cybersecurity – protect you practice · – cybercrime as an industry ... economics, and...

WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTINGInvestment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC, an SEC-registered investment advisor

Lee Painter, Principal, HC CyberSecurity and Regulatory Compliance

CyberSecurity – Protect Your Practice

Create Opportunities

About CLA

• A professional services firm with three distinct business lines– Wealth Advisory– Outsourcing– Audit, Tax, and Consulting

• More than 6,100 employees• 120 offices coast to coast

Investment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC.

Speaker Introduction (Huge Nerd)Lee Painter, CISSP, CRISC, HCISPP, CCSFPPrincipal, HealthCare CyberSecurity and Regulatory Compliance• 15 years of operational experience (DoD)

• Threat Analysis and Network Defense• Incident Detection and Response• Insider Threat Analyst/Lead• System/Network Administrator

• 5 years of consulting experience• HIPAA Security Risk Analysis• HIPAA Privacy and Security GAP Assessments• Penetration Testing• Vulnerability Assessments• GDPR Data Protection Impact Assessments• Payment Card Industry Compliance Assessments

Financial Impact of Healthcare Breaches

Raise Your Hand If…

When a TV is NOT a TV…

https://www.theverge.com/2019/6/17/18681683/samsung-smart-tv-virus-scan-malware-attack-tweet

The bad guys

“Know Thy Enemy”• Hackers have “monetized” their activity

– More sophisticated hacking– More “hands-on” effort– Smaller organizations targeted– Cybercrime as an industry

• Everyone is a target…

• Phishing is a root cause behind the majority of cyber fraud and hacking attacks

Cybercrime as an “Industry”

• Black market economy to support cyber fraud• Hacking is run like a business where people

(criminals) specialize in different areas– Writing malware– Renting botnets– Stealing data– Selling data (collect data from various

sources/BIG DATA)– Etc.

Largest Cyber Fraud Trends - Motivations• Black market economy to support cyber fraud

– Business models and specialization• Most common cyber fraud scenarios we see affecting our clients

– Theft of PII and PFIo W2/Payroll/Benefit info

– Theft of credit card information– Theft of Credentials and

Account take overs– Ransomware and Interference

w/ Operations

Marketplace for Stolen Information

Attackers buy and sell data on cyber black market– “The Dark Web” - similar to amazon.com

Cautionary Tales

RansomwareMalware encrypts everything it can interact with

http://www.engadget.com/2016/02/19/hospital-ransomware-a-chilling-wake-up-call/

Common Ransomware Targets• Local Disk(s)• Connected devices (USB)• Managed network devices• Other accessible folders• Vulnerable hosts within the

network

Everyone is a target

Should Never Happen

• 37,000 Flash Drives sent to members

• Never trust a flash drive• Always perform a secure

download• Constantly update AntiVirus

software• Advanced (and maintained)

Firewalls

How to prevent

Should Never Happen

• $10,000 Fine• Patient Information was disclosed

in response to a YELP Review (presumably negative)

• Last Name, Health Condition, Treatment Plan, Insurance, Cost Information

• No policies and procedures around PHI – Social Media Policy?

How to prevent• Policies and Procedures!• Training and Awareness• HIPAA Risk Analysis

Ransomware and Cybercrime

The Attacks!

RansomwareAttack on the availability of network data

Easier to do than exfiltration of the data

Uses strong encryption to render victims files unreadable

Payments are often in Bitcoin

Cyber criminals attempt to delete host and network backups

User credentials are used for network access

Many variants and constant evolution

Ransomware Evolution

2004 Misleading Applications

2008 Fake anti-virus

2013 Locks you out of your device (browser, etc.)

2015-2019 Locks you out of your data

• This evolution of ransomware has been greatly influenced by a range of developments in technology, economics, and security.o Cryptocurrency and anonymization networks has made it difficult to hunt down

cyber criminals

RansomwareTypes• CryptoWall, CryptoLocker, etc.• Encrypt all data, hold it “ransom” for $$

– Data on local machine and on network• Attackers are putting much more time and

effort into these types of attacks over the last year(s)

• Starting to target other operating systems, like Macs, Android, IoT

Ransomware as a Service (RaaS)

Attackers buy and sell anti-security services on cyber black markets– “The Dark Web” - similar to amazon.com

Ransomware(One year ago)

(Six months ago)

Ransomware

Create Opportunities 24

Ransomware

Ransomware(More Recently…)

Image source from NPR

Defensive Strategies

• Defense in depth• Staff awareness (users that are aware

and savvy)• Current operating systems and up to

date/patched software• Minimized User Access Rights• Email spam filters

– Setup– Tested– Examine spam

• Removal of ads from the network– Web proxy

Phishing

The Attacks!

