Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label IT Infrastructure. Show all posts
IT Infrastructure
ALPHV Change Healthcare Cyber Attacks CyberCrime Cybersecurity cybersecurity in healthcare CyberThreat data security EHRs IT Infrastructure

Weak Links in Healthcare Infrastructure Fuel Cyberattacks

 


Increasingly, cybercriminals are exploiting systemic vulnerabilities in order to target the healthcare sector as one of the most frequently attacked and vulnerable targets in modern cybersecurity, with attacks growing both in volume and sophistication. These risks go well beyond the theft of personal information - they directly threaten the integrity and confidentiality of critical medical services and patient records, as well as the stability of healthcare operations as a whole. 

There has been an increase in threat actors targeting hospitals and medical institutions due to the outdated infrastructure and limited cybersecurity resources they often have. Threat actors are targeting these organisations to exploit sensitive health information and disrupt healthcare delivery for financial or political gain. The alarming trend reveals that there is an urgent and critical security issue looming within the healthcare industry that needs to be addressed immediately. 

Such breaches have the potential to have catastrophic consequences, from halting life-saving treatments due to system failures to eroding patients' trust in healthcare providers. Considering the rapid pace at which the digital transformation is taking place in healthcare, it is important that the sector remains committed to robust cybersecurity strategies so as to safeguard the welfare of its patients and ensure the resilience of essential medical services in the future. 

BlackCat, also referred to as ALPHV, is at the centre of a recent significant cybersecurity incident. In recent months, it has gained prominence as a highly organised, sophisticated ransomware group that has been linked to the high-profile attack on Change Healthcare. As a result of the infiltration of the organisation's IT infrastructure and the theft of highly sensitive healthcare data by the group, the group has claimed responsibility for obtaining six terabytes of data.

As a result of this breach, not only did it send shockwaves throughout the healthcare sector, but it also highlighted the devastating power of modern ransomware when targeting critical systems. It has been reported that the attack was triggered by known vulnerabilities in ConnectWise's ScreenConnect remote access application, a tool that is frequently employed in many industries, including healthcare, as a remote access tool. 

Having this connection has given rise to more concern about the broader cybersecurity risks posed by third-party vendors as well as software providers, showing that even if one compromised application is compromised, it can lead to widespread data theft and operational disruption as a result. This incident has served as a stark reminder that digital ecosystems in healthcare are fragile and interconnected, with a breach in one component leading to cascading effects across the entire healthcare service network. 

There is a growing concern in the healthcare sector that, as investigations continue and new details emerge, healthcare providers are still on high alert, coping with the aftermath of the attack as well as the imperative necessity of strengthening their defensive infrastructure in order to prevent similar intrusions in the future. As one of the most frequently targeted sectors of the economy by cybercriminals, healthcare continues to be one of the most highly sensitive data centres in the world. 

It is important to note that even though industry leaders often fail to rank cybersecurity as one of their top challenges, Mike Fuhrman, CEO of Omega Systems, pointed out that despite this growing concern, there are already significant consequences resulting from insufficient cyber risk management, including putting patient safety at risk, disrupting care delivery, and making compliance with regulations even more difficult. Even though perceived priorities are not aligned with actual vulnerabilities, this misalignment poses an increasing and significant risk for the entire healthcare system. 

Fuhrman stressed the necessity of improving visibility into security threats and organisational readiness, as well as increasing cybersecurity resources, to bridge this gap. As long as healthcare organisations fail to take proactive and comprehensive steps to ensure cyber resilience, they may continue to experience setbacks that are both detrimental to operational continuity as well as eroding public trust, as well as putting patient safety at risk. 

As cybersecurity has become more and more important to the leadership, it has never been more important to elevate it from a back-office issue to an imperative. As a result of the growing number of cyberattacks targeting the healthcare sector in the past few years, the scale and frequency of these attacks have reached alarming levels.

According to the Office for Civil Rights (OCR), the number of security breaches reported by the healthcare industry between 2018 and 2023 has increased by a staggering 239%. Over the same period, there was a 278% increase in ransomware incidents, which suggests that cybercriminals are increasingly looking for disruptive, extortion-based attacks against healthcare providers as a means of extorting money. 

There is a likelihood that nearly 67% of healthcare organisations will have been attacked by ransomware at some point shortly, which indicates that such threats are no longer isolated events but rather a persistent and widespread threat. According to experts within the health care industry, one of the primary contributing factors to this vulnerability is the lack of preparedness at all levels. In fact, 37% of healthcare organisations do not have an incident response plan in place, leaving them dangerously vulnerable to ever-evolving cyberattacks. 

Health care institutions are appealing to malicious actors because they manage a huge amount of valuable data. Cybercriminals and even nation-state threat actors are gaining an increasing level of interest in electronic health records (EHRs), which contain comprehensive information about patient health, financial health, and medical history.

As a result of outdated cybersecurity protocols, legacy IT infrastructure, and operational pressures of high-stress environments, these records are frequently inadequately protected due to the likelihood that human error will occur more often. These factors together create an ideal storm for exploitation, making the healthcare industry a very vulnerable and frequently targeted industry in today's digital threat landscape.

