McMorris Rogers, (R-WA), and has now been referred to the House Committee on Energy and Commerce. The bill would amend the Food, Drug, and Cosmetic Act and extend the FDA user fee programs, which require manufacturers to pay fees when submitting applications to the FDA for product reviews. The amendments would extend the fee program to cover medical devices, prescription drugs, generic drugs, and other similar biological products.

Several bills have been introduced recently that seek to improve the cybersecurity of medical devices such as the PATCH Act, which was introduced by U.S. Senators Bill Cassidy, M.D. (R-LA) and Tammy Baldwin (D-WI) in March 2022. The PATCH Act also seeks to amend the Federal Food, Drug, and Cosmetic Act and requires all premarket submissions for medical devices to include details of the cybersecurity protections that have been implemented.

There is a clear need for changes to be made to current legislation to require medical device manufacturers to address cyber risks. The security of medical devices has attracted considerable attention of late due to the risk of vulnerabilities being exploited by cyber actors to gain access to healthcare networks, conduct denial-of-service attacks, and deliberately or inadvertently cause harm to patients.

While the FDA has published updated guidance for medical device manufacturers that includes recommendations for improving cybersecurity throughout the entire lifecycle of medical devices, they are only recommendations and are therefore non-binding.

The post Bill Introduced that Seeks to Improve Medical Device Cybersecurity appeared first on HIPAA Journal.

HC3 Highlights Trends in Ransomware Attacks on the HPH Sector

Posted by HIPAA Journal

The tactics, techniques, and procedures (TTPs) used by ransomware and other cyber threat actors are constantly evolving to evade detection and allow the groups to conduct more successful attacks. The TTPs employed in the first quarter of 2022 by ransomware gangs have been analyzed and shared by the Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3).

In Q1, 2022, the majority of ransomware attacks on the Healthcare and Public Health Sector (HPH) were conducted by five ransomware-as-a-service groups. LockBit 2.0 and Conti each accounted for 31% of attacks, followed by SunCrypt (16%), ALPHV/BlackCat (11%), and Hive (11%). The financially motivated threat groups FIN7 and FIN12 have also shifted their activities and have moved to ransomware operations, with FIN7 working with ALPHV and FIN12 extensively involved in attacks on the HPH sector. FIN12’s involvement has decreased the timescale for conducting attacks from 5 days to 2 days.

Ransomware gangs often work with initial access brokers (IABs) that specialize in gaining access to organizations’ networks, then sell the access to the ransomware gangs. The use of IABs helps ransomware gangs concentrate on developing their ransomware variants and running their RaaS operations, which allows them to work on their TTPs and conduct more successful attacks. HC3 has not observed any change in the numbers of IABs working with ransomware gangs in Q1, 2022, with similar numbers observed as throughout 2022.

IABs were most commonly observed advertising general VPN/RDP access to the networks of HPH entities on cybercrime forums, which accounted for more than half of forum adverts, and around 25% of advertisements were offering compromised Citrix/VPN appliances. Remote access solutions were extensively implemented by organizations to support a remote workforce during the COVID-19 pandemic, but the rush to deploy meant basic security features were not implemented, and vulnerabilities have been extensively exploited.

Ransomware gangs are increasingly using living-of-the-land (LOTL) techniques in their attacks, utilizing legitimate tools that are already available in the environments of large organizations during ransomware attacks such as CMD.exe, PowerShell, Task Scheduler, MSHTA, and Sysinternals. The use of these tools makes the malicious activities of the gangs harder to detect.

Tactics include the use of remote access tools such as AnyDesk, Windows Safe Mode, Atera, ScreenConnect, ManageEngine, encryption tools such as BitLocker and DiskCryptor, file transfer tools including FileZilla FTP, Microsoft Sysinternals tools such as PsExec, Procdump, and Dumpert, and open-source tools such as Cobalt Strike, Mimikatz, AdFind, Process Hacker, and MegaSync.

While the malicious use of these tools is difficult to detect by security teams, there are detection opportunities. HC3 recommends using a behavior-based approach to detection, such as a Security Information and Event Management (SIEM) tool, which can detect malicious use of LOTL tools which signature-based detection tools cannot.

The HC3 Ransomware Trends in the HPH Sector Report provides detailed information on the TTPs employed by each ransomware operation, including the most commonly abused LOTL tools, relevant ATT&CK techniques, and a long list of mitigations that can be implemented to prevent, detect, respond to, and recover from ransomware attacks.

The post HC3 Highlights Trends in Ransomware Attacks on the HPH Sector appeared first on HIPAA Journal.

NIST Published Updated Cybersecurity Supply Chain Risk Management Guidance

Posted by HIPAA Journal

On Thursday, the National Institute of Standards and Technology (NIST) published updated cybersecurity supply chain risk management (C-SCRM) guidance to help organizations develop an effective program for identifying, assessing, and responding to cybersecurity risks throughout the supply chain.

Cyber threat actors are increasingly targeting the supply chain. A successful attack on a single supplier can allow the threat actor to compromise the networks of all companies that use the product or service, as was the case with the REvil ransomware attack on Kaseya in 2021. The threat actors exploited a vulnerability in Kaseya VSA software and the attack affected up to 1,500 businesses.

