Cybercrime is increasing at a rapid pace, interfering with business operations, costing millions, breaching privacy and threatening national security. Our federal government is addressing the growing threat with recommendations on how to respond. The 50-page Report[i] released May 30, 2018, calls for international cooperation and partnerships across the private and public sectors.
But the key takeaway, in our opinion, is that all of us have a responsibility to participate by learning more and implementing preventative measures. Individual consumers at home, and managers in small and large organizations need to play a role by educating themselves and taking action. In healthcare, a strong HIPAA Compliance program that includes Risk Management is the best prevention available.
What is a Botnet?
Stemming from the words “robot” and “network”, a botnet is a network of robots used to commit cybercrime. One particularly damaging technique is a “distributed denial of service”, or DDoS, which is caused when a botnet is used to overwhelm a network, or a website, and simply shuts it down. Good articles explaining botnets here and here.
Criminals today want to infect and control as many connected devices as possible. The payoff may be in currency (ransomware), private data (healthcare data is 50x as valuable as social security or credit card #s) political or social disruption (attacks on voting systems, spreading of fake news through social media), or a combination. Attacks on cities are becoming more common – Atlanta and Baltimore experienced DDoS attacks recently – made possible through the use of botnets. The larger the network, the bigger the payoff.
But small networks are vulnerable too. Attacks are automated, reaching across the Internet at lightning speed and are reaching into our homes and personal devices. The picture we so often see of one hacker in a hoodie in a dark room on a keyboard is misleading – the threat is an army of robots on constant attack, not caring where it lands.
The Report Describes the Landscape and Calls for Action
The Report focuses on six principle themes and five goals. The problem is a global one and while work is underway to mitigate the risks, more needs to be done. There are tools available to prevent attacks, but many individuals and organizations do not understand the risks or haven’t taken steps to protect themselves. Goal 5 of the Report is Increase Awareness and Education Across the Ecosystem. That’s where you come in.
You Can Make a Difference
Healthcare organizations are particularly vulnerable because patient data is the gold standard for criminals selling private data on the black market. While the cybercrime crisis can seem insurmountable, there are steps you can take. Guidance on how to maximize your defenses, at home or in your organization: update your software – always install the recommended patches; maintain a quality anti-virus and malware program on all of your devices; and back up your data. In the workplace, security workforce training is essential.
In The HIPAA E-Tool®, numerous policies directly address the Report’s Goals.
The Security Rule section provides for Administrative, Physical and Technical Safeguards in protecting patient data. For example:
- Security Workforce Training and Awareness in Policy SR-13
- Protection from Malicious Software in Policy SR-15
- Data Backup Plan in Policy SR-21
- Transmission Security in Policy SR-35
The Risk Analysis-Risk Management section contains step-by-step instructions to create a robust Risk Management Plan (in line with NIST standards and the Security and Privacy Rules). The Plan is easy to archive and update every year.
The best defense against cybercrime in healthcare is a sound HIPAA Compliance Program. The HIPAA E-Tool® provides everything needed to prepare for and prevent hackers from stealing data or shutting down your business. Follow HIPAA, educate yourself and train the workforce, conduct an annual Risk Analysis, follow the Risk Management Plan, and you will be in the best position possible.
[i] On May 30, 2018, the Departments of Commerce and Homeland Security released the final Report to the President on Enhancing the Resilience of the Internet and Communications Ecosystem Against Botnets and Other Automated, Distributed Threats