Despite the growing frequency and complexity of cyberattacks, healthcare organisations face a critical crossroads as 2025 unfolds. Patient safety, data security, and regulatory compliance all intersect at the same time, resulting in a crucial crossroads more than ever before. Enhancing cyber resilience has become a strategic priority and a fundamental requirement, not just a strategic priority. 

Healthcare institutions must proactively adopt forward-looking security practices and technologies to secure sensitive patient data and ensure continuous care delivery. As a key trend influencing the healthcare cybersecurity landscape, zero-trust architectures are a growing trend that challenges traditional security models by requiring all users and devices to be verified before they are allowed access. 

In a hyperconnected digital environment where cyber threats exploit even the most subtle of system weaknesses, a model such as this is becoming increasingly important. IoT devices are becoming increasingly popular, and many of them were not originally designed with cybersecurity in mind, so we must secure them as soon as possible. Providing robust protections for these devices will be crucial if we are to reduce the attack surfaces of these devices. 

AI has been rapidly integrated into healthcare, and it has brought new benefits as well as new vulnerabilities to the healthcare sector. In order for organisations to meet emerging risks and ensure a responsible deployment, they must now develop AI-specific safety frameworks. Meanwhile, the challenge of dealing with technological sprawl, an increasingly fragmented IT environment with disparate security tools, calls for a more unified, centralised cybersecurity management approach.

A good way to prepare for 2025 is to install core security measures like multi-factor authentication, strong firewalls, and data backups, as well as advanced measures like endpoint detection and response (EDR), segmentation of the network, and real-time AI threat monitoring. In addition to strengthening third-party risk management, it will also be imperative to adhere to global compliance standards like HIPAA and GDPR.

There is only one way to protect both healthcare infrastructure and the lives that are dependent on it in this ever-evolving threat landscape, and that is by implementing a comprehensive, proactive, and adaptive cybersecurity strategy. Healthcare organisations must take proactive measures rather than reactive measures and adopt a forward-looking mindset so they can successfully navigate the increasing cybersecurity storm. 

Embedding cybersecurity into healthcare operations' DNA is the path to ensuring patient safety, operational resilience, and institutional trust in healthcare organisations, not treating it as a standalone IT concern, but as a critical pillar of patient safety, operational resilience, and institutional trust in healthcare organisations.

To achieve this, leadership must take the initiative to champion security from the boardroom level, integrate threat intelligence into strategic planning, and invest in people and technology that will be able to anticipate, detect, and neutralise emerging threats before they become a major issue. As part of the process of fostering cyber maturity, it is also essential to cultivate a culture of shared responsibility among all stakeholders, ranging from clinicians to administrative personnel to third-party vendors, who understand the importance of keeping data and systems secure. 

Training on cybersecurity hygiene, cross-functional collaboration, and continuous vulnerability assessment must become standard operating procedures in the healthcare industry. As attackers become more sophisticated and bold, the costs of inaction do not stop at regulatory fines or reputational damage. Rather, inaction may mean interruptions of care, delays in treatments, and the risk to human life. 

Only organisations that recognise cybersecurity as a strategic imperative will be in the best position to deliver uninterrupted, trustworthy, and secure care in an age when digital transformation is accelerating. This is a sector that is built on the pillars of trust, a sector that offers life-saving services, which does not allow for room for compromise. They have to act decisively, investing today in the defensive measures that will ensure the future of their industry.
Read more »
Software
API security Broward Data Breach Cloud based services Cyber Security CyberCrime CyberThreat Encoding IT Infrastructure Malicious actor Operators saaS Software

Securing the SaaS Browser Experience Through Proactive Measures

 


Increasingly, organisations are using cloud-based technologies, which has led to the rise of the importance of security concerns surrounding Software as a Service (SaaS) platforms. It is the concept of SaaS security to ensure that applications and sensitive data that are delivered over the Internet instead of being installed locally are secure. SaaS security encompasses frameworks, tools, and operational protocols that are specifically designed to safeguard data and applications. 

Cloud-based SaaS applications are more accessible than traditional on-premise software and also more susceptible to a unique set of security challenges, since they are built entirely in cloud environments, making them more vulnerable to security threats that are unique to them. 

There are a number of challenges associated with business continuity and data integrity, including unauthorized access to systems, data breaches, account hijacking, misconfigurations, and regulatory compliance issues. 

In order to mitigate these risks, robust security strategies for SaaS platforms must utilize multiple layers of protection. They usually involve a secure authentication mechanism, role-based access controls, real-time threat detection, the encoding of data at rest and in transit, as well as continual vulnerability assessments. In addition to technical measures, SaaS security also depends on clear governance policies as well as a clear understanding of shared responsibilities between clients and service providers. 

The implementation of comprehensive and adaptive security practices allows organizations to effectively mitigate threats and maintain trust in their cloud-based operations by ensuring that they remain safe. It is crucial for organizations to understand how responsibility evolves across a variety of cloud service models in order to secure modern digital environments. 

