2. Why This Attack Method?
Malicious actors are finding it more difficult to break into enterprise networks. As IT managers and vendors get better at blocking attacks, cybercriminals must leverage a smaller number of successful break-ins to ensure that they can hold an organization for ransom. Breaking in is the hard part; the ransomware piece is now a commodity available from more than a half-dozen dark-web vendors. It’s therefore worth it to criminals to make sure that, once they’re in, they can take control, maintain it and maximize their chances of a high payoff. Combining multiple tools with both data encryption and exfiltration techniques, dual ransomware attacks are twice as hard to defeat.
READ MORE: What is a rapid maturity assessment and why is it useful in zero trust?
3. Why Is This a Big Deal for Healthcare IT?
Healthcare is one of the most vulnerable industries when it comes to ransomware. Either an encryption attack that locks up important patient data or an exfiltration attack that risks exposing patient health information can cause a lot of damage. Having both occur at the same time is a gut punch when a cybercriminal comes calling.
4. What Defense Tactics Should Be Used?
When healthcare IT teams respond to an attack, they must remember that multiple tools are likely being deployed: Once you find one “wormsign,” you need to keep looking because there are probably more. If you catch an attack early but don’t manage to close the attackers’ path into your network, you may also find new ransomware being deployed while you are cleaning up.
Other standard advice still applies, such as keeping offline, encrypted and immutable backups; tightly restricting remote application access; and having a recovery plan for what to do when criminals damage data or shut down networks.
DISCOVER: How can a partner help you upgrade to immutable storage?
5. How Can Healthcare IT Protect Itself?
Healthcare networks and applications have an especially high level of third-party interactions: billing companies, lab vendors, imaging service providers and so on. Many recent exfiltration attacks in healthcare have come via these third parties, so IT managers should run regular reviews of the security posture of any vendors. They should also actively limit the breadth of access to data for all third parties. Where possible, rate limits should be put into place to reduce the damage if a vendor is compromised.
Editor's note: This article was originally published on April 1, 2024.
