The computers at Hollywood Presbyterian Medical Center were down for more than a week, as they were being held hostage for $3.6 million. Patients were transported to other hospitals because of the breach, and crucial systems for CT scans, lab work and pharmacy needs are offline. In healthcare, a breach can be a life or death situation.
The news is an extension of the rising tide of ransomware, malware and other beyond the perimeter threats that organizations of all kinds are now facing. On that note, I’d like to offer a contributed article from Greg Mancusi-Ungaro, CMO of BrandProtect, about how healthcare and other types of organizations have become targets for hackers and what security measures organizations should be taking to protect themselves against breaches like the one that occurred in Hollywood.
[su_note note_color=”#ffffcc” text_color=”#00000″]Greg Mancusi-Ungaro, CMO, BrandProtect:
“Healthcare organizations are a large target for many reasons. First and foremost, they possess extremely valuable assets, including the personal, family and billing information of their patients. It isn’t the blood type or cholesterol reports that make Electronic Health Records the most valuable records on the cybercrime black market; it is the virtually complete personal identity information, including social security numbers, parents, maiden names, addresses, emails, children names and, in some cases, complete information of close friends. They are the holy grail of the identity theft world.
“Second, the available attack surface in the healthcare industry is very complex. The healthcare industry contains many different organizations that have, over the past few years, moved to electronic systems, but not to a truly centralized electronic system. The reality of today’s healthcare records infrastructure is that there are many networks, data formats, communications protocols, passwords and access points all patched together. Not only is this amalgamated network challenging to maintain, it creates massive opportunities for compromise.”
“Almost all cyber events start out the same way, with a successful attack on a single individual (an employee, doctor or patient) or device. This initial incursion, whether through malware, social engineering or another means, can lead to illegal network access and records theft over the course of weeks or months.”[/su_note]
[su_box title=”About Greg Mancusi-Ungaro” style=”noise” box_color=”#336588″]
Greg Mancusi-Ungaro is responsible for developing and executing the BrandProtect market, marketing, and go to market strategy. A passionate evangelist for emerging technologies, business practices, and customer-centricity, Greg has been leading and advising world-class marketing initiatives, teams and organizations for more than twenty-five years.[/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.