Matthew Smith

The Cybersecurity and Infrastructure Security Agency (CISA) called for companies and organizations in the healthcare sector to report cyberattacks within 72 hours and ransoms paid within 24 hours. The proposed rule that would require the nation's most critical industries to more quickly report cyberattacks is raising the ire of the health care industry, which claims the new directives could actually hinder its response in a crisis. CISA says the agency isn't learning about many cyberattacks in a timely way, making it difficult to not only quickly help victims but also spot trends and warn other companies about known vulnerabilities. Cyberattacks have sent shockwaves across the health care industry, but regulators and providers don't agree on how to get a handle on the problem. Groups also raised particular concerns about the proposed enforcement mechanism included in the proposal to penalize organizations that don't comply with the law in a timely fashion... #informationsecurity #cybersecurity #security #healthcare #cisa #regulations #hipaa #healthcare #ransomware

20

5 Comments

Articles like these are why I use Brian Krebs articles in my workshops. If you want to learn how follow investigative thread to track down miscreants, see if you can copy one of Brian’s step by step investigative paths. https://lnkd.in/gbZDiH6Z

8

1 Comment

The disconnect between security and tech teams has become increasingly evident, hindering progress toward agility, meaningful metrics, and Zero Trust goals. With a shift in reporting lines and strained relationships, it's clear that understanding each other's challenges is crucial. By breaking down these silos and fostering open communication, we can bridge the gap, enhance collaboration, and drive effective solutions together. It’s time to recognize that we’re on the same side—let’s work towards a stronger, unified approach to security and technology. #Uniclan #Uniclanhealthcare #Uniclanhealthcarepvtltd #DomsWopwer #CyberSecurity #ZeroTrust #TechCollaboration #AgileSecurity #BreakingSilos #SecurityLeadership #UnifiedApproach #TechInnovation #CollaborationMatters #StrongerTogether #SecurityAndTech #EffectiveSolutions #DigitalTransformation #OpenCommunication #TeamworkForSuccess https://lnkd.in/g9YmmSCJ

3

Move on over HIPAA, there is a new bill working its way through the Washington red tape machine called "Health Infrastructure Security and Accountability Act". Since pretty much all of our health and personal data has already been leaked by inadequate data collectors, some lawmakers decided it was time to act. They are 20 years too late but it's election season so they need to pull out all the stops. HISAA (sounds 'gangsta' doesn't it) has civil penalties for all those health data grabbers out there who don't comply (and get caught) with HISAA requirements. These include: No knowledge – Minimum of $500 Reasonable cause – Minimum of $5,000 Willful neglect (Corrected) – Minimum of $50,000 Willful neglect (Uncorrected) – Minimum of $250,000 Yes, one "reasonable cause" will cost them a month's mortgage payment (4 bedroom, 2 bath, detached garage), which will be passed down to you, the patient, in one form or another. You can compare this bill to the ole SOX Act but for health care. The bill includes checklists, audits, stress test (pen test sorta) and someplace where the CEO has to sign off on the compliance thingy. Health care organizations have 3 years to figure out ways around the bill before they need to worry, once this bill is passed (if it is passed). $800 million of taxpayer cash will be given to Medicare safe providers to help them figure out how data security works. Then there is another $500 million of TaxO'Cash to " incentivize all hospitals" to adopt data security. I've attached a two page summary of HISAA so you too can gasp in horror at how our government thinks. Happy Halloween https://lnkd.in/gmyyCxhe

9

1 Comment

Before I became a cybersecurity expert, I thought that hackers only went after "big companies," yet this is not the case. Seattle's Public Library was just the victim of a ransomware attack which shut down multiple services and potentially leaked highly personal information. All companies are protentional targets if they don't have the correct system in place for data management. All companies are different so working with a cybersecurity professional that can tailor a security plan to your needs is extremely important. If your company is looking for an experienced cybersecurity analyst, then let’s connect! I bring a plethora of transferable tools (crisis management, data analytics, communication, collaborating with diverse teams and people) as well as a solid foundation of technical cybersecurity skills (SQL, SIEM, Linux). #cyberattacks #cybersecuritytips #cybersecuritythreats #employeeengagement

