ProactiveIT

Intro

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance and more.  We also bring you real world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback.  What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Unpatched Oracle WebLogic Servers Vulnerable to CVE-2020-2883

New

Chrome 83 released with massive security and privacy upgrades

Paying Ransomware Crooks Doubles Clean-up Costs, Report

Criminal group that hacked law firm threatens to release Trump documents

Likely Breach Shuts Down Arkansas Unemployment Program

Security threats associated with shadow IT

REvil Ransomware found buyer for Trump data, now targeting Madonna

Ransomware attack impacts Texas Department of Transportation

FBI warns of ProLock ransomware decryptor not working properly

Bluetooth Bugs Allow Impersonation Attacks on Legions of Devices

Ukrainian Police Arrest Hacker Who Tried Selling Billions of Stolen Records

Vigilante hackers target ‘scammers’ with ransomware, DDoS attacks

Topic 1:  Home office technology will need to evolve in the new work normal

Topic 2: Verizon Data Breach Report: DoS Skyrockets, Espionage Dips

Topic 3: April 2020 Healthcare Data Breach Report

https://www.phe.gov/Preparedness/planning/405d/Documents/tech-vol1-508.pdf

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcript (Edited)

Is the proactive IT podcast this week the latest in it in cybersecurity news. Plus paying ransom demands doesn’t pay breach statistics for business and healthcare and preparing for the new normal work from home. This is Episode 30 Hi everyone and welcome to the productive it podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech, a client focused and security minded consultant located in Central Connecticut, you can find us at and wash tech comm that’s NW Aj tech.com. Alright, as always, thank you for joining us in this week’s episode of the productive it podcast. We have lots of stuff to share with you today updates, and HIPAA news, security news, all kinds of interesting cyber security and compliance news. But before we jump into it, I want to tell you that I am now part of the 405 D task force which is a federal task force that is that goal is to improve cybersecurity in healthcare, so be looking for more of that to share with you in the future. It’s a lot of what I’ve been sharing with the HIPAA education in the last few weeks. So I’m excited to be a part of that. And my first meeting will be in July. So look for more of that to come. We do have a number of updates to talk about. But before we jump into that, I want to again, thank you for listening. Wherever you’re listening to this, if you could like share, comment or review. We’re just trying to reach the masses so that we can share all of this relevant information with them as well. And that will better prepare business owners, healthcare providers, lawyers, financial firms, just really any business owner to be prepared for the inevitable and that is to be a victim of cyber attack. Also, if you’re in a HIPAA compliant business, if you could go to Facebook, in Facebook search, type in get HIPAA compliance and join that group. That’d be awesome too, because then you’ll learn everything that I learned, plus what I already know, plus the information that I get to share out to people and you’ll be better prepared in your healthcare practice for HIPAA compliance in cybersecurity. All right, as I mentioned, we do have a number of updates to talk about software updates. And first, we have chrome 83 one was released, with quite a few security upgrades and privacy upgrades, but also some cool feature upgrades. The security upgrades, probably the most important. So that is the reason you should update your Google Chrome ASAP. They do did redesigned DNS over HTTPS. They also included a new safety check feature in Chrome. So kind of a future kind of security, both of those, right? Easier security and privacy control. So it’s easier to manage your security now. Enhanced Safe Browsing protection. And what that means is that when you go to a website, it will show you can enable it to show the full URL, instead of just a partial URL, which could be important, especially for phishing purposes. Actually, that is a separate feature in its own so enhanced Safe Browsing is when enabled, Google will perform real time check of URLs that will visit that you visit. For known threats, so they’ve kind of already been doing that, but I guess they’ve enhanced that even more. The cool feature that’s been added to this is group tab groups, which means you can group your tabs into, you know, like if you have Facebook, Twitter and LinkedIn all open, it could be your social media tab. If you have bleeping computer and spyware open, that could be your security, your cybersecurity tabs, things like that. So you could group your tabs into how you want to tab them and have less tabs open, I guess, in a sense, a little more organized organization. So that’s pretty cool feature. And it did address 38 security vulnerabilities in total in the update, so get it updated right away. It’s real simple to update Google Chrome. So make sure you take care of that. Drupal did release a security update. You should update to anything above and beyond a point eight So there is a a vulnerability that is impacting Drupal seven 8.7 and 8.8 that could allow a remote attacker to exploit the vulnerability to take control the affected system. Apple released a security update for Xcode. Again, I think that’s the second one this month. So get that updated. ISC released a security advisory for bind bind being Berkeley internet named domain that is a protocol in Windows. So there is a security advisory for that there is not necessarily an update, but there is a workaround. So make sure you check out the the advisories on that that is available on system and it is in regards to CVE 2020 8616 and 8617 Adobe released updates for Premiere Pro audition and premiere rush. So if you use any of those project products, update them ASAP. VMware really security update for cloud director. I think that might be the second one this month as well. There is a security VMware security advisory linked to the system Bolton and that is at VMware comm slash security slash advisors slash VM sa dash 2020 dash 00 10 dot html. And finally, Microsoft did release a security advisory for Windows DNS servers. Microsoft has released a security advisory that addresses a vulnerability affecting windows DNS servers an attacker could exploit this vulnerability to cause a denial of service condition. We talked about that a little bit on the daily episode, that is the advisor is a dV 200009. So make sure you check out that advisory it is not an update it is an advisory So Microsoft is aware of a vulnerability involving packet amplification that affects windows DNS servers and attacker who successfully exploited This vulnerability could cause a DNS server service to become non responsive. And there is mitigation and workarounds for it. Now of course we are approaching the end of the month which means Patch Tuesday is already past. So we did have a number of updates to begin a month. And if you want to listen to those that would be previous episodes for the month of May I really should start a blooper reel because the number of times I have to edit these things is go back and re record it is pretty funny. So we’re gonna jump into the news now. First up on threat post paying ransomware crooks doubles cleanup costs according to a report. The report summarizes essentially the The to summarize it, it costs $730,000 on average to recover from a ransomware attack. But if you pay the ransom, that’s if you don’t pay the ransom. If you do pay the ransom, then it will cost you approximately $1.4 million on average. And that’s according to the state of ransomware 2020 report on Sophos few other interesting statistics 73 51% of those polled said they were hit with ransomware attacks in the last year. And 73% of those said data was encrypted in the attack. So just over half of the businesses polled, and that was that’s 5000. It manages across 26 countries. So that’s quite a few businesses. I think that’s a pretty good representation of the global economy. Just over half have been attacked and 73% of those have been have had files encrypted. So 27% were Able to fend off the attack 94% of organizations that experienced data encrypted got back more than twice as many 56% recovered their data caused using backups rather than paying ransom, which was 26%. So 26% of those polled that were hit with ransomware paid the ransom, which means the recovery costs are quite a bit higher. The private sector was hit harder, though ransomware attacks in the public sector, which is believed to be one of the hardest hit by these attacks are high profile. The report shows that actually, that sector is less affected by ransomware attacks than the private sector. I also believe that probably more so the private sector is under reporting. And so that might lead to even bigger numbers if if the businesses reported cloud data is vulnerable to ransomware. There is a common misconception that cloud data is not if you’re if your infrastructure is Or ransomware, that your cloud data is safe. And that is not necessarily true. It really depends on how it is set up. So don’t just rest on your laurels when it comes to cloud security. Or I’m sorry, security overall involving cloud. Cloud infrastructure as a service is what it’s called. For the most part. We have a report on NBC News This has been reported all over the place about criminal group that hacked law firm threatens to release Trump documents we reported this last week. We talked about it a few times on the daily episode as well. A law firm in New York City was hit with a ransomware attack the law firm is Grubman Shire masalas and sacks or GSM law, I believe is I believe, it’s either GSM large GSM s law. And the law firm is a law firm for and, you know, celebrities, entertainers and so forth. And so we’re talking big names like Lady Gaga, Madonna, Bruce Springsteen, a bunch of big names in us in last week we saw the file structure for what they claimed for the information that they claim to have so that we saw the hierarchy. And there were files that said Lady Gaga and Bruce Springsteen and so forth. Now, this week they claim early in the week they claim that they had, or maybe late last week, they claimed that they had information on Donald Trump, that they were going to leak unless they received a $42 million demand. They have since said that they’ve sold that information to someone else. And now they’re looking for a buyer for that information on Madonna. I, the law firm says that they did not represent Trump at any time. So it’s hard to say whether or not they have information to supposedly there was some emails released that were somehow had something to do with Trump. I have not seen the email. So I don’t know what the what the content of those emails was. Doesn’t seem like anybody really cares about About the continent owes emails at this point. So I have to believe they don’t really have anything sensitive about Donald Trump, President Trump. But they have supposedly have sold that information now. So we’ll wait to see if anything else comes with that. That is where we’re staying at this moment. The law firm has refused to pay the ransom. They obviously do have information on other celebrities. So we’ll see what happens. on security week. That’s security. week.com likely breach shuts down Arkansas unemployment program. Now there was a few of these Massachusetts had some issues and I believe maybe Arizona was another one. A state program that was created to process on employment applications or Arkansas for self employed individuals or gig economy workers appears to have been illegally accessed and has been shut down. officials announced Saturday governor Asa Hutchinson said he learned Friday evening that an applicant for the program is believed to have somehow access the system prompting an investigation of a possible data breach. probe will determine if any personal data from applicants was obtained. If any individuals had their data compromised, they will be notified and steps will be taken to address the situation, including possible credit monitoring. Hutchinson said an outside it expert was brought in to review the system. We want to make sure that the system is in good shape. before it goes back online. The governor said news of the program breach was first reported on Friday by the Arkansas times that being last Friday, about 30,000 people have applied to the program which has had other problems earlier this month that computer glitch forced some who had already applied to resubmit supporting documents. So that’s all the details that are on that compromise. have not seen any updates to that but that was reported on Monday, the 18th the attack or the compromise. I don’t know if it was unintentional attack but the compromise occurred on May 15, Friday 2020 on hope net security we have an article here that talks about how shadow IT threats are a set shadow it is a threat to businesses a security threat to businesses. And now that we’re we’re experiencing more remote workers, that threat continues to grow. So as cyber threats and remote working challenges linked to COVID-19 continue to rise IT teams are increasingly pressured to keep organizations security posture intact. When it comes to remote working one of the major one of the major issues facing enterprises shadow it so once what is shadow IT. And users are eager to adopt a newest cloud application to support the remote work or bypassing IT administrators and in doing so unknowingly opening both themselves and organizations up to new things. Right, so I’ll give you an example of what shadow IT IS. You work for a company, you want to be able to remote into your work computer from home. So you set up TeamViewer on your work computer, you set up TeamViewer on your home computer and now you’re able to log in to your computer from home and I believe there was a HIPAA breach just recently similar to that. That is shadow it is not an approved application, you’ve somehow got the ability to install applications on your work computer which should never happen you should you should not have an administration ministry or account unless you are of course an administrator. And that creates a problem because now TeamViewer, which has been using impasse in the past, to attack other other businesses other other computer users is now running on a computer all the time somebody gets access to the count very ways that can happen. Now they have access to that work computer, and now they have access to the internal network of you of the business you work for. And now they may be able to do more damage based on that, especially since you probably have administrator access to be able to install their program in the first place. So what are the risks to not having this under control? First of all, there is the increased risk of data breaches, which basically what I just said, right, so if you have a while back, we’ll call it a backdoor. It’s not really a backdoor in the sense of you’ve been compromised. But it’s a backdoor in the sense that it administration might not be aware that it exists, they should be. And it shouldn’t have never happened in the first place. But they may not be aware that it exists, and which means it’s not being monitored, which means it could be easier access, maybe you’re not using complex passwords, like you should be multi factor authentication. Now the bad guys have a way in they get in and they still doubt compliance issues and regulation issues regularly. Issue violations. So now you have you know, you have to deal with HIPAA GDPR and some places ccpa the shield law in New York, FINRA, anything with law firm Sox, even PCI DSS right now you might be violating compliance and again I think I do recall the scenario I just talked about in a healthcare environment so Miss financial goals due to unforeseen costs. According to Gartner shadow, it represents as much as 30 to 40% of total it spin which can be attributed to several factors, oftentimes users and departments by shadow solutions within a similar product category already covered by company wide enterprise agreements, doubling up on capabilities and spending budget without the IT departments knowledge. And depending on who pays the bill shadow it tends to skew reporting, decrease, decreasing efficiency due to time consuming In redundant tasks, so in the case of TeamViewer, you know, you could do it for free, but let’s say you opted for the paid version. Now you’re paying for it, but they already have software, or maybe they use remote desktop protocol. You know, whatever the case may be, now we’re adding to the costs of the IT budget. So what are the solutions to help manage shadow it? First of all, it’s not in this article, but I will say this