The publication, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST Special Publication 800-161 Revision 1), is the result of a multiyear process that included the release of two draft versions of the guidance. The updated guidance can be used to identify, assess, and respond to cybersecurity risks throughout the supply chain at all levels of an organization.

While organizations should consider vulnerabilities in the finished product they are considering using, the guidance also encourages them to consider the security of components of the project, which may include open source code or components developed by third parties. A product or device may have been designed in one country, manufactured in another, and incorporate components from many other countries, which in turn may have been assembled from parts provided by disparate manufacturers. Malicious code may have been incorporated into components, and vulnerabilities may have been introduced that could be exploited by cyber threat actors. The guidance encourages organizations to consider the journey that each of the components took to reach their destination.

The guidance is aimed at acquirers and end users of products, software, and services. Since the guidance is intended to be used by a wide audience, user profiles are included that explain which sections of the guidance are most relevant for each group. “The publication integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on the development of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services,” explained NIST.

The guidance can be used to build cybersecurity supply chain risk considerations and requirements into acquisition processes and create a program for continuously monitoring and managing supply chain risks.

“Managing the cybersecurity of the supply chain is a need that is here to stay,” said NIST’s Jon Boyens, one of the authors of the publication. “If your agency or organization hasn’t started on it, this is a comprehensive tool that can take you from crawl to walk to run, and it can help you do so immediately.”

The post NIST Published Updated Cybersecurity Supply Chain Risk Management Guidance appeared first on HIPAA Journal.

Average Ransom Payment Dropped by 34% in Q1, 2022

Posted by HIPAA Journal

The average ransom payment in ransomware attacks fell by 34% in Q1, 2022, from an all-time high in Q4, 2021, according to ransomware incident response firm Coveware. The average ransom payment in Q1, 2022 was $211,259 and the median ransom payment was $73,906.

The fall in total ransom payments has been attributed to several factors. Coveware suggests ransomware gangs have been targeting smaller organizations and issuing lower ransom demands, due to the increased scrutiny by law enforcement when attacks are conducted on large enterprises. The median company size has been falling since Q4, 2020, and is now companies with around 160 employees. This appears to be the sweet spot, where the companies have sufficient revenues to allow sizable ransoms to be paid, but not so large that attacks will result in considerable scrutiny by law enforcement.

Another reason why total ransom payments have fallen is fewer victims of ransomware attacks have been paying the ransom. The number of victims of ransomware attacks that pay the ransom has been steadily declining, from 85% of victims in Q1 2019 to 46% of victims in Q1, 2022. Also, some of the most prolific ransomware operations have gone quiet, such as Maze and REvil (Sodinokibi).

Conti and LockBit are the most prolific ransomware operations, accounting for 16.1% and 14.9% of ransomware attacks respectively, followed by BlackCat/Alphv (7.1%), Hive (5.4%), and AvosLocker (4.8%). Coveware suggests that the affiliates who work with ransomware-as-a-service operations appear to be less keen to work with large RaaS groups, as those groups are often targeted by law enforcement. It is now common for affiliates to try smaller RaaS operations or even develop their own ransomware variants from leaked source code.

The most common attack vectors in ransomware attacks are phishing, Remote Desktop Protocol connections, and exploiting unpatched vulnerabilities in software and operating systems. Coveware has tracked an increase in other attack vectors since Q2, 2021, such as social engineering and the direct compromising of insiders. Social engineering attacks are similar to phishing but are highly targeted and often involve priming or grooming targeted employees before convincing them to provide access to the network. There has also been an increase in lone wolf attackers. Coveware identified the trend in late 2021, and it has continued throughout Q1, 2022. Attacks by these threat actors are often conducted on companies that have far better security than the average ransomware victim, such as multi-factor authentication properly enabled for all employees and critical resources.

In late 2019, the Maze ransomware operation started using double extortion tactics, where data is stolen from victims before files are encrypted. Payment must then be made for the decryptor and to prevent the publication or sale of stolen data. These tactics were rapidly adopted by many ransomware operations and became the norm, although there was a decline in attacks involving encryption and extortion in Q1, 2022. Double extortion was used in 84% of attacks in Q4, 2021, and 77% of attacks in Q1, 2022. While double extortion is likely to continue to be extensively used in attacks for the foreseeable future, Coveware expects the shift from data encryption to data extortion to continue, as data theft and naming and shaming victims are less likely to attract the attention of law enforcement. “Data theft without encryption results in no operational disruption but preserves the ability of the threat actor to extort the victim. We expect this shift from Big Game Hunting to Big Shame Hunting to continue,” explained Coveware in the report.

Coveware warned about paying the ransom to prevent the publication or sale of data, as there are no guarantees that payment will result in data deletion. In 63% of attacks where a ransom was paid to prevent publication or sale of stolen data, the attackers provided no proof of data deletion. In the remaining attacks where proof was provided, it could easily have been faked. When videos, screenshots, live screen shares, or deletion logs are provided as proof, victims must trust that a copy of the data has not been made. “In one notable case, we observed a threat actor explicitly state that they would not be deleting the stolen data if paid, and would keep it for future leverage against the victim,” said Coveware.

The post Average Ransom Payment Dropped by 34% in Q1, 2022 appeared first on HIPAA Journal.