As an organization with an on-premises setup, it is possible to fully control, manage, and comply with all aspects of its IT infrastructure, ranging from physical hardware and storage to software, applications, data, and compliance with regulatory regulations. As enterprises move to Infrastructure as a Service (IaaS) models such as Microsoft Azure or Amazon Web Services (AWS), this responsibility begins to shift. Security, maintenance, and governance fall squarely on the IT team. 

Whenever such configurations are used, the cloud provider provides the foundational infrastructure, namely physical servers, storage, and virtualization, but the organization retains control over the operating systems, virtual machines, networking configurations, and application deployments, which are provided by the organization.

It is important to note that even though some of the organizational workload has been lifted, significant responsibilities remain with the organization in terms of security. There is a significant shift in the way serverless computing and Platform as a Service (PaaS) environments work, where the cloud provider manages the underlying operating systems and runtime platforms, making the shift even more significant. 

Despite the fact that this reduces the overhead of infrastructure maintenance, organizations must still ensure that the code in their application is secure, that the configurations are managed properly, and that their software components are not vulnerable. With Software as a Service (SaaS), the cloud provider delivers a fully managed solution, handling everything from infrastructure and application logic to platform updates. 

There is no need to worry, however, since this does not absolve the customer of responsibility. It is the sole responsibility of the organization to ensure the safety of its data, configure appropriate access controls, and ensure compliance with particular industry regulations. Organizations must take a proactive approach to data governance and cybersecurity in order to be able to deal with the sensitivity and compliance requirements of the data they store or process, since SaaS providers are incapable of determining them inherently. 

One of the most important concepts in cloud security is the shared responsibility model, in which security duties are divided between the providers and their customers, depending on the service model. For organizations to ensure that effective controls are implemented, blind spots are avoided, and security postures are maintained in the cloud, it is crucial they recognize and act on this model. There are many advantages of SaaS applications, including their scalability, accessibility, and ease of deployment, but they also pose a lot of security concerns. 

Most of these concerns are a result of the fact that SaaS platforms are essentially web applications in the first place. It is therefore inevitable that they will still be vulnerable to all types of web-based threats, including those listed in the OWASP Top 10 - a widely acknowledged list of the most critical security threats facing web applications - so long as they remain configured correctly. Security misconfiguration is one of the most pressing vulnerability in SaaS environments today. 

In spite of the fact that many SaaS platforms have built-in security controls, improper setup by administrators can cause serious security issues. Suppose the administrator fails to configure access restrictions, or enables default configurations. In that case, it is possible to inadvertently leave sensitive data and business operations accessible via the public internet, resulting in serious exposure. The threat of Cross-Site Scripting (XSS) remains a persistent one and can result in serious financial losses. 

A malicious actor can inject harmful scripts into a web page that will then be executed by the browser of unsuspecting users in such an attack. There are many modern frameworks that have been designed to protect against XSS, but not all of them have been built or maintained with these safeguards in place, which makes them attractive targets for exploitation. 

Insider threats are also a significant concern, as well. The security of SaaS platforms can be compromised by employees or trusted partners who have elevated access, either negligently or maliciously. It is important to note that many organizations do not enforce the principle of least privilege, so users are given far more access than they need. This allows rogue insiders to manipulate or extract sensitive data, access critical features, or even disable security settings, all with the intention of compromising the security of the software. 

SaaS ecosystems are facing a growing concern over API vulnerabilities. APIs are often critical to the interaction between SaaS applications and other systems in order to extend functionality. It is very important to note that API security – such as weak authentication, inadequate rate limiting, or unrestricted access – can leave the door open for unauthorized data extraction, denial of service attacks, and other tactics. Given that APIs are becoming more and more prevalent across cloud services, this attack surface is getting bigger and bigger each day. 

As another high-stakes issue, the vulnerability of personally identifiable information (PII) and sensitive customer data is also a big concern. SaaS platforms often store critical information that ranges from names and addresses to financial and health-related information that can be extremely valuable to the organization. As a result of a single breach, a company may not only suffer reputational damage, but also suffer legal and regulatory repercussions. 

In the age when remote working is increasingly popular in SaaS environments, account hijacking is becoming an increasingly common occurrence. An attacker can compromise user accounts through phishing, credential stuffing, social engineering, and vulnerabilities on unsecure personal devices—in combination with attacks on unsecured personal devices. 

Once inside the system, they have the opportunity to escalate privileges, gain access to sensitive assets, or move laterally within integrated systems. In addition, organizations must also address regulatory compliance requirements as a crucial element of their strategy. The industry in which an entity operates dictates how it must conform to a variety of standards, including GDPR, HIPAA, PCI DSS, and SOX. 

In order to ensure compliance, organizations must implement robust data protection mechanisms, conduct regular security audits, continuously monitor user activities, and maintain detailed logs and audit trails within their SaaS environments in order to ensure compliance. Thus, safeguarding SaaS applications requires a multilayer approach that goes beyond just relying on the vendor’s security capabilities. 

It is crucial that organizations remain vigilant, proactive, and well informed about the specific vulnerabilities inherent in SaaS platforms so that a secure cloud-first strategy can be created and maintained. Finally, it is important to note that securing Software-as-a-Service (SaaS) environments involves more than merely a set of technical tools; it requires a comprehensive, evolving, and business-adherent security strategy. 