administrator should be the only one to have access to install programs on employee computers. It shouldn’t, should not. Most employees should not have access to that. So that would alleviate a lot of the issues. But at the end of the day, you want to make sure you’re providing it teams with a SaaS s a s management solution that brings visibility into the usage renewal schedules, costs policy enforcement and security to avoid the consequences of shadow it s s is short for software as a service when option is to introduce broad sa s management and discovery capabilities to check apps using a number of discovery methods. This would provide IT departments with full picture of their si s environment including all applications and users through a single dashboard si s management will call a SAS going forward. As a SAS management solutions also have the potential to educate users on the apps available through the business, choose the best solutions and utilize those platforms to their full potential. Now you so if you’re using Google G Suite or Microsoft 365 in your environment, then you already have a lot of SAS programs that are available to you. So check those out. But there are other dashboards, other offerings out there that you may want to take advantage of. So something to think about in your environment, make sure that shadow it is not an issue. And then, you know, give the employees what they need to do their job. Especially now that work from home is becoming a more common trend after during COVID-19 and post COVID-19 sounds like Twitter did announce that work from home would be permanent for most employees and Facebook is now working on 50% work from home as well. bleeping computer revel ransomware found buyer for Trump data now targeting Madonna we just talked about this from I think I said CBS or NBC. I don’t remember who it was. But there was another article posted a few days later that I want that I shared because it was said that it was rebel which is also sold in a KB and it is GSM law, by the way. So now they are looking for a buyer for the Trump data. So the first article shared that they had information on Trump they wanted 42 million sounds like they weren’t going to get it. So now they sold the data that they allegedly have, and they’re looking for a buyer for the Madonna data. ransomware attacks impacts Texas Department of Transportation. This is also on bleeping computer. This is also the second attack on on Texas in the last week. A new ransomware attack is affecting the Texas government. This time hackers got into the network of the state’s Department of Transportation, Texas DLT. Less than a week ago on May 8, which is now little almost two weeks ago to Texas core system was the victim of this same type of attack which resulted in servers being taken offline to prevent malware from spreading to the network. In a brief announcement on social media, Texas, d o t said it detected the attack on Thursday, May 14, after finding unauthorized access to the agency’s network. further examination determined that the event was part of a ransomware incident. immediate action was taken to isolate infected computers from the network and block further unauthorized access. It is unclear how many systems are impacted or the ransomware family used by the intruder. Some operations have been affected by this incident but Texas DLT executive director James bass says that the agency is working to ensure critical operation Continuing during the interruption, agencies website forms that technical difficulties make some features unavailable and that they are working to resolve the issues promptly. As it usually happens with this type of cyber attack, the FBI was alerted and evolved a new investigation. So, Texas has now had two ransomware attacks in two weeks on their different government departments. FBI warns of pro lock ransomware decrypter not working properly. So pro lock which was formerly pawned locker, p w, and D. locker is now called prologue. prologue is another ransomware group that is now working with another malware quack something to gain so quack. I forget what it’s called. It may be hearing an article, but it is a a banking Trojan which means it’s grabbing credentials so that they have access even after the ransomware is removed crackpot that’s it QAQQ ak bought. But pro lock, the decrypter itself doesn’t work properly. So this is one of those cases where you pay the ransomware demand and you get the decryption key and it doesn’t work. And the reason it doesn’t work is files larger than 64 megabytes may become corrupted during the decryption process and integrity loss of one byte per one kilobyte is possible with files over 100 megabytes and additional work may be needed to make the decrypter work properly. So this is a case where paying the ransomware probably is going to cause more problems than than if you just restore from backups. So assuming you have backups, that is a prologue is as serious a threat as the others which is me so don’t panic. You wrote in locker Gaga, or locker goga. That is, those are now telling people that if you don’t pay the ransom, they’re going to release data that they have stolen. And I believe prologue is now doing the same thing. So paying might not help you restore, but it will certainly, hopefully help prevent a data breach from becoming public. Now, I’ll say it again. ransomware attacks should be considered data breaches. They’re not in most cases, they should be at this point. Threat post shared an article that said Bluetooth bugs allow impersonation attacks on legions of devices. So a host of unpatched security bugs that allow bi s attacks, effects Bluetooth chips from Apple, Intel, Qualcomm, Samsung and others, which is pretty much every smartphone that’s out there. academic researchers have on Covered security vulnerabilities in Bluetooth classic that allows attackers to spoof pair devices. They found that the bugs allow an attacker to insert a rogue device into an established Bluetooth pairing masquerading as a touch a trusted endpoint. This allows attackers to capture sensitive data from the other device now, I shared last week, the plan going forward for COVID-19 and contact tracing and it was going to use Bluetooth. And Apple and Google were both going to come up with a way to do this at the operating system level. And my concern was Bluetooth is always vulnerable. There’s always vulnerabilities that pop up a Bluetooth in here we go. So now what could happen the bugs allow Bluetooth impersonation attacks, which is big for short bias on everything from Internet of Things, gadgets to phones to laptops, according to researchers at the equal equal Polytechnique Federal de Lausanne EP FL in Switzerland. The flaws are not yet patched in the specification those some effective vendors may have If implemented workarounds, we conducted B is attacks on more than 28 unique Bluetooth chips by attacking 30 different devices the researcher said, at the time of writing, we were able to test chips from Cyprus, Qualcomm, apple, Intel, Samsung and CSR, all devices that we tested were vulnerable to be is attack. The issue lies in pairing bonding protocols used in the specification when two Bluetooth devices are paired for the first time they exchange a persistent encryption key, the long term key that will be will that will then be stored so that the endpoints are therefore bonded and will connect to each other without having to perform the lengthier pairing process every time. And if you’ve ever paired a Bluetooth device, you know, it’s not always fun for the attacks to be successful and attacking device would need to be within wireless range of a vulnerable Bluetooth device that was previously established bonding with a remote device with the Bluetooth address known to the attacker, which isn’t that hard because if the Bluetooth I’ve so I have Been places where somebody is trying to connect to a Bluetooth device, and it pops up on my phone, and I can choose to accept or decline and of course, I was declined. But if I accept it, I now have access to that device, potentially. So it’s really not that hard to grab the MAC address of the of another device. The post pairing connections are enabled because of devices, let’s call them Alice and Bob perform a background check to make sure both possess the long term key. This is done using the legacy secure connections or secure connections protocol. Inside the Bluetooth specification, which verify three things Alice’s Bluetooth address Bob’s Bluetooth address and a shared long term key. And then it goes on to talk about how the technical, the technical, the technical information behind the attack and what could occur. But essentially, if the attack happens, they could read all of the data on your phone. Potentially. So, remediation is forthcoming there is there has not been any updates to anything yet. And as you know, if you own an Android, you have to wait for the specific vendor of your Android device unless you have a Google phone. You have to wait for the vendor to release the update. And then with Apple that’s always update to everything when they release the update. So this was the concern that I expressed when it came to contact tracing. And here we have it. On Hacker News, UK Ukrainian police arrest, Haku tried selling billions of stolen records sold. The Ukrainian police have arrested a hacker who made headlines in January January last year by posting a massive database containing some 773 million stolen email addresses and 21 million unique plaintext passwords for sale on various underground hacking forums. And an official statement released on Tuesday the Security Service of Ukraine. SBU said it identified the hacker behind the suit them sanics who was resident of ivano? Friends victory friends frankest. I don’t know how to say that. It’s ivano iba and oh, dash f ra nk IV sk region of Ukraine, but it did not reveal his actual identity to the media in January last year, the hacker tried to sell the massive 87 gigabyte database labeled as the largest array of stolen data in history, which according to security experts, was just a fraction of the stolen data sanics collected according to authority sanics had at least six more similar databases of stolen and protect and broken passwords totaling in terabytes in size, which also included billions of phone numbers, payment card details and social security numbers. So here’s the crazy part. So he had all this information, email addresses, he wallets all kinds of stuff, pin numbers, bank card pin numbers. He was selling the databases for between 45 and 65. dollars each. That’s not a lot of money. And so when I tell you that if your data is stolen, it’s going to be in multiple hands before you know it, that is exactly going to be what happens. Search of at his residence resulted in a seizure of computer equipment with two terabytes of stolen data, phones and evidence of illegal activities of more than $10,000 in cash from illegal transactions, which was 190,000 Ukrainian heaviness, which is approximately 70 $100 and then $3,000 in US sanics is now facing Ukrainian criminal charges for unauthorized interference with computers and unauthorized sale disseminate or dissemination of information with limited access stored in computers, if found guilty could be facing up to eight years in prison. And which, I don’t know it doesn’t seem like a lot for the amount of damage you potentially have caused. But what can I say? And if you thought vigilantes were just a thing in movies, They’re not if you thought it was just all about Batman it’s not vigilante hackers target scammers with ransomware and DDoS attacks. This is on bleeping computer hacker has been talking just or taking justice into their own hands by targeting scam companies with ransomware and denial service attacks. Last week his new ransomware was discovered called milkman victory that a hacking group stated date created to attack scammers. In a conversation with bleeping computer the hacking group known as cyber where stated that they have started targeting companies performing what they call loan scams. The victims are saying that they give loan but you first have to pay and then you get nothing to hacking group told bleeping computer. The as part of their attacks the threat actors are sending phishing emails containing links to executables masquerading as PDF files. They’re also conducting denial service attacks to bring down the company’s websites. The ransomware is being distributed as its destructive wiper attack as it does offer a way to contact the attackers and does not have the encryption key. I do not ask money because scammers do not deserve money for scamming innocent people the hackers told us instead the victims are left with a ransom note stating the computer was destroyed because we know you are a scammer. So I think it does a typo there don’t have a way to contact. The hacker group claims to have targeted the German Luz union loan company, whose website is currently down with a DDoS attack and email spreading ransomware. The attacker state that this ransomware is based on hidden tier which means that even if a key is not saved, it can still be decrypted using the brute force attacks. Anyone who is encrypted by hidden tear variant may be able to recover their files for free using Michael Dilip Michael Gleb sees hidden tear decrypter so vigilantes using ransomware sounds pretty cool. Right hot topics for the week, we have a few things we’re going to discuss. The first one on Zd net home office technology will need to evolve in the new work normal. And what does that mean? So Twitter announced either earlier this week or late last week that work from home would be a permanent option for employees. Facebook announced, I believe, yesterday that they would like to have more than 50% of their work force to be worked from home by 2030. So work from home is going to become more of a reality for a lot of companies. I know that it’s not new, and it has been growing for some time. And there were some people that said it’s great and others say it’s not. I believe it is good for those that like it’s not, it’s not good for everybody. Not everybody wants to work from home. I believe those that like to work from home are more productive. They’re just not going to work. Their traditional hours if it’s possible, they’re not Going to work through the traditional hours, the nine to five to eight hours a day. They’re going to work, you know, typically I work from roughly seven in the morning, so, three to four in the afternoon, and then I go back to work around 830 at night for a few hours. So that’s, you know, that’s my typical day. I’m still monitoring throughout the day. But that’s typical. And I think that’s true for a lot of work from home people. They break their days up around different factors that impact their schedule. So the new normal for work will be more remote spirit home, office innovation wave make edge computing, more mainstream and require more automation, immersive experiences and robotics. Those are just some of the takeaways from my conversation with Dell Technologies. CTO john Royce This is written by Larry dignam dignan di gnn on ZD net and as he says, the conversation revolves around what we’ve learned so far from the great work from home experience, experiment that and where we’re going next. So the great work from home experiment, I’m assuming is linked to another article, I’m assuming he’s talking about COVID-19 which kind of forced work from home on everybody. Here are the two key takeaways in in there is a video included if you want to go over to Xena and and watch the video. Of course the link will be in the show notes. Culture and home Environment Matters. Not surprisingly, Dell didn’t have a hard time moving more than 100,000 people to work from home arrangements. After all, Dell says wise thin clients laptops and virtual desktop platforms. Roy said when you move everyone then you start to discover some of the things you didn’t know about. We clearly understood that people weren’t would work from home. So we had the proper equipment, the proper VPN access to proper network capacity, VDI, all those things. But we started to realize that maybe we didn’t have the right environment at home. Maybe we didn’t have the right culture and a sense of people We’re getting overwhelmed but we would call zoom fatigue and other new normal scenarios. So those are good points. So first of all I want to say VPN access is critical. If you’re going to use remote desktop, it is even more critical. vd eyes, which is virtual desktops. Also a good viable option if sending them home with a laptop is not a good option. And they’re going to use their own device then VDI is another option. You can lock that down much better than you can lock down a person’s personal laptop. Zoom fatigue is becoming a real problem for some people. I think to some extent, I feel it because I’m I