Re: Ransomware Attack Causes Patient Death at a Hospital - What to Do Now

Roundup of CI Security's daily newsletters view this email online     Ransomware Attack Causes Patient Death - CIO-CISO panel discussion Tragedy and security collided last week when a woman's life was lost during an active ransomware incident at a hospital in Germany. With critical services now being targeted more than ever, healthcare IT and InfoSec leaders must address ransomware preparedness so tragedies like this do not become the norm. CISO Mike Hamilton and former healthcare CIO Drex DeFord hosted a panel yesterday to discuss what went wrong, and what InfoSec leaders can do now to avoid tragic outcomes after a ransomware attack. Read on for the full story and to view the CIO-CISO panel post-event recording. Full Story and Video     Healthcare   Fatality After Hospital Hacked Attackers struck the Düsseldorf University Clinic (DUC) last Thursday, causing IT systems at the major hospital to fail. Because of the attack, a woman seeking emergency treatment at the hospital on Friday night died after she had to be transported to a hospital in another city for treatment. Treatment of the deceased woman was delayed by an hour as she had to travel an additional 20 miles to a hospital in Wuppertal.   Healthcare Institutions Fall Short of National Cybersecurity Standards In some cases, the report found that larger organizations slipped because of recent acquisitions where the newly acquired organizations' computing environment had poor security postures. "What our report has uncovered over recent years is that healthcare is still behind the curve on security. While healthcare's focus on information security has increased over the last 15 years, investment is still lagging. In the age of remote working and an attack surface that has exponentially grown, simply maintaining a security status quo won't cut it."     Government   US Voting Systems 'Being Targeted' as Presidential Election Nears There are also concerns that cyber actors looking to interfere with Election Day voting will launch an indirect attack, perhaps using ransomware to take down systems that could create difficulties, even though they are not directly involved in the election process. "We see cascading impacts where internet is lost, connectivity to websites is lost," Masterson said. State and local officials are also being targeted, with cyber actors using spear-phishing and social engineering as ways to get passwords or other information that could give them access to critical systems.   FBI, DHS warn that foreign hackers will likely spread disinformation around election results The agencies warned that "foreign actors and cybercriminals could exploit the time required to certify and announce elections' results by disseminating disinformation that includes reports of voter suppression, cyberattacks targeting election infrastructure, voter or ballot fraud, and other problems intended to convince the public of the elections' illegitimacy."     Private Sector   Government Warns of New Cyber Threats Targeting U.S. Businesses These hackers target vulnerabilities in virtual private networks (VPNs), which organizations use to allow remote network access. Once the hackers gain access through a VPN, they export data, sell access to the network, and have the ability to install ransomware. This is the latest example of criminals exploiting vulnerabilities associated with the current remote working environment.   This dangerous Android banking trojan is now available online for anyone to use According to analysts at security firm Kaspersky, the operators of the Cerberus trojan originally attempted to auction off the code to other cybercriminal syndicates, but have now abandoned the material online for anyone to use. As a result, researchers have witnessed an immediate spike in the number of mobile infections, as cybercriminals harness the complex and sophisticated Android malware to defraud users across Europe.     Privacy   Companies can track your phone's movements to target ads Companies like NumberEight, or competitors Sentiance and Neura, use sensor data to categorize users. Instead of building a profile to target, say, women over 35, a service could target ads to "early risers" (as indicated by sensors noting when the phone is picked up after hours of rest) or adapt its user interface for after-work commuters (as indicated when sensors note riding a train after 5 pm). The feedback from the sensors provides "context" on the user's physical behavior.   How breakthroughs in privacy-enhancing technologies enable the future of biometric authentication Why? Because nobody follows best practice when it comes to password security. Even IT leaders are not immune: around 55% of them reuse the same password across multiple services – in fact, 51% of all passwords are reused. All this means that around half of all helpdesk calls are for password resets, and passwords cause approximately 80% of all data breaches.     Nation-State   The ransomware crisis is getting worse. We need to make these four big changes That means treating ransomware as a simple law-enforcement issue is never likely to fix the problem: these states will never hand over these gangs to outside justice. This makes ransomware a political issue as much as a problem for police. Politicians should make clear to these governments that by allowing these gangs to flourish on their soil, they are part of the problem.   North Korea likely paid Russian hackers for access to bank networks Working with hackers linked to Russia could allow DPRK-linked groups to focus their efforts on more important tasks, according to researchers at security firm Intel 471. The collaboration reportedly shows the "trusted relationships" North Korean hackers have built with elite Russian-speaking cybercriminals.

Forward this to a Friend  ⇒   © 2020 CI Security About Us   |   CI Security News   |   Contact Us 1215 4th Avenue, Suite 1710 Seattle, WA  98161 1 (800) 604-4810 update email preferences unsubscribe from all emails