With the increasing dependence on SaaS solutions, which are becoming increasingly vital for critical operations, the security landscape becomes more complex and dynamic, resulting from distributed workforces, vast data volumes, and interconnected third-party ecosystems, as well as a continuous shift in regulations. Regardless of whether it is an oversight regarding access control, configuration, user behavior, or integration, an organization can suffer a significant financial, operational, and reputational risk from a single oversight. 

Organizations need to adopt a proactive and layered security approach in order to keep their systems secure. A continuous risk assessment, a strong identity management and access governance process, consistent enforcement of data protection controls, robust monitoring, and timely incident response procedures are all necessary to meet these objectives. Furthermore, it is also necessary to cultivate a cybersecurity culture among employees, which ensures that human behavior does not undermine technical safeguards. 

Further strengthening the overall security posture is the integration of compliance management and third-party risk oversight into core security processes. SaaS environments are resilient because they are not solely based on the cloud infrastructure or vendor offerings, but they are also shaped by the maturity of an organization's security policies, operational procedures, and governance frameworks in order to ensure their resilience. 

A world where digital agility is paramount is one in which companies that prioritize SaaS security as a strategic priority, and not just as an IT issue, will be in a better position to secure their data, maintain customer trust, and thrive in a world where cloud computing is the norm. Today's enterprises are increasingly reliant on browser-based SaaS tools as part of their digital infrastructure, so it is imperative to approach safeguarding this ecosystem as a continuous business function rather than as a one-time solution. 

It is imperative that organizations move beyond reactive security postures and adopt a forward-thinking mindset to align SaaS risk management with the long-term objectives of operational resilience and digital transformation, instead of taking a reactive approach to security. As part of this, SaaS security considerations should be integrated into procurement policies, legal frameworks, vendor risk assessments, and even user training programs. 

It is also necessary to institutionalize collaboration among the security, IT, legal, compliance, and business units to ensure that at all stages of the adoption of SaaS, security impacts are considered in decision-making. As API dependency, third-party integration, and remote access points are becoming more important in the SaaS environment, businesses should invest in visibility, automation, and threat intelligence capabilities that are tailored to the SaaS environment in order to further mitigate their attack surfaces. 

This manner of securing SaaS applications will not only reduce the chances of breaches and regulatory penalties, but it will also enable them to become strategic differentiators before their customers and stakeholders, conveying trustworthiness, operational maturity, and long-term value to them.
Read more »
User Privacy
Data Breach Data Leak IT Infrastructure Kelly Benefits User Privacy

Kelly Benefits Data Leak Affects 260,000 People

 

A Maryland-based outsourced benefits and payroll manager is notifying nine large customers and nearly 264,000 individuals that their private and sensitive data may have been compromised in a December hack. The number of impacted people has increased by eight-fold since Kelly & Associates Insurance Group, also known as Kelly Benefits, published an estimate of the hack's scope earlier this month. 

The company's current total of 263,893 affected persons is far higher than the 32,234 initially reported on April 9 to state regulators and the US Department of Health and Human Services as a HIPAA breach. 

The benefits company announced that it is sending breach notices to impacted individuals on behalf of nine clients: Amergis, Beam Benefits, Beltway Companies, CareFirst BlueCross BlueShield, Guardian Life Insurance Co., Intercon Truck of Baltimore, Publishers Circulation Fulfilment, Quantum Real Estate Management, and Transforming Lives. 

Kelly Benefits declined to comment, citing "the sensitive nature of the incident and subsequent investigation.” An investigation following the incident revealed that unauthorised access to the company's IT infrastructure occurred between December 12 and December 17, 2024. The company claimed that throughout that period, the attackers copied and stole specific files.

"Kelly Benefits then began a time-intensive and detailed review of all files affected by this event to determine what information was present in the impacted files and to whom it related," the company noted. It analysed internal records to match the individual with the relevant client or carrier. 

Individuals' information compromised in the event varies, but it could include their name, Social Security number, date of birth, medical information, health insurance information, or financial account information.

Kelly Benefits informed the FBI about the incident. This company stated that it is still reviewing its security policies, procedures, and technologies. At the time of writing, at least one proposed federal class action lawsuit against Kelly Benefits was filed in connection with the hacking incident. The lawsuit claims Kelly Benefits was negligent in failing to safeguard sensitive personally identifying information from unauthorised access.

"Even with several months of credit monitoring services, the risk of identity theft and unauthorized use of plaintiff's and class members' PII is still substantially high. Cybercriminals need not harvest a person's Social Security number or financial account information in order to commit identity fraud or misuse plaintiffs and the class's PII," the lawsuit notes. "Cybercriminals can cross-reference the data stolen from the data breach and combine with other sources to create 'Fullz' packages, which can then be used to commit fraudulent account activity on plaintiff and the class's financial accounts."
Read more »
Sensitive data
Co-op Customer Data Customer Data Exposed cyber attack Data Breach Data Leak data security IT Infrastructure Sensitive data

Co-op Cyberattack Exposes Member Data in Major Security Breach

 

Millions of Co-op members are being urged to remain vigilant following a significant cyberattack that led to a temporary shutdown of the retailer’s IT infrastructure. The company confirmed that the breach resulted in unauthorized access to sensitive customer data, although it emphasized that no financial or account login information was compromised. 