do hop in and auto zoom meetings probably at least two or three times a day. And then on top of that, I’m getting my kids in and out of zoom meetings right now because of the school from home. The the there are they do make something called Blue. I think they’re called Blue glasses that was supposed to help us zoom to zoom fatigue. But so there’s that. And it’s not. It’s called zoom fatigue. It’s not just zoom, it’s teams. It’s Google, it’s Facebook, it’s all of those things. This idea that part of what we do will be virtual, and part of what we do will be physical. But more importantly, those two worlds are going to intersect, we’re going to run into each other. And so some examples of that are, for instance, in our client businesses. We’ve already seen this, we have material scientists, we have mechanical engineers, we have people that actually have to work on a physical device in a lab somewhere, they can’t do that work from home exclusively. So initially, we set up programs to allow scheduling of lab space and sanitation of labs to develop a lab environment. And to get through that, but as we look forward, what we’re going to see is the environments are either going to become more automated with robotics. So that person can actually do mechanical work from somewhere else. or more importantly, maybe one person is in the lab but other person. Other people now have better visual representations better immersive technology, so they can be part of that. experience. So sort of a hybrid model, which we’ve also discussed today, whether it’s education or healthcare or any other industry, virtual and physical experiences will evolve and meld together, the definition of working from home will change. And I agree with that as well, our assumptions around that about what it meant to work from home were wrong collectively. We had we had this idea that work from home was about work life balance, you were working, or you were doing home stuff. That was what worked from home had to deal with. And what we almost immediately discovered was it wasn’t that simple. In fact, there were at least four different contexts that people had to live in or experience sitting at their desk at home at any given time over the course of a day. an immersive work experience such as zoom call, or interacting with people, a non immersive work experience, where you have different deliverables, a personal it experience, such as answering email and paying bills, and entertainment experience. The funny thing is, all of that had to happen in the same space. And so we discovered that the monitors weren’t configured properly. was hard to context switch between them. We didn’t have enough bandwidth. In some cases the devices people had in their houses weren’t powerful enough to do all these tasks and voice. technology will have to nor context to home technology experience will have to adapt to our various modes and have the capacity to manage to compute requirements. There is a very large innovation cycle coming to really make the work world at home adaptable to all of these contexts. As we look forward, edge computing we will will come to the home. As remote work evolves more to include augmented and virtual reality as well as video conferencing and data intensive applications IT infrastructure at home will change. Roy said that edge computing devices may be deployed in homes by enterprises to beef up home infrastructure. Early when we were talking about edge It was about all smart factories, in smart cities and smart hospitals. But there’s another class of edge compute that’s really interesting and This new world said Royce, and there’s their that is to augment the compute capacity of the devices that attach to that edge. AR VR and applications that need horsepower would use these edge compute devices and laggards will invest heavily now, digital transformation, laggards will invest heavily now. So what does that mean? So basically, we’re going to have some new devices. And they didn’t really talk about security in here that will also play a big role in this because typically the home user has a home router. And that’s the extent of their security. They may have a you know, maybe an ABG or an Avast or some other relatively cheap malware protection. Things like that. And then so that’s, that could create a problem. There, they’re also probably less likely to be security focused at home. So that’s going to create a bit of a struggle for for us It teams around the world. those are those are concerns on the digital transformation. laggards will invest heavily now, do we have some some companies learned really quickly that they’re going to have to invest in work from home. And they saw that over the last few months. And they saw the struggles and I saw it across different industries. Personally, we handled, you know, everything from healthcare to law firms to even a municipality. So, it is it is something that that should have been addressed a while ago. You know, this, the ability to work from home has been fairly easy now for probably close to 10 years. And it’s gotten easier over the last few years, especially with the with the explosion of zoom and other collaboration platforms, slack and teams. So now that it’s easier than ever, those that didn’t invest in that are going to invest in that and probably more than ever before. Alright, so we have a couple of reports to go over. We have one from Verizon Verizon data breach report. DDoS skyrockets, that’s denial service and espionage tips. So you may or may not be aware of Verizon issues an annual report. That is called the data breach investigations report DBI RS for short. They released it. This Week in denial service attacks have spiked over the past year while cyber espionage campaigns have spiraled downwards. That’s according to Verizon 2020 data breach investigations report released Tuesday, so that was Tuesday, May 19. And so they analyze 32,002 security incidents and 3950 data breaches across 16 industry verticals. Notably this year’s DDoS attacks increased in number by 13,000 incidents and we’re also seen as a bigger part of cyber criminals tool boxes DDoS attacks made up 40% of security incidents reported beating else to cry beating out crimeware. In web applications while DDoS attacks use different tactics, they most commonly involve sending junk network traffic to overwhelm and crash networks systems. It doesn’t help that cyber criminals have created new and dangerous botnets to launch DDoS attacks like Kashi and Mariah variance over the last over the past few years. While the amount of this traffic is increasing, as mentioned in DDoS, which we don’t just look at the number of attacks that are conducted, said researchers, we also look at the bits per second, which tells us the size of the attack and the attacks and the packets per second, which tells us the thruway of the attack, in other words, how much traffic is coming through. What we find is that regardless of the service used to send the tax, the packet to bit ratio stays within a relatively tight band and PPS hasn’t changed that much over time, sitting at 570 megabits per second for the most common mode. Cyber cyber espionage attacks, meanwhile, have seen a diurnal downward spiral dropping from making up 13.5% of breaches in 2018 to a mere 3.2% of data breaches in 2019. That may come as a surprise given that espionage campaigns were actually on the rise in 2019. Verizon DVR, in addition, a slew of cyber espionage campaigns such as ones targeting the who, that’s the World Health Organization, several governments in Asia Pacific region and more were on earth over the past year, but researchers say underreporting which we talked about earlier, some some of the private sector anyway might be under reporting may be a factor in the duping statistics, drop and wrong numbers could be due to either under reporting or failure to detect these attacks. But the increase in volume of this other patterns is very much responsible for the reduction in percentage said researcher So in other words, if last year you had 100 cyber attacks and you 15 of those were cyber espionage and 10 of them were DDoS then your number of cyber espionage looks bigger than DDoS. But this year, there’s 50 DDoS. And still 15 cyber espionage hasn’t changed, but this percentage goes down. In fact, financially motivated breaches continue to not only be more common than espionage campaigns, but a wide margin by a wide margin making up 86% of all breaches but also increasing over the past year, they said, financial origins financial, motivated breaches that really shouldn’t come as a surprise the amount of ransom to dollar amount for ransom demands has continued to rise year over year, month over month and it’s going to continue to rise because people keep paying when it comes to data breaches almost half 45% stemmed from actual hacks while 22% use social attacks that social engineering, and we’ve talked about social engineering extensively. 22% breaches involve malware and 17% were created by errors and 8% of breaches stem from misuse of authorized users by authorized users. In fact, internal actors were only around 30% of the breaches with the majority 70% actually coming from external actors, while researchers said that incidents stemming from inside actors have grown over the past few years, that’s likely due to increased reporting of internal errors rather than evidence of actual malice from these actors. External attackers are considerably more common in our data than are our internal act attackers and always have been said researchers This is actually an intuitive finding as regardless of how many people there may be in a given organization. There are always more people outside. Nevertheless, it is widely held opinion that insiders the biggest threat to an organization security but one that we believe to be erroneous. malware has been on a country consistent and steady decline as a percentage of breaches over the last five years, researchers said due in part to the increasing level of access by cyber criminals to credentials. So in other words, it’s easier to get credentials, so why bother with malware? We think that the other attack types, such as hacking and social breaches benefit from the theft of credentials, which makes it no longer necessary to add malware in order to maintain persistence, said researchers now some attackers add to both they steal their credentials, just steal the data, and it will add malware because they may want to come back later. According to accordingly, the top malware varieties and data breaches was taught by password dumpers which are used to collect credentials, followed by Capture App Data and ransomware ransomware attacks continue to grow over the past year and have created high profile clients and headaches for companies such as Norsk hydro ransomware is the third most common malware breach, variety and second most common malware incident variety party If this continued growth can be explained by the ease with which attacks can kick off a ransomware attack. Researchers researchers stress in 7% of the ransomware threads found in criminal forms and marketplaces service was mentioned, suggesting that attackers don’t even need to be able to do the work themselves, said researchers they can simply rent a service kickback, watch, eat, watch cat videos and wait for the loot to roll in. So in other words, I could pay someone to run a ransomware attack for me and not have to worry about all the all the technical details. The Verizon DVR also poked down data breaches by vertical to show that cyber criminals are drastically changing how they are targeting industries for instance, point of sale related attacks once dominated breaches in accommodation and food services industry However, they have been replaced by malware attacks and web application attacks is instead responsibilities spread relatively evenly among several different action types such as malware error. And hacking via stolen credential said researchers. Financially motivated attackers continued to target this industry for the payment card data it holds. The educational services industry saw phishing attacks trigger 28% of breaches and 23% of breaches stem from hacking via stolen credentials. ransomware is a top threat for education space, with ransomware accounting for approximately 80% of malware infections. In the incident data ransomware attacks triggered by financial motivations also plagued the healthcare industry. Other top security issues leading to breaches include lost and stolen assets basic human error, however, privileged misuse, which has topped data breach causes for healthcare in the past, for the first time this year wasn’t an issue in the top three in the 2019. Report, privileged misuse at 23% of attacks, while 2020 has dropped to just 8.7%. So that’s good news and healthcare. I will say this the sectors, the verticals that saw the most activity, education, finance, healthcare information, manufacturing professional public. Well, those aren’t really verticals but yeah. I think that’s it. So those are the so you have you have Let’s do that again. So there’s healthcare. He has healthcare, information, finance, education, manufacturing. Those are the verticals that seem to have the most activities. All right. And then we also have the April health, April 2020, healthcare data breach report. There were 37 incidents, healthcare data breaches of 500 or more records again, pretty much on pace for the last six months. You know, going back all the way back to November was 36 December 41 January 33. February 39, March 36th and April 37th. So that is pretty much on par with what it’s been. What is down is the number of healthcare records that were breached for April 442,943. So just shy of 443,000 versus march was 129,000. And February was 1.5 million. So we’re back to January levels, which was 463,000, roughly. So that is good news. The 10 largest breaches most of them were relatively small compared to previous months. All were health care providers with the exception of beacon Health Options Inc, which was number 10. On the list that was a business associate that had 6723 and that was lost other portable electronic device, which means those were not encrypted. And I’m not sure I have to double check but I believe that was the one in Texas where hard drives went missing. So the the top nine Beaumont health 112,000 email meridian health services Corp 111,000 email Arizona endocrinology center 74,000 electronic medical record advocate Aurora health 27,000 email network server, doctors community Medical Center 18,000 email injures braces 16,000 network server Andrews braces By the way, so that is a dentist provider. A dental provider 16,622 individuals were impacted and it was a network server UPMC Altoona Regional Health Services almost 14,000 email, Colorado Department of Human Services Office of Behavioral Health 8000 network server and agility center orthopedics 7000 email, causes of April 2020 healthcare data breaches hacking our it incident 18 unauthorized access disclosure 16 theft two loss one so those bottom two theft two and last one, not a lot. And by the way, it was Are those are mitigated by encrypting your devices. So if you had to encrypted those devices then those three aren’t even reported location or the breached pH I pH I again being protected health information location is other two other portable electronic devices three paper and film eight the fact that eight of the breaches for April were still paper and film is, is I don’t know it just seems a little crazy to me. Email 18 44% of all breaches for April. Again, email in this just tells me yet again, we’re still not taking the precautions to make sure that PHP is not an email, and that we’re not locking down those email accounts and we’re not training our employees on phishing, network server five laptop three electronic medical records to now we’ll laptops, three and other portable electronic devices also threats. So that’s six. Those two, six of those are mitigated with encryption, electronic medical records, if you have multi factor authentication turned on, maybe that doesn’t happen. So that’s eight right there eliminated. And then finally, what data breaches by covered entity type so you have three or business associates to forward health plans in 30 of them were healthcare providers. So healthcare providers are, are appear to be dropping the ball in April. It’s going to be different. Um, you know, we we’ve only had one one financial penalty imposed so far this year, and I believe that was in January. So COVID-19 has definitely taken away from from the enforcement activity for the year so far. Now that we’re starting to reopen. Perhaps we’ll See more enforcement. I don’t know what will happen yet. But remember one of those breaches was in Connecticut. We are based in Connecticut. One of those breaches did occur in Connecticut in April. I think it was