1

👿👨‍🏫 The Dark Side of Brilliance👨‍🏫👿 How Hackers are Exploiting Real Estate Transactions and Small Businesses One of my perverse cybersecurity joys is appreciating the evil genius of hackers. Many of their attacks are so effective. So patient. So financially rewarding. It’s hard to not see the brilliance in their simplicity. In the last month I’ve stumbled upon a new favorite that goes something like this: ***The Scheme*** 🎯 Breach: Hackers infiltrate a network processing large financial transfers (think mortgages or business deals). 🕶 Lurk in the Shadows: They spend months studying the system, communication styles, and payment methods. Basically, they become silent observers. ❗ Strike Time: They identify high-value, time-sensitive transfers - every minute counts for them. 👩‍🏫 Fake Customer Service: These cyber-cons then impersonate real customer service, mimicking communication styles down to a tee. They "verify" details like service, name, and payment dates. 💸 Wire Fraud: The unsuspecting victim, trusting the "verification," sends the money (often around $100k) straight to the fraudster's account. 🤦‍♀️ Confusion Reigns: The real vendor starts asking for the actual transfer, and guess what? The fake vendor does the same! This double request creates chaos, leading to even more misplaced funds. 💔 Fallout: Home sales fall through, businesses are crippled, and hackers walk away with millions - all thanks to a simple hack, patience, and some basic social engineering. Here's the Shocker: This happens THOUSANDS of times a month, and most go unresolved! **How to Fight Back? ** ✅ Never Trust, Always Verify: Don't respond to calls or emails claiming to "verify" transfers. Reach out directly to your authorized contact using previously established methods. 📂 Old School is Cool: Paper checks are a pain, but way harder to hack than wire transfers. Consider them for extra security (yes, it might take longer). 🏦 Think Local: Whenever possible, work with local sales reps or lenders. Building a face-to-face relationship can be a powerful defense. By staying vigilant and implementing these simple steps, you can protect yourself from falling victim to these elaborate scams. Let's outsmart the cybercriminals together! #cybersecurity #realestatescam #informationsecurity #staysafe Check out this article for a deeper dive into this specific scam. https://lnkd.in/gRmTPWKM

5

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

As most of these threats do, they aim to trick targets into running malicious code. It is crucial to train all employees and provide refresher training. These types of exploits catch us when we multitask and do not pay attention. If you need help with Security, Risk, or Compliance, SEI can help. Please reach out if you would like to brainstorm ideas.

2

An ID #verification service that works with #TikTok and #X left its credentials wide open for a year 😱 This means that hackers could potentially have accessed sensitive data, like driver’s licenses 😬. An ID verification company that works on behalf of TikTok, Twitter, and Uber, among others, has left a set of administrative credentials #exposed for more than a year, as reported by 404 Media 📰. The Israel-based AU10TIX verifies the identity of users by using pictures of their faces and driver’s licenses, potentially opening up both to #hackers 🕵️‍♂️. The set of admin credentials that were left #exposed led right to a logging platform, which in turn included links to identity documents 🔗. There’s even some reason to suspect that bad actors got ahold of these credentials and used them 🕶️. They appear to have been #scooped up by #malware in December 2022 and placed on a Telegram Messenger channel in March 2023, according to timestamps and messages acquired by 404 Media 🕵️‍♀️. The news organization downloaded the credentials and found a wealth of passwords and #authentication tokens linked to someone who lists their role on LinkedIn as a #Network_Operations_Center_Manager at AU10TIX 🔑. If hackers got ahold of customer data, it would include a user’s name, date of birth, nationality, ID number and images of uploaded documents 🆔. It’s pretty much all an internet #Gollum would need to steal an identity 🏴‍☠️. All they would have to do is snatch up the credentials, log in, and start wreaking havoc 🔓. Yikes 😱. AU10TIX has issued a statement on the matter, writing that the “data was potentially accessible” but that it sees “no evidence that such data has been exploited” 📝. The company said that impacted customers have been notified and that it’s decommissioning the current operating system in favor of a new one that focuses more on #security 🔒. Some of its #partners switched #verification companies before this issue popped up. A spokesperson for Upwork said that it has “been working with a different service provider for some time now” 🤝. Twitter, however, just signed up with AU10TIX back in September and it uses government-issued IDs to verify premium users 🆔. Others, like Fiverr and Coinbase, have said they aren’t aware of any data exposure, though they still work with AU10TIX 💼. Dumping customer data on Telegram Messenger or the #dark_web has become the most popular way for hackers to do their thing 📲. Back in late March, over 73 million AT&T passwords were leaked onto the dark web 🕵️‍♂️. LoanDepot experienced a similar issue this year, as did the US Department of Defense 🏛️.