Shirine Khoury-Haq, Chief Executive Officer of Co-op, addressed members directly, expressing regret and concern over the breach. She assured customers that the company’s core operations were largely unaffected by the attack and that members could continue to use their accounts and services as normal. However, she acknowledged the seriousness of the data exposure, which has affected both current and past members of the Co-op Group. 

“We deeply regret that personal member information was accessed during this incident. While we’ve been able to prevent disruption to our services, we understand how unsettling this news can be,” Khoury-Haq stated. “I encourage all members to take standard security precautions, including updating their passwords and ensuring they are not reused across platforms.” 

According to an official statement from Co-op, the malicious activity targeted one of their internal systems and successfully extracted customer data such as names, contact information, and dates of birth. Importantly, the company clarified that no passwords, payment details, or transactional records were included in the breach. They also emphasized that their teams are actively investigating the incident in coordination with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA). 

The company said that it has implemented enhanced security measures to prevent further unauthorized access, while minimizing disruption to business operations and customer services. Forensic specialists are currently assessing the full scope of the breach, and affected individuals may be contacted as more information becomes available. In response to the incident, Stephen Bonner, Deputy Commissioner of the UK Information Commissioner’s Office (ICO), offered guidance to concerned members. “Cyberattacks like this can be very unsettling for the public. 

If you’re concerned about your data, we recommend using strong, unique passwords for each of your online accounts and enabling two-factor authentication wherever possible,” he advised. “Customers should also stay alert to updates from Co-op and follow any specific instructions they provide.” The Co-op has apologized to its customers and pledged to continue prioritizing data protection as it works to resolve the issue. While the investigation continues, members are encouraged to remain cautious and take proactive steps to safeguard their personal information online.
Read more »
secure access
application virtualization Cyber Security Cybersecurity Hybrid Work IT Infrastructure remote desktop Remote Work secure access

The Future of Work: Why Remote Desktop Solutions Are Essential

 

The workplace is transforming at an unprecedented rate. Remote and hybrid work models, once considered temporary adjustments, have now become permanent components of modern business operations. Organizations worldwide are seeking secure, efficient, and cost-effective solutions to support a distributed workforce while maintaining productivity. As a result, remote desktop solutions have become essential, enabling seamless access to business applications and data from any location.

One of the most scalable and effective solutions available today is TSplus. Designed for businesses of all sizes, TSplus provides secure remote access, application virtualization, and IT infrastructure optimization, making it a key technology for the evolving workplace.

The shift to remote work accelerated during the COVID-19 pandemic, proving that many roles can be performed effectively outside traditional office environments. While some organizations initially faced difficulties adapting, many quickly recognized the advantages of flexible work models. Today, hybrid work is the norm, combining in-office collaboration with remote flexibility.

However, managing a dispersed workforce presents challenges, particularly regarding IT accessibility and security. Businesses must ensure employees can securely access their work environments from any device while maintaining operational efficiency.

Why Remote Desktop Solutions Matter

1. Seamless Access to Business Applications
A primary challenge of remote work is providing employees with secure access to essential business tools without compromising security. Remote desktop solutions allow seamless login to work environments from any device, replicating the in-office experience.

With TSplus, businesses can centrally host applications and desktops, enabling secure access from anywhere. This eliminates the need for costly hardware upgrades, allowing companies to support remote teams effortlessly.

2. Enhanced Security for Distributed Teams
As cybersecurity threats continue to rise, remote workers have become prime targets for phishing, ransomware, and data breaches. Traditional VPNs and unsecured remote connections expose businesses to significant risks.

A robust remote desktop solution integrates multi-layered security measures, such as:

  • End-to-end encryption to protect sensitive data
  • Multi-factor authentication (MFA) to prevent unauthorized access
  • IP and geo-restriction policies to regulate login location
TSplus provides advanced security features, safeguarding businesses from cyber threats while ensuring a seamless user experience.

Maintaining an on-premise IT infrastructure is costly and resource-intensive. Businesses must invest in high-performance hardware, software licenses, and ongoing IT maintenance to support remote work.

Remote desktop solutions reduce IT costs by centralizing resources and eliminating the need for physical workstations. Employees can securely access their work environment from any device, including laptops and tablets, allowing businesses to scale operations efficiently as they grow.
Read more »
Ransomwares
CISO Cyber Security cybersecurity solutions Healthcare Healthcare Cyberattacks IT Infrastructure Ransomware attack Ransomwares

Preparing Healthcare for Ransomware Attacks: A 12-Step Approach by Dr. Eric Liederman


Dr. Eric Liederman, CEO of CyberSolutionsMD, emphasizes that healthcare organizations must be prepared for ransomware attacks with a structured approach, describing it as akin to a “12-step program.” He highlights that relying solely on protective measures is insufficient since all protections have the potential to fail. Instead, planning and creating a sense of urgency is key to successfully handling a cyberattack. 

