Four minutes after an initial alert from NYSIC-CAU, Albany Medical Center received another from its anti-malware security vendors, prompting it to initiate a series of protective actions; from IDS/IPS network address and file blocking, to network traffic pattern block rules, to the patching of servers and medical devices.

The date was Friday, May 12, 2017, the first of four days that saw more than 300,000 computers worldwide infected by the WannaCry Ransomware attack. In recounting the experience, Kristopher Kusche, vice president and chief information security officer at AMC, told a group of onlookers at HIMSS 2018, at the Sands Expo and Convention Center in Las Vegas, that health care providers should expect more trouble on the horizon.

“Because of our position and because of the way we have elaborated our infrastructure not to keep up with sectors like banking, we have become targets, accidental targets,” he said during his presentation, Getting Ready for the Next International Cyber-⁠attack. “There’s not one federal agency that will say that health care was in the attack vector on these things. We weren’t in the plan. These things wouldn’t have targeted us, which kind of makes it a little more difficult because these things were random. Now, we have to protect against everything because we’re not the target, we’re not the target of this stuff. But where somebody finds a hole, they take advantage of it. That’s what happened at AMC.”

Health care accounted for 28 percent of all breaches in 2017; more than any sector, with 374 reported in total, and an impact on more than 5.1 million patient records.

Though AMC addressed its attack in a matter of hours, Kusche says the lack of education of staff, as well as inadequate PHP policies, open network ports, lack of encryptions, and inadequate solutions for internal defense have made providers and health systems vulnerable to the same fate.

To prevent the occurrence of this, he advises that organizations create their own cybersecurity framework (CSF), broken down into a series of necessities from workforce security to threat monitoring and assessment.

An effective CSF he says should be simple enough for staff to understand and execute, having backing from leaders, such as CIOs and boards; and should be compared to maturing models, such as the NIST cyber framework, for improvement. “It tells us where we are at in implementing and maintaining our security programs.”

The most basic step in a CSF is risk assessment, carried out by keeping an inventory of any issues that pose a risk with the end result being the creation of a risk registry that lists any issues an organization formally recognizes and plans to address by a certain point.

Health IT Homepage