April that it happened. So that’s it for the HIPAA data breach report for April. We’re gonna move on to our HIPAA education. All right, we’re going to continue on with our 405 D Task Force best practices cybersecurity practices for small healthcare organizations. This being the taskforce that is trying to improve the cybersecurity posture for healthcare organizations around the world and we are on practice number six network management. So computers communicate with other computers through networks. These networks are connected wirelessly or via wired can actions like network cables and networks must be established before systems can interoperate networks that are established in a secure insecure manner sorry increase an organization’s exposure to cyber attack. Proper cybersecurity hygiene ensures that networks are secure and that all network devices access networks safely and securely. Even if network management is provided by a third party IT support vendor the organization must be must understand key aspects of the proper network management and ensure that they are included in contracts for these services. Well, so these are smaller healthcare practices. So that would mean that more than likely to have do have outside it vendor third party it vendor. This is probably going to change now with the work from home push that we’re going to see in the coming months and years because of COVID-19 and COVID-19. The first part of this is network segmentation. And remember, this is all based on the NIST cybersecurity framework right? So we get the information from NIST cybersecurity framework. The first part is network segmentation, configure networks to restrict access between devices to that which is required to successfully complete the work. This will limit any cyber attacks from spreading across the network. So what does that mean? If you have a piece of medical equipment, and this happens a lot now, so we have medical equipment out there that’s running outdated versions of Windows, or whatever operating system Am I have, so a lot of windows seven still exists? I think there’s even some Windows XP out there still. And these are a lot more susceptible than Windows 10 right now. those devices should be segmented from your office staff network, they should not have the same they should not be on the same network. It is called network segmentation, meaning they’re not they they may be connected to the same devices but they cannot communicate with each other is what it means. This allow all internet bound access in to your organization network, if your host servers that interface with the internet, consider using third party vendor who will provide security as part of the hosting service, restrict access to assets with potentially high impact in the event of compromised. This includes medical devices and Internet of Things, items like security cameras, badge readers, temperature sensors, and you’re going to see more of those building management systems. And by temperature sensors. They mean building temperature sensors, but also you’re going to see temperature sensors now, for people. Just as you might restrict physical access to different parts of the medical building, which is a medical office. That’s a good point. So you you’re going to lock up offices with hope you lock up offices that might have files and maybe computers and so forth that people shouldn’t have access to. Although I gotta tell you, I don’t see that a lot of the time. It’s important to restrict access of third party entities including vendors to separate networks allow them to connect only through tightly controlled interfaces. This limits the Exposure to an impact of cyberattacks on both the organization and on third party entity established and enforced network traffic restrictions. These restrictions may apply to applications and websites as well as to users in the form of role based controls restricting access to personal websites eg social media couponing online shopping limits exposure to browser add ons or extensions, in turn, reducing the risk of cyber attacks. So you can also include some DNS filtering that will block out different types of traffic that you don’t want on on your network. So in other words, if you want to block social media sites, you can block those if you want to block adult oriented websites, you can block those which you should block those. Then you have physical security and guest access. Just as network services need to be secured physical access to the server and network equipment should be restricted to IT professionals configure physical rooms and wireless networks to allow internet access only Always keep that in network closets locked Of course grant access using badgers rather than traditional key locks disable network ports that are not in use. maintained network ports is inactive until an activation request is authorized. This minimizes the risk of unauthorized users plugging in to in an attempt to it to an empty port to access to your network. This used to happen a lot I don’t think it happens as much anymore, but people used to just walk in with a laptop with an ethernet cable plugged into the network and do what they have to do. In conference rooms or waiting areas established guest networks that separate organizational data and systems the separation will limited accessibility of private data from guests visiting organization, validate that guest networks are configured to access authorized Guest Services only. I would take that a step further and say you shouldn’t have separate networking devices for those networks. So Know the the trend now is to have a device one device that has separate networks. So you have your internal network your guest network. Well, that could the potential the risk that exists that that guest network can be used to access the internal network. While it’s minimal, it is higher than if you had to separate two separate devices, maybe even two separate networks. For you know, if you have separate internet connection coming into your practice for the guests that would mitigate any chance of being able to access your internal network and intrusion prevention. So implement intrusion prevention systems as part of your network protection plan to provide ongoing protection for your organization network. Most modern firewall technologies that are used to segment your network include an intrusion prevention system component, implementing IPS and configuring them to update our Automatically reduces the organization’s vulnerability to known types of cyber attacks. IPS are available as part of a suite of next generation network applications or standalone products that can be added to existing networks. So you may have heard of intrusion prevention systems, what they do is they watch for traffic on your network that wasn’t there before maybe, you know, there’s different ways there’s different ways of doing it. But typically they watch for traffic that wasn’t there before. And if they see it, and they block it, that’s kind of layman’s terms. threats that are mitigated by this type of by this practice include ransomware attacks, loss of depth or equipment or data, insider accidental or intentional loss of data attacks against medical service that may affect patient safety. So we just talked a few minutes ago about the April 2020, healthcare data breach report and some of that included theft or lost devices. So those threats would be mitigated by instituting these practices. Heard it is time for the HIPAA breach report for the week. I don’t recall if we shared last Friday’s on last Friday’s podcast, so I’m going to share it today and if it’s redundant and it’s redundant, but we do have a few from last Friday, and then we have a few more that reported a couple of days ago. Management and Network Services LLC, a Dublin Ohio based provider of administrative support services to post acute health care providers has discovered the email accounts of some of its employees have been compromised. You might be wondering why I’m stressing the word some, and it may 4 2020 Breach Notification Letter Mns explained that it learned on or around August 21st 2019 that’s several employee email accounts had been subjected to an unauthorized access between April and July of 2018. The analysis of the email accounts recently revealed five accounts contain a protected health information of patients of its accounts. So that five accounts that’s a lot of accounts that are compromised the information and emails and email attachments vary from individual to individual, and may have included the following data elements name medical treatment, information, diagnosis information codes, medication information, dates of service, insurance provider, health insurance number, date of birth and social security number. a limited number of individuals also had their driver’s license number, state ID, card number and or financial account information exposed. And then SS taking steps to improve email security such as enhancing password policies across the entire organization and implementing multi factor authentication for employee email accounts. So that’s a little too little too late so they did not have these things. in place, they were not educating their employees. They did not use. They did not adhere to the 60 day Breach Notification rule. A lot of failures on the part of this breach, Santa Rosa, and Rob Bronner Park oral surgery on Portland, Oregon, or in Portland, Oregon has discovered the email accounts of one of its employees was accessed by an unauthorized individual. The breach was detected on March 11 2021. suspicious activity was detected in the email account. The forensic investigation revealed the email account was breached on December 20th 2019. And access remained possible until March 11 2020. So that’s almost three months of of access. When the account was secured a compromised account was found to contain a large arm sorry range of protected health information and may have been viewed or acquired by the attacker. So they don’t show they don’t listen to how many people were impacted by this. They does say affected individuals may have been offered. affected individuals have been offered complimentary membership to my ID care, credit monitoring and identity theft protection services from ID experts Santa Rosa and rohnert. Park Oral Surgery is reviewing and enhancing its policies and procedures and will take further steps to improve information security. Oral Surgery, dentists, Ph I have 3683 ash to tubular County Medical Center patients exposed online as Tupelo County Medical Center and affiliate of Cleveland Clinic is notifying 3683 patients that some of their protected health information has been exposed online. on or around January 6, a CMC posted an Excel spreadsheet on a website to comply with government requirements about medical costs disclosures on March 12 2020 HCMC, learned that a limited amount of protected health information had been accidentally included in the spreadsheet The exposed information was limited to patients names, diagnosis and health and treatment histories. No social security numbers or financial data were exposed out of the abundance of caution. affected individuals have been offered a 12 month complimentary membership to identity theft recovery services through ID experts. Kind of a failure. There should be some there should be checks and balances here that that should not have happened. And I’m not sure why a government requirement will would mean they share. I don’t know what government requirement that is. That’s just seems a little weird to me. orchard medical consulting a provider of nurse case management services for workers compensation claims has announced that unauthorized individual gained access to the email account of one of its employees and potentially access protected health information stored in the account. The attack was detected on January 3 of 2020 and immediate action was taken to secure the account. investigation revealed the account contain names dates of birth and for a very small number of individuals. Security number and medical information such as diagnosis, treatment plan and or health history, no evidence of data access, data theft or misuse of pH I has been discovered. affected individuals have been offered complimentary membership to TransUnion interact as my true identity credit monitoring service out of the abundance of caution. To prevent further breaches email security has been strengthened policies and procedures updated and multi factor authentication has been implemented yet again. And earlier this week, we have three more breaches. On Omnia, Minnesota based Mille Lacs health system has experienced a phishing attack that potential resulted in exposure more than 10,000 patients protected health information. phishing emails were sent to some of its employees containing links that direct them to a website that requested their email credentials a small number of employees were fooled by the scam so here we go again, no education normal for normal two factor authentication miralax mill x health system learned about the phishing attack on November 14 2019, and launched an investigation to determine the extent of the breach on February 24. It was confirmed that stolen email credentials were used by the attacker to access email accounts between August 26 and January 7. To review the compromised email accounts was completed on April 22, and confirmed that the patient information may have been accessed. So they had access for roughly four and a half months, which is a long time to have access to email so you, you know patient information may have been accessed it was accessed. Information potentially compromised includes first and last names, addresses, dates of birth provider names, dates of service, clinical information, treatment information, procedure types, and for certain individual social security numbers. No evidence was found to suggest patient information was obtained or misused by the attackers. All accounts have been secured a full password reset was performed for all email accounts. additional measures have been implemented to strengthen email security. infected individuals were notified about the breach by email by mail on May 11 2020, have been offered complimentary credit monitoring services. So according to the breach portal, there’s 10,630 patients affected by this. Again, big time failures, multiple email accounts means there’s no multi factor authentication, there’s no training. There’s no education, and it did not adhere to the 60 day Breach Notification rule. Northshore pain management and Massachusetts has experienced a manual aka Oh ransomware attack and the data of some of its patients was stolen, as will be the case for ransomware. So this is technically a data breach rate incident has not yet appeared on the HHS Office of Civil Rights breach portal and at the time of writing, there’s no substitute breach notice on the company’s website, the breach was covered by data breaches dotnet, which reports that approximately four gigs of data relating to the company has been published. On the tour site. You By the attackers more than 4000 files containing patient and employee information has been dumped online. The files contain a range of sensitive protected health information, including social security numbers, health information and insurance information. The Detroit based occupational therapy speech therapy and family therapy provider side genex, Inc, has discovered one of its employees forwarded a spreadsheet containing a customer containing customer information on personal email account. The breach was detected on May 25 2020. As part of the regular security review, the email was sent on March 24 2020. So one day after he sent the email they discovered the breach spreadsheet was contained. The spreadsheet did contain information such as customers, names, diagnosis codes, provider names and appointment times. No other information such as treatment notes were detailed in a spreadsheet, no reason was given as to why the employee sent the spreadsheet to their personal email account. psychogenic says it found no evidence of attempted or actual misuse of client information. So I could tell you what probably happened here? Is the employee wanting to do some work from home emailed the spreadsheet to his personal email account to do that work? Now? Is it his fault for doing that? Maybe Maybe there was no, there’s no procedures in place. We don’t know. Maybe site psychogenic should take a look at potentially making it making a way to work from home, you know, this was during COVID-19. So it’s possible that this person just wants to work from home and avoid trying to get sick. And this is this is the outcome. So that’s gonna do it for the breach roundup for this week, and that is going to do it for this episode of the productivity podcast. Until next week, stay healthy, stay safe and stay secure.