According to Liederman, organizations should anticipate losing access to critical systems and have a strategic recovery plan in place. One of the most important components of such a plan is designating roles and responsibilities for the organization’s response. During an attack, the Chief Information Security Officer (CISO) essentially takes on the role of CEO, dictating the course of action for the entire organization. Liederman says the CISO must tell people which systems are still usable and what must be shut down. 

The CEO, in this situation, plays a supporting role, asking what’s possible and what needs to be done to protect operations. A significant misconception Liederman has observed is the assumption that analog systems like phones and fax machines will continue functioning during a ransomware attack. Often, these systems rely on the same infrastructure as other compromised technology. For example, phone systems that seem analog still resolve to an IP address, which means they could be rendered useless along with other internet-based systems. 

Even fax machines, commonly thought of as a fail-safe, may only function as copiers in these scenarios. Liederman strongly advises healthcare institutions to conduct thorough drills that simulate these kinds of disruptions, enabling clinical and IT staff to practice workarounds for potentially critical outages. This level of preparation ensures that teams can still deliver care and operate essential systems even when technological resources are down for days or weeks. 

In terms of system recovery, Liederman encourages organizations to plan for bringing devices back online securely. While the need to restore services quickly is essential to maintaining operations, the process must be carefully managed to avoid reinfection by the ransomware or other vulnerabilities. Given his extensive experience, which includes almost two decades at Kaiser Permanente, Liederman advocates for resilient healthcare IT infrastructures that focus on readiness. This proactive approach allows healthcare organizations to mitigate the potential impacts of cyberattacks, ensuring that patient care can continue even in worst-case scenarios.
Read more »
Ransomware attack
Cyber Attacks Cybersecurity Policy Data Center data security Indonesia IT Infrastructure IT problems Ransomware attack

Indonesia’s Worst Cyber Attack Exposes Critical IT Policy Failures

 

Indonesia recently faced its worst cyber attack in years, exposing critical weaknesses in the country’s IT policy. The ransomware attack, which occurred on June 20, targeted Indonesia’s Temporary National Data Center (PDNS) and used the LockBit 3.0 variant, Brain Cipher. This malware not only extracts but also encrypts sensitive data on servers. The attacker demanded an $8 million ransom, which the Indonesian government has stated it does not intend to pay. 

One of the most alarming aspects of this attack is that almost none of the data in one of the two affected data centers was backed up, rendering it impossible to restore without decryption. This oversight has significantly disrupted operations across more than 230 public agencies, including key ministries and essential national services such as immigration and major airport operations. In response to the attack, Indonesian President Joko Widodo ordered a comprehensive audit of the country’s data centers. Muhammad Yusuf Ateh, head of Indonesia’s Development and Finance Controller (BPKP), stated that the audit would focus on both governance and the financial implications of the cyberattack. 

An official from Indonesia’s cybersecurity agency revealed that 98% of the government data stored in one of the compromised data centers had not been backed up, despite the data center having the capacity for backups. Many government agencies did not utilize the backup service due to budget constraints. The cyberattack has sparked calls for accountability within the government, particularly targeting Budi Arie Setiadi, Indonesia’s communications director. Critics argue that Setiadi’s ministry, responsible for managing the data centers, failed to prevent multiple cyber attacks on the nation. Meutya Hafid, the commission chair investigating the incident, harshly criticized the lack of backups, calling it “stupidity” rather than a simple governance issue. 

The attack has not only exposed the vulnerabilities within Indonesia’s IT infrastructure but has also led to significant operational disruptions. The lack of proper data backup procedures underscores the urgent need for robust cybersecurity measures and policies to protect sensitive government data. The audit ordered by President Widodo is a crucial step in addressing these issues and preventing future cyberattacks. 

As Indonesia grapples with the aftermath of this significant cyberattack, it serves as a stark reminder of the importance of comprehensive cybersecurity strategies and the need for constant vigilance in safeguarding critical national data. The incident highlights the essential role of proper IT governance and the consequences of neglecting such vital measures.
Read more »
IT Infrastructure
Australia Australian Businesses Cyberattack cybercriminals Data Breach Fortinet Hacker attack Hackers IT Infrastructure

The Growing Threat of Data Breaches to Australian Businesses

 

Data breaches are now a significant threat to Australian businesses, posing the risk of "irreversible brand damage." A cybersecurity expert from Fortinet, a global leader in the field, has raised alarms about cybercriminals increasingly targeting the nation’s critical infrastructure. Cybercriminals are continually finding new ways to infiltrate Australia’s infrastructure, making businesses highly vulnerable to attacks. 

The Australian federal government has identified 11 critical sectors under the Security of Critical Infrastructure Act, which was amended in 2018 to enforce stricter regulations. Businesses in these sectors are required to complete annual reporting to notify the federal government of any attempts to access their networks. Michael Murphy, Fortinet’s Head of Operational Technology and Critical Infrastructure, recently discussed the severity of cyber threats on Sky News Business Weekend. During the 2022-2023 financial year, 188 cybersecurity incidents were reported across critical sectors, highlighting ongoing risks to national networks like water and energy supplies. 

