Social engineering threats are a reality that the healthcare industry is beginning to prioritize. Franciscan Health System of Tacoma, Wash. recently dealt with an email phishing attack and part of taking phishing attacks seriously is educating users.
David Holtzman, CynergisTek Vice President of Compliance, explained to HealthITSecurity.com the importance of training users on the current phishing threats that hackers are attempting to use these days. These well-crafted attacks attempt to take advantage of human nature and lead users to click on malware-laden links.
What types of social engineering trends are you seeing in work with clients?
Our clients are clearly seeing an increase in attacks or targeting of their systems through phishing attacks. Hackers are sending communications to recipients who are employees or physicians on the email networks and attached to those are links to self-executed programs that attempt to install malware into the information system. This is not a case of a hacker sending millions of messages to a system attempting to find the golden password that gets them into the system. This is much more focused on the human weakness and emphasizes the opportunities for organizations to educate their users and workforce members to be better consumers of the internet.
What do these communications normally look like?
Often times, they are disguised as communications from within the IT department, such as an email that says it’s from the help desk. Or it could be an internal communication from a CEO or other leader within the organization that has a link or some sort of prize or inducement for participating in a survey. Workforce members should be very careful to raise awareness within the organization of these threats.
We work with organizations to approach it on two different fronts. We assist organizations by developing internal phishing “attacks” where we attempt to gauge the vulnerability of the organization to a real phishing attack. And, secondly, we urge organizations to raise awareness internally, either prior to or in conjunction with one of these exercises.
What other user-related risks are you seeing?
After phishing attacks, we still see the greatest risk [for organizations] to be lost or stolen mobile devices or laptops on which data is stored. The Verizon Breach Report found that in healthcare, the greatest number of breaches were taking place because laptops or mobile devices were being lost or stolen. And it said that these devices were most often being stolen within the four walls of the facility in which the employee worked.
There were a couple of takeaways. First, encrypting your device on which data is stored is as much of a no-brainer as it gets. Secondly, if you can avoid storing data on the device, you are substantially reducing the threat of losing data through a lost or stolen device. It’s not a matter of “if” the device is going to be lost or stolen; it’s “when” it’s going to happen.
There’s two main ways that the “bad guys” are getting the data. We’re either handing them the key by not encrypting a device on which the data is stored or we’re clicking on links that install malware on our system that allows the bad guy free access to the data. The key to preventing unauthorized access to information is the user who has the device or is opening the email.