Transcribed by https://otter.ai

The post ProactiveIT Ep 30 – Breach Statistics for Business & Healthcare appeared first on Nwaj Tech - Information Tech & Cloud Support.

This is Episode 29  

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance, and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback.  What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Unpatched Oracle WebLogic Servers Vulnerable to CVE-2020-2883

VMware Publishes Workarounds for Vulnerabilities in vRealize Operations Manager

Adobe Releases Security Updates

May 2020 Patch Tuesday: Microsoft fixes 111 vulnerabilities, 13 Critical

Update on Cognizant

RIP: Microsoft to drop support for Windows 10 on 32-bit systems

DigitalOcean Data Leak Incident Exposed Some of Its Customers Data

Hacker group floods dark web with data stolen from 11 companies

REvil ransomware threatens to leak A-list celebrities’ legal docs

Thunderbolt flaws affect millions of computers – even locking unattended devices won’t help

Texas Courts hit by ransomware, network disabled to limit spread

WordPress plugin bugs can let hackers take over almost 1M sites

Maze ransomware fails to encrypt Pitney Bowes, steals files

Ransomware Hit ATM Giant Diebold Nixdorf

Healthcare giant Magellan Health hit by ransomware attack

US warns of Chinese hackers targeting COVID-19 research orgs

Topic 1:  FTC Seeks Comment on Breach Notification Rule for Health Data

Topic 2: US govt shares list of most exploited vulnerabilities since 2016

Topic 3:  Leaked NHS Docs Reveal Roadmap, Concerns Around Contact-Tracing App

Woman stalked by sandwich server via her COVID-19 contact tracing info

Utah Says No to Apple/Google COVID-19 Tracing; Debuts Startup App

https://www.phe.gov/Preparedness/planning/405d/Documents/tech-vol1-508.pdf

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the proactive IT podcast this week the latest in it in cybersecurity news, plus privacy versus health, healthcare breach notifications for non HIPAA apps and the most exploited vulnerabilities since 2016. This is Episode 29. Hi everyone and welcome to the productive it podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to By watch tech a client focused and security minded IT consultant located in Central Connecticut. You can find us at and watch tech comm that’s NW Aj tech.com. Alright, let’s jump into it. We got a lot to talk about this week along the lines of privacy and COPPA COVID-19. Not a lot of HIPAA breach news. So that’s good, I suppose. But before we jump into anything, of course, this week was also Patch Tuesday. Before we jump into Patch Tuesday, let’s talk about whether or not you’re going to comment like, share or review this podcast because if you do, we will. I don’t know. I guess I could think you live on the show. If you do. Just shoot me an email so I know you did it. And you can shoot the email to support at nwaz tech and wha tech. Go follow us on Facebook at unwashed tech and wha tech and if you’re in a HIPAA compliant business If you can join our Facebook group does centered around HIPAA compliance, it is get HIPAA compliance just search for get HIPAA compliance on Facebook. Now, as far as Patch Tuesday updates, we went over a bunch of updates that were released last week. So if you there’ll be in the show notes, but if you want to you can go back to listen to last week’s episode and get the update on all those patches to this week that was not as many but it is, of course Microsoft Patch Tuesday week. So we have First up we have VMware publishes workarounds for vulnerabilities in V realized operations manager. So not necessarily an update, as far as patching goes, but it is a workaround for a known vulnerability. Adobe did release security updates for Adobe Reader, Adobe Acrobat and for Adobe dng software development kit. So especially Acrobat and reader, get those updated, but if you’re also using Adobe dng software development Kitt patched that as well. And then Microsoft did release patches that addressed 111 vulnerabilities 13 of which were critical most of them centered around the usual suspects remote code execution. What do we got Microsoft Edge elevation privilege vulnerability that one is not as common but you have remote graphics components, remote code execution, color management, remote code execution vulnerability, Microsoft SharePoint Server remote code execution vulnerability, Microsoft SharePoint I’m sorry, scripting engine memory corruption vulnerabilities chakra scripting engine memory corruption vulnerability which we seem to see those every month. Media foundation memory corruption vulnerability, media foundation memory corruption vulnerability again, Visual Studio Code Python extension remote code execution vulnerability and that was the last one so we Did patch all of our client machines in our own machines this week? Already? No issues that we’ve seen. And of course you have the vulnerabilities the the patching from last week. So we’ve addressed all the patches we have in our environment so that you know, that includes browsers and Adobe and things like that. And we have not seen any issues. So make sure you take care of your patching. As AP as warranted, of course test and then push out. I have not seen any reports of problems either. So get it done. Okay, we have lots of news to share this week. going to start with an update from Cognizant, Cognizant, you may remember from last week they were hit with mais ransomware Tak cognitive being probably the world’s largest MSP and with earnings in the hundreds of millions every quarter, or Yeah, so we’ll get to the numbers in a moment. But anyway that were hit with Mays ransomware attack we know from previous episodes, that means typically exfiltrate the data first and then launches the ransomware. There has not been any indication that that has occurred here. But let’s let’s go with the update here. So Mays ransomware attack hit the MSP in IT consulting firm in late April. According to a first quarter earnings report statement, released May 7, the attack will impact cognizance, second quarter of 2020 revenue for obvious reasons and there may be an additional financial impact implications thereafter. So this is you know, there were a lot of ransomware attacks to report this week. But this is two Cool. Have any business when you hit hit with ransomware it’s not just pay ransom or restore your data from backups and be done with it. That’s not how it works. It doesn’t work that way. It’s going to cost you some money no matter what. So Cognizant in April 2020 disclose that the attack may impact company revenues. During a may 7 earnings call Cognizant CEO Brian Humphreys and CFO Karen McLachlan provided additional details about the attack mssp alert. I’m reading this from mssp alert By the way, has paraphrased the comments and company updates in these 10 points. So number one ransomware attack costs so far, the attack will cost cognisant about 50 to 70 million in lost revenue and, and margin for second quarter of 2020. Additionally, the company expects to incur certain legal consulting and other costs associated with the investigation, service restoration and remediation of breach so now you’re gonna have to deal with your clients who may have lost money, last had downtime and so forth to executive efforts. Cognizant mobilized its entire leadership team when the attack was discovered in April. The company also notify law enforcement agencies at that time. Three hundreds of customer communications and communications with clients were transparent from the start. The effort included hundreds of individual client calls with Cognizant security organization. Cyber experts and executive team along with to client conference calls in April for indicators of compromise. So Cognizant is proactively providing clients with indicators of compromise so that they can also do their own investigations. Five latest conference calls attack contained early in the week of May 4 Cognizant held a third conference call with customers could confirm that the attacks were contained. What that leaves a one to two week window where they may have been on the network and then we’d all know before that how long they were on the network. Six ransomware attacks ransomware attacks financial impact of ransomware attack will negatively impact Cognizant second quarter results for reasons First, the attack encrypted some of the IT consulting firms internal systems, effectively disabling them and Cognizant proactively took other systems offline to disruption impacted work from home enablement such as VDI, which is virtual desktops and the provisioning of work from home laptop second, some clients opted to suspend and cognizance access to their networks. For obvious reasons, again, billing was therefore impacted for a period of time yet to close the staffing those projects remain on cognizance books. So access to the networks because if ransomware is on cognizance network, it could jump in you know, we just talked about on the daily episode, we talked about the risk with RDP. And so this this is the risk now that you have some remote desktop protocol application running not necessarily Microsoft RDP, but windows RDP but something third party and maybe that makes sense. Clients vulnerable. Seven work from home issues are now largely have now largely been addressed. Eight regaining customer trust. Customer network trust Cognizant has meaningfully progressed in addressing the concerns of clients that have suspended our your our access to the networks. We expect to substantially complete this by the end of the month on preset nine financial impact timing most of the ransomware attacks impact on revenue margin will occur in the second quarter however, ongoing remediation costs will continue throughout this subsequent quarters. Cognizant plans to disclose the financial impact on a quarter but quarterly basis to ensure visibility and in 10. Lessons Learned Cognizant is applying lessons learned applying learnings from the attack to further harden its network. First quarter of 2020 Cognizant revenue was 4.2 billion up 2.8% a year ago quarter including a negative 50 basis points impact from the exit of certain content services businesses and then income was 367 million Compared to 441 million a year ago, so Cognizant is taking a big financial hit. And we have not seen the all the fallout from that yet. But Tom will continue to update as we get more information. On bleeping computers reporting that Microsoft will drop support for Windows 10 on 32 bit systems shouldn’t really come as a surprise, nor should you be using 32 bit systems at this point, you’re just not getting the full benefit of using any not just Microsoft Windows 10. But any operating system if you’re using a 32 bit system, you can’t use the memory like you can with a 64 bit system and the other resources that are available because of 64 bit system, you’re really not getting the full benefit So Microsoft will stop supporting windows 1032 bit in the near future. Hacker News reported Digital Ocean data leak incident exposed some of its customer data. Digital Ocean one of the biggest modern web hosting platforms recently hit with a concerning data leak incident that exposed some of his customer data to unknown and unauthorized third parties. Though the hosting company has not yet publicly released a statement it did. It did start warning affected customers of the scope of the breach via an email. According to a breach notification email that affected customers received the data leak happened due to negligence where digital Digital Ocean unintentionally left an internal document accessible to the internet without requiring any password. Now Digital Ocean is a competitor to Microsoft Azure and Amazon AWS. You know those those being the big players in the game. Then you have Google Cloud Platform and Alibaba. Digital Ocean is in there, but not quite as big. The document contained this document contain your email address and or account name, the name you give your account at signup, as well as some data about your account that may have included droplet account bandwidth usage, some support or sales, communication notes and the amount you paid during 2018. The company said in a warning email, the end they did include a screenshot of the email here. So what’s the concern? The concern is now they have enough information to potentially fish customers or past customers of Digital Ocean. So if you are a Digital Ocean client, make sure you if you get this letter, make sure you read it, understand it and make sure you’re aware that you could now potentially be fished or be compromised in some other manner because of it. hacker group floods dark web with data stolen from 11 companies. So they’re, like I said, there’s been a lot of random ransomware and data leaks this week. So this hacker group hacking group has started the floated dark web hacking marketplace with databases containing a combined total of 73.2 million user records. Over 1111 different companies. And so here are the list of the companies there’s total total pedia home Chef mineka. minted style share. g komen. I’m not sure what that is as ggu m i am mindful Star Tribune chapbooks The Chronicle of Higher Education in Zoosk, and then we we know, there was I think we reported last week a large Indian Education platform that was compromised in the datastore unit Academy here it is 30 to 22 million unit Academy user records are also on the dark web, as well. Hi, bleeping computer also reports revolution. Somewhere threatens to leak a list celebrities legal docs so rants, sort of leukemia. ransomware group threatens to release hundreds of gigabytes of legal documents from a prominent entertainment and a law firm that counts dozens of international stars as their clients and we’re talking big names here. So they grab data. As soon as leukemia and me’s and some others do exfiltrated the data in hit them with ransomware This is a law firm in New York City. I’m looking for the name of the New York of the law firm Grubman Shire, Musa lists and saxes GSM law, which is based in New York and represents dozens of heavyweight artists. So some of the clients that they have on their list on their roster, I should say, Madonna, Lady Gaga, elton john Robert De Niro, Nicki Minaj. Chris Brown, assure you to Timberland, Rick Ross and many others. Now, there is a screenshot of some of the data They claim to have so as you can see the hierarchy of the folder structure here and I see things like Lady Gaga Madonna, Priyanka Chopra, you to Kathy savate, Mary J. Blige, Nicki Minaj. Run DMC, you have another one for you, too. So, you can imagine Bruce Springsteen that Midler you can imagine the concern here, but they they still don’t Okay, me too. People behind Sodano KB claimed to have all of this information and are threatening to release the list to the dark web. Legal docs That is, if of course their ransom demands are not met. Thunderbolt on CD net thunder and Thunderbolt flaw affects millions of computers even locking unattended devices won’t help so Thunderbolt type of connection on Men are on all Macs after 2011 and some Windows computers and Linux computers as well. So Microsoft says this sufficiently was sufficiently concerned about the vulnerability of Thunderbolt three to direct media access attacks that it opted against including it on the Surface devices. But some of the Microsoft OEMs still added Thunderbolt and all Apple Mac computer since 2011 include Thunderbolt and there are also some Linux computers that have it as well. So the vulnerability is called Thunder spy. And while all Thunderbolt equipped computers are vulnerable to fulness by Intel, which develops Thunderbolt technology says the attacks were mitigated at the operating system level with kernel DMA protection but this technology is limited to computer sold since 2018. So if you have a computer between 2011 and 2019 with Thunderbolt, you may You may be exposed. Even if your computer is put to sleep or or locked, you are still vulnerable is the point of this vulnerability. So there is a little bit of back and forth between Ruttenberg who identified the vulnerability with Thunderbolt. Two thunders by and Intel as to whether or not the vulnerability is legitimate. with Intel saying that they developed Thunderbolt three which includes a policy management feature called security levels that lets Admins use cryptographic authentication to whitelist PCIe connections to to approve peripherals but Ruttenberg contends that Thunder spy completely breaks Intel security levels because Thunderbolt suffers from inadequate firmware verification, weak device authentication use of under unauthenticated device metadata and is vulnerable to version downgrade attacks. So I don’t use Thunderbolt. I can’t tell you. You know, I wouldn’t even I wouldn’t even I don’t even think I have any devices with Thunderbolt. So there’s that. bleeping computer reports Texas courts, Texas courts hit by ransomware network disable to limit spread. This was earlier in the week will actually last week a week ago today. The Texas core system was hit by ransomware on Friday night, may 8. And we’ve talked about this before where a lot of times ransomware attacks occur right before the weekend and right before a holiday. And that is to allow them more time to do damage. So this led to a branch network including websites and servers being disabled to block the malware from spreading to other systems. On Friday, May 8, Office of court administration the information technology provider for appellate courts, is state traditional agencies within the Texas judicial branch. identified a serious security event in the branch network, which was later determined to be ransomware attack. His statement published today on the site of Texas judicial branch says I didn’t see an update to this. So they were hit with a ransomware attack and took everything offline to prevent the spread of the attack. And, you know, Texas seems to be a popular target for ransomware attacks. It does not say who the ransomware attacker was. I’m not sure if it’s one of the ones that also exfiltrate data. We will I will see