9

Here is a step-by-step guide on how to gain access to social media accounts, Netflix, eBay, Twitch, PayPal... This is for educational purposes ONLY! Remember, do not attack accounts you do not have permission to access. #cybersecurity #kalilinux #zphisher #ethicalhacking

1

UnitedHealth Group, Optum, and Change Healthcare...just a thought... I'm pretty sure a comprehensive, enterprise-wide risk analysis (required at  45 CFR §164.308(a)(1)(ii)(A)) followed by the development and execution of good old-fashioned risk management (required at  45 CFR §164.308(a)(1)(ii)(B)) would have come in less than $2.5B. Obviously, the controls checklist approach didn't work... https://lnkd.in/ehsRAdKs

27

5 Comments

Last night I spent some time talking to a few dear friends calming them down, helping them to sanity check, and navigate evacuating the fires in SOCAL. Though they don't work in our industry, several of you have met these friends over the years. It reminded me of the principles that I keep in working incident response. I leaned on: 1. Being the most calm. 2. Being empathetic. It's ok for people to feel negative emotions, especially during events, I lean on understanding and channeling those emotions. 3. Assist in making action-oriented decisions smaller and more numerous. People, including you, make mistakes in responding to events, making decisions smaller and incremental gives people the opportunity to make smaller mistakes. In this case this meant asking questions about their driving, their speed, their gas situation, their fog lights, etc. Each of these are small decisions that can help people calm down and focus, as well as keep them safe. 4. Helping them avoid pitfalls. 5. Being honest. If I didn't know things I told them. If I knew things, I told them why (experience, news article, whatever). I also follow a mantra of: 1. Manage safety first. 2. Manage convenience second. 3. Manage emotions third. Getting folks to a safe spot is obvious, managing convenience to reduce the immediate challenges is important, but people often confuse this for the first priority. Knowing that it comes second enhances the first priority. Having emotions come last allows people to feel but also let's them know that their feelings don't influence what keeps them safe and what is most convenient. Always remember to communicate, even over communicate, your thoughts and focus on a mantra, your underlying focus is on their long-term well-being. Be flexible for people, but stringent on your principles. I remind folks that this is what I do. For 20+ years now, helping folks in situations, at it's core, is what I do. In professional terms since Blaster and MyDoom. Over that time, it became ingrained in who I am. Let them know that you're honored you could be on the other end of the phone in that situation with them. You're there for it. And lastly, maybe the most important. When everything is all said and done, whether it's a week, a month, whatever. Ask if they're ok. Over the years I've played virtually every role in industry in events (interim CISO, response commander, responder, SME, whatever), as I reflect on that, I recognize that these principles and steps have helped from all of those angles. My heart goes out to everyone affected by the fires in SOCAL. Be safe and take care of each other.

