Thursday, March 12, 2015

Protecting Healthcare Records from Cyber Attacks Is a Game of Cat and Mouse

Protecting Healthcare Records from Cyber Attacks Is a Game of Cat and Mouse

By Mike Potts, CEO, Lancope

The never-ending battle between healthcare organizations and cyber attackers has always been like a game of cat and mouse. The hacker plays the role of the mouse, constantly trying to sneak past the company’s cat that is guarding information. For years, the cat not only consistently beat the mouse, he would help his fellow cats identify new mice and keep them out of their cupboards too. But as the successful data breaches over the past year demonstrate, including one earlier this year that made headlines after millions of health insurance records were compromised, the mice are now kicking the cats in their tails.

As the healthcare sector continues its collective effort to move to a 100-percent electronic records system, these recent attacks should serve to do two things. First, it should shine a light on why your existing cybersecurity system is likely inadequate – even if it complies with HIPAA’s Security Rule. Second, it should prompt you to immediately call your CSO, CIO and IT administrators into your office to overhaul your security posture and establish new employee education and incident response training programs.

While you may not have thought of this industry as a primary target for attackers, I hope you understand that cyber criminals consider healthcare information just as valuable as credit card numbers and other financial records if not more so given the longer shelf life of social security numbers and other personal information. And furthermore, traditional security solutions alone are incapable of keeping thieves out of your network. Healthcare security needs a more holistic approach that keeps watch both outside and inside your network and can help your security personnel more quickly identify and remediate threats. Here is why:

A Game of Cat and Mouse

Your first question might be, “what happened to the cat that I thought was such an effective guard?” Actually, the question you should be asking first is “what’s happened to the mouse to make him so much better at sneaking past the cat-guarded gate?”

The mouse has become faster, smarter and more agile. His motivations have evolved too, from hacking into systems to gain public notoriety and praise from his fellow mice, to silently and anonymously stealing information for financial gain.

In fact, the cat often does not even realize the mouse has snuck in and has been sitting for weeks, possibly months, stealing whatever it finds valuable.

The solution is not to add more cats that keep their ever-watchful eyes trained outside your network in order to spot outside attackers from trying to get in. That’s still important, the cat hasn’t become obsolete. But now building a better mouse trap requires a more holistic approach that guards both from the outside-in and from the inside-out.

This requires monitoring activity across your entire network in real time, including who is accessing and moving data stored in third-party cloud-based services like Dropbox or Simply put, security cannot be a one-time “set it and forget it” process.

In addition to implementing technology tools to enable you to see who is in your network and what, exactly, they are doing, you need to educate and train all of your employees, not just those in the IT department. Practice makes perfect. Just as you run regular fire drills, do the same to ensure your teams know what to do when a security threat is identified outside or inside your network? You want to put out a fire in a trash can long before it becomes a blaze that engulfs the whole building and causes irreparable damage.

A Holistic Approach

There’s no sugar-coating this fact: it’s likely only a matter of time before a breach occurs. You still want to lock your front doors (a.k.a. your perimeter), but don’t put all your eggs in that one basket. You have to balance your cybersecurity technology budget and include tools that provide your security team with the intelligence, visibility and forensic IR capabilities they need to identify when someone picks the lock and shut them down before any significant damage is done.

Also, for more information about just how serious the insider threat has become to healthcare organizations, please review the infographic “The Reality of Insider Threats” at

Wednesday, March 11, 2015

Why You May NOT Want to Freeze Your Credit

This just in: Reasons to Rethink Freezing Your Credit During ID Fraud Scare

Here are some reasons you may want to consider for any stories you might be planning around tax season:

• If you do put a freeze on your credit report it can take up to a month for the credit bureaus to do the unfreeze
• During a freeze, all credit cards are frozen
• Your debit card may also be impacted
• Consumers may need to go to a cash lifestyle even to pay bills
• All of your automated bill payments are then frozen and that can negatively impact your credit even further if or when you miss payments
• The Federal Trade Commission warns that tax ID theft, the most common form of identity theft, is a bigger problem than any one company.
• The Internal Revenue Service said Tuesday that tax-related identity theft is on the rise. In 2014, the IRS conducted over 1,000 identity theft-related investigations. There were also 748 sentencings connected to identity theft crimes, representing an increase of 75 percent over 2013.

"Once you freeze your credit report, it takes a long time to unfreeze it and you may have to live off liquid assets in the meantime," said Brian Richards, ID Theft Expert at Protect Your Bubble. "Only wait until there has been an activity reported against you specifically before you actually put a freeze on your credit report. It's difficult to dictate the timing of the freeze or unfreeze and that places added stress on consumers to maintain bill payment or have access to credit."

Monday, March 9, 2015

Smart Cities Need Smart Vaccine against Cyber Attacks

A Smart Vaccine approach is needed to protect the Middle East's smart cities, says security expert Dr. Rocky Termanini. It applies, of course, to other regions, too.

Dr. Termanini is the auther of The Cognitive Early Warning Predictive System Using the Smart Vaccine, to be published by CRC Press in November 2015.