if I can find update for everybody. But remember last year, Texas was also hit 23 local governments and in if I’m not mistaken, that was done through open VPN, and maybe RDP. So, Texas again, popular target, kind of like Louisiana. bleeping computer also reported WordPress plugin bugs can let attackers take over almost 1 million sites. So this is The page builder WordPress plugin which is installed on more than 1 million sites. The vulnerabilities are cross site request forgery CSRF and deletes really, that leads to reflected cross site scripting attacks. And they affect all page builder versions up to an including two point 10 point 15. Attackers can exploit these security flaws by tricking WordPress site administrator into clicking specially crafted links or attachments and execute malicious code and browsers as well as forge requests on their behalf. The they are then able to inject malicious code. And I’m looking to see if there was an update to this but I can tell you that no millions of WordPress sites waiting for patches page builders development team updated to plug into two point 10 point 16 almost a week ago to fix the two security flaws and users are urged to patch their installations to avoid attacks so I should have included this on the on the patch report Patch Tuesday report but this is another WordPress vulnerability there have been quite a few of these over the last few weeks. And there was one last week that affected over a million websites so on bleeping computer Mays ransomware fails to encrypt, Pitney Bowes steals files so amaze ransomware got in and was able to exfiltrate some files, but they were they were unsuccessful in launching the ransomware attack of their the ransomware portion of their attacks so they did not encrypt anything. But they did get in and exfiltrate files this occurred on does not say when it happened but it’s it is recent. This was reported on May 11. So that would have been Monday and so probably over the weekend and They did have the wherewithal to prevent the encryption, but it looks like it sounds like the data leak, data was stolen, some data was stolen. It looks like they grabbed financial information, the names of their other directories in the screenshots. So there’s some screenshots here that you know may sent to say, hey, we’ve grabbed your information. So list of phones, customers and current employees, and I see a file files here for apps, eBay and PayPal, e commerce and finance final reporting forecast. So this looks like probably a network drive of some sort. So they did get the data. They did not encrypt anything they do. They failed in that respect. All right, we have a report from Krebs on security and I did not interestingly enough, I did not see this anywhere else. But a ransomware hit ATM giant Diebold. nixdorf Diebold nixdorf, a major provider of automatic teller machines and payment technology to banks and retailers. suffered a ransomware attack that disrupted some operations company says the hackers never touched the CTS or customer networks, and that the intrusion only affected its corporate network Canton, Ohio based Diebold is currently the largest ATM provider in the United States with an estimated 35% of the cash machine. Market worldwide to 35,000 employee company also produces point of sale systems and software used by many retailers according to Diebold on the evening of Saturday, April 25. So a weekend company security team discovered a non anomalous behavior on its corporate network suspecting a ransomware attack. Diebold said it immediately began disconnecting systems on a network to contain the spread of the malware. So it’s just told Krebs on security that dipoles response affected servers or services for over 100 of the company’s customers die boasted the company’s response to detected disrupts system that automates Field Service Technician requests, but the incident did not affect customer networks or the general public. Diebold has determined To spread it a malware has been contained I bought said in a written statement provided to Krebs on security incident did not affect ATMs, customer networks or the general public and its impact was not material to our business. Unfortunately, cybercrime is an ongoing challenge for all companies. Diebold nixdorf takes the security of our systems and customer service very seriously. Our leadership has connected personally with customers to make them aware of the situation and how we address it. So once again, another weekend ransom attack ransomware attack and this one was pro lock ransomware which when it comes to ransomware they’re not they’re clearly not one of the leaders but they are trying they are definitely trying so change was formerly known as porn pond locker. p p w. d locker is now called pro lock. We have a report us that the US warns of Chinese hackers targeting COVID-19 research or organizations This is coming from FBI and from Cisco. The threat actors affiliated to the People’s Republic of China are attempting to compromise and collect COVID-19 information from organizations in the US healthcare, pharmaceutical and research industry sectors. The ongoing attacks are currently investigated by the Federal Bureau of Investigation and the cybersecurity infrastructure security agency. As stated in a joint public service announcement that was published on May 13. China’s efforts to target these sectors pose a significant threat to our nation’s response to COVID-19. The FBI said this announcement is intended to raise awareness for silver institutions in the American public and provide resources and guidance for those who may be targeted. These actors have been observed attempting to identify and illicitly attain valuable intellectual property and public health data related to vaccines treatments and Testing from networks and personnel affiliated with the COVID-19. related research to potential death of this information jeopardizes the delivery of secure effective and efficient treatment options. So, this also comes on the heels of there was, I believe, a warning about North Korea, and also maybe one from Russia again. There was some vague warnings about the power grid electric grid for the US and for Canada and Canada was a Canadian electric or energy company was hit with a ransomware attack last week. So there appears to be an uptick in threats from that part of the world. And I suspect we’ll see even more targeted COVID-19 research in response organizations are advised to take defensive measures to block potential attacks. Assume that that press attention affiliating your organization with COVID-19 related research will lead to an increased interest in cyber activity. If your name is in the news, then they will Probably look at that and say, hey, let’s try. Patch all systems for critical vulnerabilities prioritizing timely patching for known vulnerabilities of internet connected servers and software processing internet data. Actively scan web applications for unauthorized access modification or anomalous activities. And let’s add to that. Well, we’ll get to in a moment approve credential requirements and require multi factor authentication, and identify suspend access of users exhibiting unusual activity and with that, I identify and suspend access of people no longer with the company or people that change departments. And that is going to do it for the news. So we will move on to our hot topics. All right, so first up This was on health IT security comm FCC FTC seeks comment on Breach Notification rule for health data and this is applying to third party applications not through EHR, IRS or covered entities, stakeholders are being asked to provide comments on the FTC Breach Notification rule, which requires vendors not covered by HIPAA to inform consumers and FTC of breaches within 60 days. The Federal Trade Commission is seeking comment from industry stakeholders on breach notification requirements for entities that collect personally identifiable health information but aren’t covered by HIPAA regulations, as noted by a host of others in the past, including the Department of Health and Human Services, third party apps chosen by patients are not typically covered by HIPAA, the only ones that are covered by HIPAA, not third party applications that would be through EHR vendors. So like follow my health is through all scripts, I believe instead The FTC Breach Notification rule enacted in 2009 requires vendors and related entities not covered by privacy regulations to inform individuals, the FTC and the media and in some cases of breaches. of unsecured personally identifiable health data. HIPAA an FTC Breach Notification rule requires notifications to occur within 60 days of discovering the breach, and if more than 500 individuals, the FTC must be notified within 10 days, which is a little more strict than HHS, the HIPAA rules. The rule certain rule created certain protections for personal health records, or PHR electronic records of identifiable health information that can be drawn from multiple sources and are managed, shared and controlled by or primarily for the individual FTC officials explained. Specifically, the Recovery Act recognized that vendors of personal health records and PHR related entities were collecting Consumers health information. But we’re not subject to the privacy and security requirements of HIPAA that continued. The rule requires these entities in their third party party, third party service providers to provide notification of any breach of unsecured, individually identifiable, identifiable health information. FTC is currently reviewing its health Breach Notification rule, as part of an overall periodic review to ensure the agency keeps pace with the changes in the economy, technology and business models. Reviews typically occur every 10 years, and includes standard questions around the effectiveness and, and potential benefits. The FTC is also reviewing whether the rules self should be retained, changed or eliminated and request the stakeholders to provide comment on key issues posed by the rule, such as whether it has resulted in under notification over notification or an efficient level of notification. industry leaders can also provide feedback on whether there is a need to notify to modify the rule to reflect the legal economic and technological changes as well as whether the time is requirements in breach reporting methods are adequate for the FTC is asking for insights into possible conflicts between rule and state, local and or federal regulations. FTC is also seeking insights into enforcement implications raised by direct to consumer technologies and services such as mobile health apps, virtual assistance and platform health tools along with potential ways. The rule should address developments in healthcare products or services tied to COVID-19 say like contact tracing apps, which we’re going to talk about shortly. Stakeholders were also asked whether they feel there’s a continuing need for specific provisions of the rule as well as needed benefits for consumers and evidence to support those asserted benefits. The FCC also requested insights on potentially significant costs imposed on consumers caused by the rule. Notably, the agency would also like feedback into whether the rule benefits or hinders their harmonization of the rule with HIPAA as well as if the rule indeed accomplishes the recovery x goal. advancing the use of health information technology while strengthening the privacy and security protections for health information, industry stakeholders will have 90 days to review the request for comment. And that is posted on the Federal Register. Now, a few things first of all, 10 years is a long time in the tech world. So 10 years ago, we didn’t have all these mobile health applications that we have now. And we’re not just talking about things like, like follow my heart, even though that is not a third party app, but something similar, where a patient can request information transferred to that application, but we’re talking about things like um, like, My Fitness Pal or your smartwatch that tracks your heart rate and things like that. Those are third party applications that do track health information and could conceivably lead to a data breach that would include health information for a person, they would not be covered under HIPAA because they’re not a covered entity, and they’re not a business associate. So they would not be covered under HIPAA. And that’s where the FTC steps in. A lot has changed in 10 years. So there’s definitely a need for changes to the rules around this. Also, there was a point here that I wanted to address. And that is the COVID-19 tracing apps. We’re going to talk about that in a moment. But we don’t really know 100% what that looks like yet. And I think there will be issues when it comes to privacy with these things. Google has been trying to get their hands and I think even Apple to an extent has been trying to get their hands on healthcare data for a long time. For obvious reasons. The reasons are in the healthcare is a business that’s never going to go away. And in fact, in some ways it will probably grow. They want to remain relevant and remain finally Eventually secure. These are massive organizations that have access to things that most organizations don’t have access to. So they want more. So it’ll be interesting to see how that develops, how this rule develops. And I think we’re going to see that this may, at some point tie into some of the data breach rules, data breach laws, data breach laws, we’re starting to see like ccpa in California and the shield law in New York and things like that. So I’m 90 days to review this was posted earlier this week. If you want to comment on it, it is available on the federal federal register that is regulations.gov you can go there and comment on it. The second thing we’re going to share today, US government shares list of most exploited vulnerabilities since 2016. This is on bleeping computer. US government cyber security agencies and specialists today have released list of Top 10 routinely exploited security vulnerabilities between 2016 and 2019. This was shared on Tuesday, cyber security and infrastructure security agency which assists the Federal Bureau of Investigation and the broader US government issued the a 20 dash 133 A alert through the National Cyber awareness system to make it easier for organizations from the public and private sector to prioritize patching in their environments. The public and private sectors should could degrade some foreign cyber threats to us interest through an increased effort to patch their systems and implement program to keep system patching up to date now, so what does that mean? It means that the US government has recognized that North Korea, China, Russia and some other countries, some other nation states may be trying to exploit these vulnerabilities that exist. And some of these vulnerabilities go back years. And so they recognize that also there are businesses in the private and public sector that have the vulnerabilities still, a concerted campaign to patch these vulnerabilities would introduce friction into foreign adversaries operational tradecraft and forced them to develop or acquire exploits that are more costly in western law widely effective and probably harder to deal with. Based on US government’s analysis of cyber attacks, abusing security vulnerabilities threat actors have most often exploited bugs in Microsoft’s object linking and embedding only OLED technology with the Apache struts web framework being the second most reported exploited technology of the top 10 to three vulnerabilities used most frequently across state sponsored cyber attacks from China, Iran, North Korea and Russia are CVE 20 1711 A to 2017 0199 2012 0158. Now the first set of numbers on these CVE are the year so this one goes back. That last one goes back to 2012. So that is eight years old. So says all three of these vulnerabilities related to Microsoft’s LTE technology over Chinese hackers have frequently exploited CVE 2012 10158, starting with December 2018, showing that organizations have failed to patch it, and that the malicious actors will continue abusing such flaws as long as they’re not fixed. In 2020. Cisco says that attackers have been hard at work exploiting unpatched security Citrix VPN, which was CVE 2019 11510 and pull secure VPN 2019 19781. So these are both last year. And pulse secure VPN is a big problem because even if you’ve patched it, and they’ve already, if they’ve already compromised it, they’ve already on your network and they’re already still able to continue to exploit other vulnerabilities in your network after them and so now that more people are working from home, that’s an even bigger issue. So here is the top 10 routinely exploited security flaws since 2016. So I want to start with the CVE 2012 0158. The Associated malware was trying to exploit the exploit. The vulnerability is found in various versions of Microsoft Office and Microsoft SQL Server and so forth. So it’s Microsoft products, which are routinely routinely have patches available to them. That is not getting pitch, not getting patched sorry. I just tried to combine patch and fixed so but we have vulnerabilities going back to 2012 2015 2017 1819. You know, 19 not being that long ago, but still so these are the list of the Top 20 Top 10. vulnerabilities are linked to this article. And the associated malware you so you have loci form book apone verite fins by Leighton bot Dried x we already mentioned Jack’s boss, China chopper dog call internal synergy and eternal blue you remember you may remember eternal blue from wanna cry Tosh LIFFE on warrior and kitty. The eternal blue compromised versions of Windows Vista, Windows seven. And those are still out there. I just saw recently somebody I know where the Windows version of Windows seven still running. So they’re still out there. They’re still out there and that’s a problem because you’re vulnerable. So check out that article on bleeping computer.com, the 10 most exploited vulnerabilities in the last four years. And if you if you’re guilty of any of