Additionally, the Australian Bureau of Statistics found that 34 percent of businesses experienced resource losses managing cybersecurity attacks in the 2021-2022 financial year, and 22 percent of Australian businesses faced a cybersecurity attack during that period—more than double the previous year’s figure. Even small businesses are now vulnerable to cybercrime. Murphy pointed out that among entities with mandatory reporting, 188 incidents were reported, with 142 incidents reported by entities outside of critical infrastructure, demonstrating the widespread nature of the threat. He explained that hackers are motivated by various factors beyond financial gain, including the desire for control. 

The consequences of cyber attacks can be severe, disrupting systems and causing significant downtime, which leads to revenue loss and irreversible brand damage. Critical infrastructure sectors face unique challenges compared to the IT enterprise. Quick restoration of systems is often not an option, and recovery can take considerable time. This extended downtime not only affects revenue but also damages the reputation and trustworthiness of the affected organizations. Murphy noted that many incidents are driven by motives such as financial profiteering, socio-political influence, or simply the desire of hackers and syndicates to boost their credibility. 

As cyber threats evolve, it is crucial for businesses, especially those in critical infrastructure sectors, to strengthen their cybersecurity measures. While annual reporting and adherence to federal regulations are essential, proactive strategies and advanced security technologies are necessary to mitigate risks effectively.
Read more »
Sensitive data
Data Breach Healthcare HHS IT Infrastructure network segmentation Sensitive data

One in Three Healthcare Providers at Risk, Report Finds


 

A recent report reveals that more than a third of healthcare organisations are unprepared for cyberattacks, despite an apparent rise in such incidents. Over the past three years, over 30% of these organisations have faced cyberattacks. The HHS Office for Civil Rights has reported a 256% increase in large data breaches involving hacking over the last five years, highlighting the sector's growing vulnerability.

Sensitive Data at High Risk

Healthcare organisations manage vast amounts of sensitive data, predominantly in digital form. This makes them prime targets for cybercriminals, especially since many operators have not sufficiently encrypted their data at rest or in transit. This lack of security is alarming, considering the high value of protected health information (PHI), which includes patient data, medical records, and insurance details. Such information is often sold on the dark web or used to ransom healthcare providers, forcing them to pay up to avoid losing critical patient data.

In response to the surge in cyberattacks, federal regulators and lawmakers have taken notice. The HHS recently released voluntary cybersecurity guidelines and is considering the introduction of enforceable standards to enhance the sector's defences. However, experts stress that healthcare systems must take proactive measures, such as conducting regular risk analyses, to better prepare for potential threats. Notably, the report found that 37% of healthcare organisations lack a contingency plan for cyberattacks, even though half have experienced such incidents.

To address these challenges, healthcare organisations need to implement several key strategies:

1. Assess Security Risks in IT Infrastructure

Regular cyber risk assessments and security evaluations are essential. These assessments should be conducted annually to identify new vulnerabilities, outdated policies, and security gaps that could jeopardise the organisation. Comprehensive cybersecurity audits, whether internal or by third parties, provide a thorough overview of the entire IT infrastructure, including network, email, and physical device security.

2. Implement Network Segmentation

Network segmentation is an effective practice that divides an organisation's network into smaller, isolated subnetworks. This approach limits data access and makes it difficult for hackers to move laterally within the network if they gain access. Each subnetwork has its own security rules and access privileges, enhancing overall security by preventing unauthorised access to the entire network through a single vulnerability.


3. Enforce Cybersecurity Training and Education

Human error is a growing factor in data breaches. To mitigate this, healthcare organisations must provide comprehensive cybersecurity training to their staff. This includes educating employees on secure password creation, safe internet browsing, recognizing phishing attacks, avoiding unsecured Wi-Fi networks, setting up multi-factor authentication, and protecting sensitive information such as social security numbers and credit card details. Regular updates to training programs are necessary to keep pace with the evolving nature of cyber threats.

By adopting these measures, healthcare organisations can significantly bolster their defences against cyberattacks, safeguarding sensitive patient information and maintaining compliance with HIPAA standards. 


Read more »
Ransomware attack
Cyber Attacks Cyber-recovery IDC survey IT Infrastructure Ransomware Ransomware attack

Are You Really Prepared for a Ransomware Attack?


With the continuous evolution and development in the IT industry, it still seems as if most IT environments are yet not adequately equipped against ransomware and remain oblivious to the importance of an efficient protection system. 

According to a recent IDC survey, conducted on more than 500 CIOs from more than 20 industries around the world, 46 percent of the respondents reported having witnessed at least one ransomware attack in the last three years. This indicates how ransomware has surpassed natural disaster, to become the main reason one needs to be skilled at handling large data restorations. Many years ago, disk system failure, which frequently required a complete restore from scratch, was the primary cause of such restores. 

However, situations changed with the introduction of RAID and Erasure Coding, which brought terrorism and natural disasters to the forefront. Nonetheless, unless you lived in a specific disaster-prone area, the likelihood that any one company would experience a natural disaster was actually fairly low. 

Is the Company Prepared for an Attack? 

May be not. 

The survey suggests that organizations who have had an experience of cyberattacks or data loss think highly of their ability to respond to such events in the future. In support of this notion, 85 percent of the respondents, on being asked about their security plans, claimed of having a cyber-recovery playbook for intrusion detection, prevention and response. 