What is Phishing?

• Simply put:– Convince someone to perform an action that will benefit the attacker

• What is that action?– Visit a malicious website– Download and open a malicious file– Provide confidential information (Password, Account Number, etc.)– Wire money out of the organization

Types of Attacks

• Traditional Attack (Spamming) – Attacker targets a large amount of users

• Spear Phishing – A custom message is built for a specific target

• Whaling – “C-level” executives or management is specifically targeted

Phishing Email

You can forge the sender address in a letter

Poor Email Filtering

Connected to mail.cogentco.com (38.9.X.X).MAIL FROM: <hacker@contoso.com>250 OKRCPT TO: <david.anderson@claconnect.com>250 Accepted

DATA354 Enter message, ending with "." on a line by itselfFROM: <ElonMusk@tesla.com>TO: <david.anderson@claconnect.com>Subject: Free Tesla Car

SMTP Envelope

SMTP Message

Phishing Email

Ransomware

Phishing Website

Protect Against Email Phishing

• Harden email gateway (spam filter)– Block potentially malicious file attachments (e.g. ZIP, RAR, HTA, JAR)– Flag Office documents that contain Macros as suspicious– Prevent your organization’s domain from being spoofed

◊ Sender Policy Framework (SPF)◊ Custom rule to evaluate SMTP Letter FROM field

– Flag emails that originate from the Internet◊ E.g. Modify subject line to say ‘External’

Protect Against Email Phishing

• Continue to Train Employees– Train employees how to spot odd wire requests– Politely challenge the request and ask if it has been verified through

proper channels – Provide sample policies/guidelines for organizations that don’t have

them– Explain simple controls to implement (limits, two-step/two-factor,

etc.)– Make sure request is not authorized via email

Ransomware Recovery Strategies

None of that worked – Now What?

Data Backup

• Ensure ALL critical systems and data are being backed up

• Practice a full system and data restore to verify your confidence in full system and data restore capabilities– Understand how long it will take to recover various

backup types

• Segment critical backups to prevent deletion– Attackers will attempt to delete or encrypt all

accessible backups

Incident Response

• Playbooks for common incident types• Ensure employees understand their

responsibilities and procedures to follow in the event of an incident

• TEST!

Cyber Insurance

• Average cyber insurance payout:– Median $150,000– Mean $700,000

An Ounce of Prevention

• Evaluate your risks (and be compliant) – Perform a HIPAA Risk Analysis• Establish policies and procedures• Train staff to policies and procedures• Test your security – Penetration Testing, Vulnerability Assessment(s)• Plan for an incident/disaster• Practice your plan• Assess, Adjust, Operate (Repeat)

Prevent the Breach and/or Limit the Impact

“You can outsource IT and the responsibility, but you can never outsource theaccountability for protecting Patient Health Information….Choose yourvendors carefully.” Lee Painter, Today – and a bunch of times since 2014

Thank you!

CLAconnect.com

Lee PainterPrincipal, HC CyberSecurity and Regulatory Compliance

lee.painter@CLAconnect.com

cybersecurity – protect you practice · – cybercrime as an industry ... economics, and...

Documents

fighting russian cybercrime mobsters - black hat is online...

cybercrime prevention act sponsorship speech - "quashing...

cryptocurrency anti-money laundering report, 2019 q2 ·...

cybercrime fighting cybercrime...cybercrime part ii tyler...

workload-aware anonymization techniques for large-scale...

eﬃcient k-anonymization using clustering...

data privacy and anonymization

data anonymization – introduction and k-anonymity

bitcoin (cryptocurrency)

yinbi cryptocurrency: introducing a censorship-resistant...

data anonymization (1)

presented by: brian nienhaus. what is cybercrime? running...

clustering-based web query log anonymization

alexandru caciuloiu cybercrime and cryptocurrency...

the business of cybercrime a complex business...

graph symmetry and social network anonymization

international telecommunication union cybercrime...

data anonymization - european commission

ˆ-uncertainty: inference-proof transaction anonymization

understanding cryptocurrency