those, get them taken care of. All right. The last thing we’re going to talk about in our hot news for today is the contract contact tracing applications that are developed or worked been worked on. I have three separate articles that show a concern for privacy in reality so the first one was reported on threat post leaked NHS docs revealed roadmap concerns around contact tracing app. So NHS is UK National Health Service. They were storing to haven’t developed an app yet they were storing information in Google Docs. That information was leaked. So a COVID-19 contact tracing app to be rolled out by the UK National Health Service has been thrust into the spotlight thanks to sensitive documents being leaked via public Google Drive link. contact tracing has emerged as a top idea for dealing with the Coronavirus pandemic and is considered by many to be an important step towards reopening economies worldwide. However, with several initiatives underway to use mobile phone apps to carry out privacy concerns have come to the forefront. The NHS app is no exception with details tractors concerned about how the information it collects could be used to leaked NHS NHS documents reported by wired showed that the officials behind initiatives are also concerned specifically around about how unverified information could be used. So this particular post raises a couple of concerns. One is how is the information going to be used, right? So if I decide to opt in, and in the US anyway, it’s going to be you can opt in, you don’t have to, you’re not being forced to do it. But you can opt into doing it. So if you do have symptoms, you put the information into the app. In the US, this is how they’re planning to do it. You put your information into the app, it’s supposed to be anonymous. And if you are, if it is determined that you had COVID-19 then that is updated. And now that anybody now anybody who’s opted in to this will be notified that they have come into close contact with you And then there’s there’s some guidelines around what’s considered close contact. Right. So the concern, one is, is my privacy secure is my privacy? Is there a potential for privacy issues within the application? And in the US, Android, Google, and Apple are planning to do this at the operating system level, meaning they will, they won’t be a third party app eventually. Right now, there are companies working on third party apps, and we’re going to talk about that shortly. One of them in Utah. But what are the potential repercussions to my privacy and health information being put into an application that by the way works with Bluetooth which has several vulnerabilities. So that’s number one. Number two, what happens if I want to be funny and I upload the wrong informations Um, I am sick and I put that I’m not sick or I’m not sick and I put that I am sick to cause fear. So that’s another concern that I don’t know how they can address that. Because it’s supposed to be anonymous, so I can, if it is anonymous, I could put whatever information I wanted, and nobody will know it’s me, theoretically. So already in UK, somebody got a hold of publicly, a link that was public on Google Drive that had some information in regards to the application being developed in the UK. But let’s take it a step further now. Now we have a woman in New Zealand who was being stalked after going to subway subway restaurant, and she put her information on the I guess they’re in there they have to write down contact details, including name email. Address, physical address and I think phone number. And she did this and then started getting essentially stalked by an employee a subway. So now that’s part two of the problems. So this here’s another another example of Privacy Information. private information being leaked to someone who probably should not have had it. So why this is, I compare this to I used to see my doctor used to keep a clipboard in the waiting area, you would come in, you would put your name, the reason you were there and who you were, who you were there to see in a clipboard sat at the front desk for the whole world to see. And so this is the same thing essentially, right? I’m writing down my name, email addresses, phone number and physical address and anybody else can see it, including employees, but also other customers can see it potentially. So if you’re If this is just like a mailing list you’re putting your name on, which is what it kind of sounds like then now you have other people seeing your name, address, phone number and physical address, name, address, email address in physical, you know, get a right name, address, and email address and phone number. And potentially the whole world sees it. That it you know, that could be cause for concern. Absolutely right. And this was a woman. And she even goes on to state that if she did live alone, she doesn’t that she she lives with several roommates it sounds like, but if she did live alone, then she could feel even more uneasy about what happened. And then this also opens up things like spear phishing, using social engineering, different forms of social engineering. There’s a lot of different little cyber activity cyber crime items that can be committed, because this information is now somewhat publicly available. And then we have another article, this one on threat posts about a company called healthy together an application called healthy together being developed out of Salt Lake City or out of Utah. They’re saying no to Apple and Google COVID-19 tracing, I get that, but they’re going to go with a third party app, which, in my opinion, is probably less secure than using Google or Apple. So healthy together app uses a raft of location data, including GPS cell tower triangulation, and Bluetooth. Again, Bluetooth being having several vulnerabilities to pinpoint users and Id Coronavirus hotspots. I just give you an example of Bluetooth and how it works. I one of my children’s activities. They’re one of their teachers. Try To connect her phone to Bluetooth speakers, and every time she tries, it attempts to connect to my phone. And I deny it because I’m not a bad person. But if I had accepted it, I now conceivably have access to everything on her phone. Who knows what’s on that phone, right? That’s how Bluetooth works. And if you’re in close, close proximity to something like that, it’s not hard to grab Bluetooth information off of another device. And we’ve seen it already with Tesla, their cars. We’ve seen it already with their entertainment systems. We’ve seen it with other phones. We’ve seen it with Bluetooth devices when you rent a car. If you don’t remove your phone’s information from the Bluetooth connection then you I mean, even if you do you might you might be at risk. And I’ve rented cars where I’ve seen five or six other phone information still there. After being rented after being Return. Now. We have Utah wanted to use this application from. It’s called healthy together. It’s called. And it’s from a startup company called 20 holdings. And they had already developed a social application that lets users see who’s around see who’s down and hang out in so I guess that’s their their tagline. In other words, the company specializes in Nebula enabling physical in person connections. It’s perhaps no surprise that 20 is Coronavirus app for Utah uses a raft of location data including GPS cell tower triangulation, and Bluetooth to pinpoint users. Now, that quote, that to me is cause for concern privacy concerns like what why do you? Why would you want that information out there? I get the reasoning behind it. So don’t get me wrong. I understand. We want to slowed the progress of COVID-19 down. And from the information I’ve seen in the last few days, it sounds like we’re already on that. But so just to give you an idea of how it works, so Jeff and Sarah are two individuals. This is as an example, this is not real people, Jeff and Sarah, two individuals in this example who don’t know each other, but they both have the app on their phones, old outlet. And so both phones are emitting Bluetooth and GPS signals all good said. So all good being the Chief Strategy Officer at 20. Through that data, we can identify whether or not two people have spent some time together from their contact, tracers can swing into action making calls and contacted ineffective and exposed persons, other contexts. So do you can see where I hope you can see where that could be a concern. A big privacy concern Again, I get the idea behind it. I don’t know that it’s worth the privacy concerns. Let’s educate the population. Let’s tell everybody, hey, this is what, what the symptoms are, this is what you need to be Look out, this is how you need to protect yourself, this is what you need to do. And then let’s let it go from there. I think what what you’re going to see is this technology somehow will get abused, whether it’s the company creating an application, and even say, where some people within the organization will have access to that data. Or somebody finding a vulnerability and utilizing it or somebody using false information. So there’s too much potential damage that can occur from an application like that. They’re probably going to move forward with it, to be honest with you. So Google and Apple and maybe some other companies and other countries are already doing In this so my concern is privacy. All right, so we’re gonna continue with our HIPAA education we started a few weeks ago around cybersecurity practices for small healthcare organizations. This is according to the 405 D. project to improve cybersecurity and healthcare organizations. And this week, we’re going to talk about asset asset management, management, asset management. So, what are we doing to secure our assets our servers, our computers, our healthcare equipment, and so forth. Organizations manage it assets using processes, referred to collectively as it asset managers. ITM is critical to ensuring that the appropriate cyber hygiene controls are maintained across all assets in your organization. ITSM processes should be implemented for all endpoints, all endpoints, there’s always that one breach where all we didn’t think that was needed. servers and networking equipment. ITSM processes enable organizations to understand their devices, and the best options to secure them. The practices described in this section may be used to support many of the practices described in other sections of this volume. So let’s talk what we have here. First of all, you need to do an inventory. And again, this is all based on the NIST cybersecurity framework framework, NIST cybersecurity framework. It completely inaccurate inventory of IT assets in your organization facilitates the implementation of optimal security controls as inventory can be conducted and maintained using a well designed spreadsheet the following question should be captured for each device. So you should capture AI asset ID primary key hostname purchase order operating system, Media Access Control address that’s the MAC address that MAC address is assigned to any piece of hardware that connects to a network IP address deployed to who is deployed to user last logged on which you know that’s that’s kind of ongoing but purchase date cost and physical location now the user logged on can be last logged on can be monitored. So you can you can continually track that. Most important probably asset IDs, operating system MAC addresses IP addresses, and who was deployed to especially with the current work from home environment, procurement. And with that, once you have established your ITM spreadsheet it is important to record each new it asset as it is acquired. This requires establishing standard operating procedures for procurement. Generally, it is advisable to assign the responsibility of collecting information on new assets to the purchaser within your organization. And then decommissioning which is probably the most important piece, right? It assets that are no longer functional or required, well, maybe not the most important but it’s close to inventory. Required should be decommissioned in accordance with your organization’s procedures. small organizations often contact contract with an outside service provider specializing in secure destruction processes. Such providers can ensure that all data especially sensitive data, are properly removed from a device before it is turned over to other parties. Additionally, your standard operating procedures should ensure that your record decommissioning of each device if you use a service provider to decommission or destroy devices, record the certificate certification of destruction so there was never a question about what happened to it. What is mitigated by this These activities so you have ransomware attacks, loss of, or theft of equipment or data insider accidental or intentional data loss and attacks against connected medical devices that may affect patient safety. Asset Management is important because things walk away and we see it time and time again. They walk away, and they didn’t the healthcare provider realizes, hey, that wasn’t encrypted. And now you have a problem because now you have potentially thousands or even in some cases, millions of healthcare records. Now, just out there, no idea what is going to come of it. You know, we saw a HIPAA breach a few weeks ago, I think, where some hard drives went just went missing. The hard drives were not encrypted. Now. There was From the healthcare provider was that you need a specialized software to be able to see the information on those hard drives. But let me tell you a software is not hard to come by that so that response is not to me is not a good response. The hard drives non encrypted is a problem the hard drives being able to walk away as easily as they did. They were in a locked room, but the person who took them out of the locker room didn’t realize the room was supposed to be locked thought it was just because it was time of the day they walked out, never to be seen again. It doesn’t take much to get required software to view healthcare records. And if so, if that’s the intention of the Deaf, maybe it’s not the intention. Maybe the intention is Hey, I just found some hard drives I could use. But if that is the intention, then it’s not going to be hard to get that information if it’s not encrypted. So Asset Management know where they are. tracked them use barcodes or use a barcode reader you can get you could put a bar reader on a smartphone and print labels off with a barcode without any printer. Really, there’s printers out there that can do that. So put a barcode on the device, scan it, you’re done with it. Well, if you can believe this, we only have one. HIPAA breach to report this week. Fortune 500 company Magellan health has announced that it experienced a ransomware attack in April that resulted in encryption of files and theft of some employee information. The ransomware attack was detected by Magellan health on April 11. When files were encrypted on a systems the investigation into the attack revealed the attacker had gained access to its systems following a response to a spear phishing email sent on April 6, the attacker had fooled the employee by impersonating a client of Magellan health, Magellan health engaged in cyber security from mandiant to assist with the investigation into the breach, which revealed the attacker had gained access to a corporate server that contained employee information and exfiltrated, a subset of that data. Prior to the encryption of files. The attacker also downloaded malware that was used to steal logon credentials. The data stolen by the hacker related to current employees, and including names addresses, employee ID numbers, and W two and 1099 information which included taxpayer IDs, and social security numbers. a limited number of usernames and passwords were also stolen in the attack. Magellan health is unaware of any attempts to use that data but has advised affected individuals to be alert to the possibility of identity theft and misuse of their data. affected individuals have been offered a complimentary three year membership to experience identity works identity theft, detection and resolution service Magellan health is working closely with law enforcement is and is aggressively investigating the breach and steps have already been taken to improve security to prevent similar breaches in the future. Of course, it is currently unclear how many of the individuals have been affected by the breach the ransomware attack comes just a few months after the company discover some of its subsidiaries suffered phishing attacks. Magellan RX management Magellan healthcare and national imaging associates were all affected. announcements about the breaches were made in September and November of 2019. With the phishing attacks following I’m sorry, with the phishing attacks, allowing unauthorized individuals to gain access to employee email accounts in July of 2019. The emails into compromised accounts contain the protected health information of 55,637 members. So this goes back to last July. It’s conceivable that the two are tied together, right. So they got some information from that attack back in July of last year and then used it to fish Someone else this year, because it says spear phishing email. Spear Phishing means that was somebody that was targeted in the organization. So it’s conceivable that the information from last year’s attack was used in this year’s attack. And that’s why you have to be careful with that information. And that’s why you have to teach your employees how to recognize phishing attacks. And that’s why you have to set up multi factor authentication. So it sounds like Magellan which is a fortune 500 company is not not taking that information seriously. And then, of course, you always have these information where these responses where they say, you know, they’re aggressively investigating and they’re taking steps to improve security to prevent a similar incident, but hey, just happened 10 months ago, so alright, that is going to do it for the product by T podcast. Until next week, stay healthy, stay safe and stay secure.

