Cybersecurity Saturday

David Ermer–Cybersecurity–

Today is the 25th anniversary of President Clinton signing the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) into law. Ponder that, my friends.

Let’s start of today with a link to Bleeping Computer’s The Week in Ransomware:

Ransomware gangs continue to attack schools, companies, and even hospitals worldwide with little sign of letting up. [At the link] we have tracked some of the ransomware stories that we are following this week.

Stories of particular interest revolve around new features and tactics used by some of the ransomware operations.

After analyzing the Conti training material leaked earlier this month, we learned that they use a legitimate remote access software to retain persistence on a compromised network. We also learned that they prioritize searching for cyber insurance policies and financial documents after taking control of a network

There is some good news, as Emsisoft has released a SynAck ransomware decryptor after the master decryption keys were released by the threat actors earlier this month.

Earlier this week Security Week reported that the “U.S. Cybersecurity and Infrastructure Security Agency (CISA) this week published a new document providing recommendations on how to prevent data compromise during ransomware attacks.”

Although it’s not healthcare, it’s a big hack. The Wall Street Journal reports that “The breach of T-Mobile US Inc. allowed hackers to steal information about more than 54 million people and potentially sell the data to digital fraudsters and identity thieves.” The Journal adds that “T-Mobile has set up a website containing information about the breach and advice on how consumers can protect themselves.”

From the advice column

  • Tech Republic informs us based on an interview with a cybersecurity lawyer that “Expert says people are becoming smarter about the links they click on and noticing the ones they shouldn’t, giving hope for the future of cybersecurity.” Keep up the good work, friends.
  • HITConsultant.net discusses three way that healthcare organizations can work to prevent insider security threats, to with (1) prioritize employee education without burning them out; (2) improve IT hygiene, and (3) implement a zero trust approach.
  • For more on the zero trust approach check out this helpnetsecurity.com article.

Finally, the Wall Street Journal offers an interesting article on a Deloitte study about using technology to improve the health plan member experience. Check out, and again Happy Birthday HIPAA.