While, it is to be taken into consideration that ransomware attacks are ever-evolving, with threat actors implementing a different tactics for the attacks. Thus, it is difficult to conclude that the current data resiliency tools would be highly efficient for all the future ransomware attacks. 

These tools however, should have one key objective in common. An efficient tool must be capable of recovering the breached data in a manner that the organization need not have to pay enormous ransom, while also making sure that the data is not lost. Since ransomware attacks are inevitable, data resiliency tool could at least ensure lesser damage from the attacks. 

Minimizing Attack Damage 

In order to detect a ransomware attack, to respond and to recover from it, one requires several crucial steps and tactics to be followed as given below.  

• IT infrastructure could be created in a way to limit the damage of an attack, for example, by forbidding the usage of new domains (preventing command and control) and restricting internal lateral movement (minimizing the ability of the malware to spread internally). However, after ransomware has hit you, you must employ numerous tools, many of which may be automated for greater efficiency. 

• Limiting lateral movement in order to halt the IP traffic all at once. If infected systems would not be able to communicate, no further damage would resultingly take place. Once the infected systems are identified and shut down, one can proceed with their disaster recovery phase of bringing infected systems online. Further, ensuring that the recovery systems are themselves not infected.  

Read more »
Terror
Cyber Security Data data security IT Infrastructure Safety Terror

Cyber-Terrorism In The Skies

 

Prior to 9/11, plane hijackings were thought to be the stuff of Hollywood scriptwriters. Major movie plots frequently reflect current societal themes in character scenarios and, in some cases, technology. 

There are numerous cyber-crime-themed films that accurately predicted our future. If we stop and think about it, nearly everything around us is becoming more digitized than ever before, from car navigation and control systems to Wi-Fi-enabled temperature sensors in backyard grills. You can't avoid it, so it's no surprise to learn how much technology goes into a modern aircraft. Aside from in-flight entertainment, Wi-Fi, and LED lighting, there are intricate sensors, controls, and computing systems that work together to provide the safest, best flights possible.

Unfortunately, in today's world, the general public is well-informed about how terrifying hijacked planes can be. And, as time has passed, the threat of terror in the skies has evolved technologically.
For many years, the terrifying prospect of cyber-attacks on commercial flights has haunted the airline industry. One of the first incidents to garner public attention was when security researcher Chris Robert was detained by the FBI on a domestic flight after claiming to have briefly seized control of the plane.

At the Black Hat cybersecurity conference in Las Vegas, another cybersecurity researcher, Ruben Santamarta, claimed that he had hacked hundreds of aircraft while they were in flight from the ground. The cybersecurity researcher claimed he used flaws in satellite equipment to remotely hack into the planes.

We would be dealing with a very dangerous threat if a plane's technical systems were compromised by malicious hackers. And we've had some close calls. A malware infection, for example, prevented a Spanair flight from taking off several years ago. In that case, the detection occurred before the flight was even possible, but the entire scenario highlights a significant risk and an ever-present threat.

Protection in the air is important, as is protection from potentially malicious passengers-turned-hackers, but what about safeguarding at other points in the flight industry's technology chain? Is it possible that mission-critical IT systems will be as vulnerable as satellites and onboard computers have proven to be?

Consider it from the perspective of a hacker. Nobody attempts to enter a fort through the guarded front gates. They sneak in through an unguarded wall or disguise themselves as the gate maintenance team. In other words, hackers find ways to circumvent perceived barriers and all the costly fortifications or processes in order to find a vulnerable point of entry.

Bugs and malicious software, for example, can infiltrate a simple software update. Although updating software is a good practice, the possibility of something dangerous occurring during these specific times is always present.

Almost like the vulnerable moments when vigilance is low during a guard change. Conditions like these require us to validate versions, and baseline systems and understand how to identify and isolate threats. They compel us to keep an eye out for compromise behavior and metrics. As a result, the security challenges encountered are closely related to enterprise security.

The Real World vs Hollywood

Planes, like any other interconnected IT system, can and probably will be hacked at some point. At this point, the question is not if, but when. Using intelligent precautions, processes, and technologies, we can hopefully predict and prevent whatever that sober incident turns out to be. And, if this terrifying situation occurs, we hope that quick recovery is triggered in accordance with well-planned disaster plans. Even if we are not in the airline industry, we should have the same mindset when it comes to our mission-critical internal IT systems.

Throughout the service lifecycle of our own IT infrastructure, are we sufficiently monitoring and protecting our mission-critical systems from cyber threats? No enterprise IT system is safe if planes can be hacked. The same questions regarding vulnerability mitigation and disaster recovery planning should be directed toward every IT system in every organization.

It is critical to understand that when it comes to commercial flights, the stakes could not be higher because human lives are at stake. Fortunately, industry leaders and government task forces are committed to developing solutions that address cyber threats to the commercial flight industry in a proactive manner. Eventually, their awareness and diligence will ensure that this remains a plot line for Hollywood thrillers rather than a potential opportunity for another devastating terror attack that weaponizes commercial airliners.
Read more »
Subscribe to: Posts (Atom)