43

"Something Better Change" in the words of 70s New Wave band 'The Stranglers' and plainly today something had better change to the cybersecurity of healthcare across the USA, which has become a near constant victim of rising cybercrime. The healthcare industry simply wasn't designed to be a secure industry like banking or defense - it was designed to save lives and treat patients. It lacks so many things to be secure, including the resources to become so, and that's why new proposed US government regulations are a mixed bag. Tying Medicaid or Medicare reimbursements to new security requirements under a federal rule due to be proposed in the coming weeks may sound like a good thing, but without direct assistance from government (other than some minimalist security training), its not going to move the needle. While many healthcare organizations especially the payers and payviders are raking in billions in profit like UHG ($22 bn in 2023) others, especially small and rural healthcare providers, are being drowned by high costs, staff shortages and declining reimbursement rates. Small hospitals also lack cybersecurity capabilities and teams. Meanwhile out of control medical bills, cost-shifting to the insured, and static insurance limits, place more medical costs on patients who cannot afford them, don't pay, or decline services even with insurance. US healthcare is inextricably broken, and moving the needle on healthcare cybersecurity requires so much more than tweaking the regulations and expecting a different outcome. It requires a whole system approach to reform - one that is politically risky for politicians when lobbyists have so much power and who want to keep things just they way they are - broken but lucrative for their clients. Keeping patients and their medical data safe and secure should be a core mission of healthcare providers, as should the availability of healthcare systems to provider care when under attack. Yes, resiliency to cyberattack is entirely missing in this industry. Lack of segmentation means a single compromised system can take down an entire hospital, or in Change Healthcare's case nearly half of the country! Governments should be fostering and paying for highly resilient healthcare shared infrastructure that is secured to military standards. Healthcare is after all part of Critical National Infrastructure (CNI). In times of rising geopolitical tensions CNIs are coming under increasing levels of attacks from adversaries and their criminal proxies and it is the constitutional duty of the federal government to protect its citizens from harm, especially in times of war. And if you look out there, we are most definitely in a hybrid cyber war. While sticks are required to convince some healthcare CEOs and boards to make cybersecurity a priority and a core mission, so too are meaningful and substantial carrots that encourage cyber-safe behavior and investments in cybersecurity people, process and technologies. .

29

7 Comments

👉🏽 The FBI suggests four actions “to protect yourself from putting yourself at risk: ✔ Regularly clear your cookies from your Internet browser. ✔ Recognize the risks of clicking the ‘Remember Me’ checkbox when logging into a website. ✔ Do not click on suspicious links or websites. Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission. ✔ Periodically monitor the recent device login history from your account settings.” “Cybercriminals are gaining access to email accounts,” the FBI warned this week, even when accounts are protected by multifactor authentication (MFA). Attacks begin when users are lured into “visiting suspicious websites or click on phishing links that download malicious software onto their computer.” Email access itself comes by way of cookie theft. Not the devilish tracking cookies that we read so much about, and which caused havoc when Google reversed its promise to eradicate them from Chrome. These are session cookies or security cookies or “remember me” cookies. They store credentials to stop you having to log in every time you visit a website or access one of your accounts. The threat affects all email platforms providing web logins, albeit Gmail, Outlook, Yahoo and AOL are by far the largest. The same threat clearly impacts other accounts as well, including shopping sites and financial platforms, albeit there are now often additional protections in place, especially with financial accounts. MFA is not usually stored in the same way, and criminals use other means to steal live codes. “Many users across the web are victimized by cookie theft malware,” Google has warned, “giving attackers access to their web accounts.” While “fundamental to the modern web... due to their powerful utility,” Google describes security cookies as “a lucrative target for attackers,” and that problem is getting worse. #fbi #cookies #hackers #malware #mfa

5

1 Comment

Cyber threats are increasing—especially in the healthcare sector. Risks to patient safety are rising exponentially, yet most healthcare organizations are underprepared to deal with these threats. Safeguarding today’s patients and your organization is not just an IT problem—it's a critical priority for everyone involved. With comprehensive strategies and proactive measures, we can protect patient data and ensure the continuity of care. Order the book here: https://lnkd.in/eYaHdGAw #Cybersecurity #DataProtection #RiskManagement #PatientCare

11

For many hospital and health system leaders, moving data from old systems often feels like a tick-the-box exercise—transfer the data in any way possible and let it gather dust until it's required for compliance, regulation, billing, clinical reports, or information release requests. This approach severely limits the potential of that data. However, forward-thinking executives see the hidden value in their software systems. When done correctly, archiving can unlock and normalize legacy data, enabling workflows that are easily accessible through today's advanced and secure interoperability channels. With the rise of industry standards and AI, there's newfound hope that data from over a decade ago can be just as valuable now as it was when first created.

1

Very true words, while we focus on cybersecurity threats we must also remember that there are physical security threats out there too.

3