The healthcare industry experiences more than its fair share of phishing attacks. Each week, several phishing attacks are reported by healthcare organizations that have resulted in the exposure or theft of protected health information. In the majority of cases, those attacks could be prevented by following basic cybersecurity best practices.

Cyberattacks are becoming more sophisticated, but the majority of attacks are not. They involve the use of default and commonly used passwords in brute force attacks or basic phishing emails.

Brute force attacks can be thwarted by creating and enforcing strong password policies. It should not be possible for users to use dictionary words as passwords or commonly used weak passwords such as 12345678. Accounts are also commonly breached due to password re-use. Figures from Microsoft suggest 73% of users duplicate passwords on work and personal accounts. If a personal account is breached, the password can be used to access the user’s work account.

Many phishing emails succeed in bypassing anti-spam defenses. A recent report from Avanan suggests as many as 25% of phishing emails are not blocked by Exchange Online Protection (EOP) – Microsoft’s default anti-phishing control for Office 365. It is therefore essential for additional controls to be implemented to prevent those messages from resulting in a data breach.

All employees should be provided with regular security awareness training and should be instructed how to identify phishing emails. Legacy authentication should also be blocked. Other protections include the spam filters, anti-malware solutions, and web filters, but according to Microsoft, there is one solution that blocks 99.9% of automated cyberattacks: Multi-factor authentication.

Multi-factor authentication is the use of more than one method of verifying the identity of a user. In addition to a password or passphrase that only the account holder knows, additional factors are required such as the use of a token or biometric verification. If an attempt is made to logon to an account from an unfamiliar device or location, the second authentication factor comes into play. That could be a text message sent to the user’s mobile phone.

Even though MFA is an effective way of preventing unauthorized account access and preventing data breaches, many healthcare organizations only implement MFA once they have experienced a breach.

In a recent blog post, Microsoft explains that more than 300 million fraudulent sign-in attempts are made to its cloud services every day and the number of attacks is continuing to rise. Even if a username and password is compromised, multi-factor authentication will prevent those credentials from being used to gain access to an account.

“Based on our studies, your account is more than 99.9 percent less likely to be compromised if you use MFA,” said Alex Weinert, Microsoft’s Group Program Manager for Identity Security and Protection. “Your password doesn’t matter, but MFA does.”

Many organizations are reluctant to implement MFA as they feel it is complicated and will have a negative impact on workflows, when that is not necessarily the case. To keep disruption to a minimum, organizations can implement MFA on the most critical accounts or adopt a role-based approach. MFA can then be expanded from there.

MFA is not infallible, but it is one of the single most important measures to implement to block cyberattacks and ensure that responses to phishing emails and poor password choices from resulting in a costly data breach.

The post Multi-Factor Authentication Blocks 99.9% of Automated Cyberattacks appeared first on HIPAA Journal.

A recent ProPublica investigation has highlighted a growing problem that is fueling the current ransomware epidemic. Insurance companies are opting to pay ransom demands as it is the most cost-effective way of settling claims. A ransom demand may be high, but it is far cheaper to pay the ransom than cover the cost of rebuilding systems from scratch and restoring data from backups.

Paying the ransom demand is a win-win for the insurer and breached entity. The insurer saves money and since most insurance policies only require payment of a small deductible, the breached entity does too. They are also likely to regain access to their files and systems far more quickly, which saves time and money by reducing downtime. The hackers responsible for the attack are also happy, as their demand is met.

This has been clearly demonstrated in recent attacks where the breached entity has refused to pay up. The ransomware attack on the city of Atlanta saw the attackers issued a demand of $51,000 for the keys to decrypt files. The city refused and ended up paying around $8.5 million to resolve the attack. The city of Baltimore also refused to pay its $76,000 ransom and ended up paying $5.3 million (and counting).

There is naturally a downside to paying a ransom. Doing so gives the attackers the finances to conduct further attacks. When ransom payments of hundreds of thousands of dollars are paid, it sends a message to other cybercriminals that attacks can be extremely profitable. That just encourages others to jump on the ransomware bandwagon and start conducting their own attacks. It is for this reason that the advice of the FBI is never to pay a ransom.

The report also suggests that, in some cases at least, cybercriminals may be choosing to attack companies that have cyber insurance as there is a much higher probability that the ransom demand will be paid. The report cites Fabian Wosar, chief technology officer at New Zealand-based cybersecurity firm Emsisoft, who points out that one company offering cyber-insurance listed some of its clients on its website and three of those companies suffered ransomware attacks.

Information about companies that have cyber-insurance can also be found in SEC filings. The U.S. Securities and Exchange Commission recommends informing shareholders in quarterly filings that the company holds a cyber-insurance policy. That information could be used by ransomware gangs to find potential targets to attack. ProPublica reporters spoke to one company that was allegedly told by the FBI that U.S. companies are being targeted by hackers as there was a greater chance that the ransom demands would be paid by insurance companies.

Whether companies are being targeted specifically because they have a cyber-insurance policy is unclear, as there is little evidence to backup such claims. More and more companies are taking out insurance and it may just be coincidence that insured companies have been attacked.

Most ransomware attacks still occur because vulnerabilities have not been identified and addressed and cybersecurity defenses are poor. What is needed is greater investment in cybersecurity solutions, policies, and procedures to make it harder for attacks to succeed in the first place.

The post Insurance Companies are Fueling the Ransomware Epidemic by Paying Ransoms appeared first on HIPAA Journal.