Transcribed by https://otter.ai

The post ProactiveIT Ep 29 – Privacy vs. Health appeared first on Nwaj Tech - Information Tech & Cloud Support.

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance, and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback.  What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Unpatched Oracle WebLogic Servers Vulnerable to CVE-2020-2883

SaltStack Patches Critical Vulnerabilities in Salt

Firefox 76 released with integrated data breach alerts

Microsoft releases May Office updates with fixes for auth issues

Instacart Patches Security Bug That Would Have Let Attackers Spoof SMS Messages

Google Releases Security Updates for Chrome 

Cisco Releases Security Updates for Multiple Products

Trump Declares National Emergency As Foreign Hackers Threaten U.S. Power Grid

GoDaddy notifies users of breached hosting accounts

Ciitizen HIPAA Right of Access Study Shows Significant Improvement in Compliance

Nearly 2,000 malicious COVID-19-themed domains created every day

US financial industry regulator warns of widespread phishing campaign

SAP announces security issues in cloud-based products

Cyberattack on NTPC Further Exposes the Cybersecurity Risks of Energy Sector

An Update on Cognizant

Critical WordPress plugin bug lets hackers take over 1M sites

Topic 1:  Consumers will opt for competitors after a single ransomware-related service disruption

Topic 2: Patients Notified Medical Records Exposed at Tornado Hit Secure Medical Record Facility

Topic 3:  Half of Companies Have Suffered a Cybersecurity Issue Amid COVID-19 Crisis

https://www.phe.gov/Preparedness/planning/405d/Documents/tech-vol1-508.pdf

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the proactive it podcast this week the latest in it in cybersecurity news. Plus critical vulnerabilities being patched. breaches in cybersecurity stats are gloomy, and the cost of ransomware. This is Episode 28. Hi everyone and welcome to the productive it podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech a client focused and security minded consultant located in Central Connecticut, you can find us at and wash tech comm that’s NW Aj tech.com. Well, it’s been another fun week in isolation. I don’t know what to call it really, because it’s not real isolation, we can go out, but you’re trying to avoid it for the most part and I’m now entering week eight It is day 56 as I record this I don’t know. Good. Seems like there may be some some light at the end of the tunnel. But we’ll see. First of all, wherever you’re listening to this, if you could like share, review or comment, you know, whatever, we’ll get people to, you know, new people to listen to, if that would be awesome. You know, especially on Apple and Google, but also stitcher and anywhere else you listen to it. And if you’re in a HIPAA compliant business, if you can go over to Facebook, type in get HIPAA compliance, and join that group. You’ll be awarded with Lots of HIPAA information. And if you want to go to that now, are we you know, just you go do that, and I’ll wait right here. All right. Did you do you? Um, I did not. You know, I’ll be honest with you. I got asked a lot of questions this week, and I did not pick one to completely forgot about it, to be honest. So we’re not going to do a question of the week. We’re going to jump right into the updates for the week. And so it is the first week of May. We do not have Patch Tuesday updates from Microsoft, but we do have quite a few updates to talk about. So we’re gonna jump right into that, with the first one being unpatched Oracle WebLogic servers that are vulnerable to CVE 2020 2083 Oracle has released a blog post warning users that have previously disclosed Oracle WebLogic Server remote code execution vulnerability is being exploited in the wild Oracle disclose the vulnerability and provided software patches in April 20. 20 critical patch update over malicious cyber actors are now known to be targeting unpatched servers so if you’re using Oracle WebLogic Server get patched because it’s already been exploited saltstack which you may have heard about because it’s being it’s impacted some pretty big systems including ghost blogging platform saltstack does did patch a critical vulnerability in salt. So you should be if you’re, you shouldn’t be on anything prior to 2019 point 2.4 or three first salt. I’m sorry, should not be on anything prior to 2019 point 2.4 or two to 3,000.2. So get that updated ASAP because it is being actively exploited. Firefox 76 was released to integrate data breach alerts I I’m obviously I’m on Firefox 76 already, I have not checked out the data breach alert to see if it works at all. So we’ll be it’ll be interesting to see how that develops. There were some security vulnerabilities addressed with that release as well. Microsoft released May office updates with fixes for auth issues. There are no security updates as part of this rollout. But there is an issue with auth issues basically. Blank authentication prompts were being displayed. And I believe there was something that was crashing as well. I don’t I don’t remember what it wasn’t this point, but it’s a it’s a bug in feature update. So applied at will Microsoft Office 2016. PowerPoint 2016 outlook 2016 Project 2016 word 2016. And Skype for Business 2015 instacart did patch a security bug that would have led to tech spoof SMS messages. I’m only reporting this because sort of as an update, it’s not anything you need to take care of. But they did patch an issue with their system. Basically, it was sending a text message saying, if you’ve saw that they have an application on our website, you can happen, have them text you the link to the application. And link could have been compromised and sent a different link redirecting you to a malicious website. With that being said, if you ever want to download an app for anything, do it from the Google Play Store or from the Apple Store, don’t click on links and don’t download it from anywhere else. And we have a Google released a security update for Chrome you should be on at 1.0 point 404 4.138. That’s across the board. And finally Cisco released security updates for a bunch of products. That was just reported. Yesterday. So if you’re using Cisco products, check out their Cisco Cisco security advisories page and see if you need to update any of them. All right, we got lots of news to share this week. First up earlier this week on Forbes Trump declared national emergency as foreign hackers threaten us power grid. Combine that with another article that I saw a few days later that I don’t think I’m sharing today where a, an energy company in Canada was hit with a ransomware attack. So President Trump has signed an executive order that declares foreign cybersecurity threats to the US electricity system, a national emergency. We’ve known for a little while now that electric grid is a target. So President Trump signed an executive order may 1 to further secure the US bulk power system from foreign adversaries that he wrote are increasingly creating exploiting opportunities. The Executive Order declaring a national emergency over the hacking threat bans the acquisition, importation transfer or installation of bulk power system electricity equipment from companies under foreign adversary control. Executive Order also confirmed that the task force has been established with members including the Secretary of Defense Secretary of Homeland Security and the director of national intelligence to work to protect against national security threats to energy infrastructure, with the sort of did not do is go as far as naming any specific foreign adversaries and other companies. They may control so they left it a little vague on purpose, I’m sure. However, President Trump did state the acquisition or use of bulk power system or choosing equipment designed, developed, manufactured or supplied, subject to the jurisdiction of these unnamed foreign adversaries as to their ability to create an exploit vulnerabilities with potentially catastrophic effects. Acknowledging that an open investment, climate needs to be maintained for the growth of the economy, President Trump note wrote that this openness has to be balanced with the requirement to protect against a critical national security threat. Then Director of National Intelligence Dan arcos, published a ward worldwide threat assessment in January 2019. That warned of cyber attack capabilities both China and Russia when it came to the US electricity grid. That report stated that Russia has the ability to execute a cyber attack in the United States that generates localized temporary disruptive effects on critical infrastructure. The FBI and the Department of Homeland Security released an alert in 2018 warning of Russian government actions targeting among others the energy infrastructure sector in the US. US Secretary of Energy Dan relay, who will lead the newly established Task Force said it is imperative the bulk power system be secured against exploitation and tax by foreign threats. this executive order will greatly diminish the ability of foreign adversaries to target our critical electric infrastructure. The Department of Energy established the Office of cyber security, energy, security and emergency response in February of 2018 to approve energy, infrastructure security, including Preparedness and Response against cyberattacks. So there you have it. bleeping computer report GoDaddy notifies users are breached hosting accounts to secured an October 19 of 2018 and was discovered on April 23. I did see somewhere a number of accounts and don’t don’t believe it’s in this article. But it wasn’t attend. Oh, here it is approximate 28,000 accounts. They identified an SS de identified SSH usernames and passwords that were compromised through an altered SSH file in the hosting environment. This apparently only impacted hosting and nothing else. So if you are hosting on GoDaddy you should have received he received a notification at this point, an email or a letter saying that your account may have been compromised and enforced password changes. Citizen HIPAA right of access study shows significant improvement in compliance. So this was good news I wanted to share it. There has been a significant improvement in compliance with the HIPAA right of access. According to the latest patient records scorecard report from citizen to propel the report citizen conducted a study of 820 healthcare providers to assess how well each responded to patient requests for copies of their healthcare date. Data and wide range of healthcare providers were assessed for the study from single physician practices to large integrated healthcare delivery services or systems. So this is a so the HIPAA right of access rule is this you asked for your medical records to bring them to another doctor or just because you want Whatever it may be, they’re supposed to give them to you within a reasonable amount of time, which is 30 days or less. And you’re supposed to give it to for no less demand supposed to charge more than the cost of actually creating that record, which is usually a few dollars. They have a rating system for this, they’ve been doing this for a little while, I guess. They have a rating system of one to five stars, one being the worst and five being, you know, your name goes up in lights. The good news is that there was an increase of so there’s the latest study saw the percentage of one stars fall to 27% from 51%. That’s those that were not compliant. percentage of providers awarded four stars rose from 40 to 67%. And those with five stars rose from 20 to 28%. So that is good news, because we did see a few and they actually believed that this was because of the enforcement initiative on right of access, by the way by the OCR. And we did see a couple of penalties last year and we saw a few breach notifications for it as well. So maybe people are taking a little bit more seriously, let’s hope. On tech Republic, nearly 2000 malicious COVID-19 themed domains created every day. More than 86,600 new domains related to pandemic are considered risky or malicious according to a new report. And there was 1.2 million newly registered domain names containing words related to the COVID-19 pandemic from March 9 through April 26. And they believe that almost 87,000 of those are malicious in nature. And I’m just looking for the actual numbers here. Man, I’m not looking I’m not seeing what I’m looking for. So anyway, there’s 2000 rough almost 2000 domains registered every day related to COVID-19 that they believe will be malicious in nature, meaning it could be phishing sites or carry malware. And believe they believe that most of them will be crypto mining sites, but some of them will be fishing for sure. You know, they’ll say, Hey, we have a, we have masks, we have we have peepee, or we have a vaccine or we have a cure or whatever it might be, none of those things will be true. They will steal information and run with it and probably use it in another attack later on. And so that is the goal and there was some registered around zoom done. This article doesn’t cover the zoom ones. But that did occur when zoom was having all their problems. And it’s they’re still being used. And this is why you need to have DNS filtering in your environment because DNS good DNS filtering will take care of any newly registered domains. So they will not cause an issue with your business. Zd net us Financial Industry Regulatory warns of widespread phishing campaign. This is FINRA making a warning or issuing a warning I should say the US Financial Industry Regulatory Authority, also known as FINRA, probably more commonly known as FEMA. FINRA has issued a rare cybersecurity alert today warning member organizations have a widespread ongoing phishing campaign. FINRA said the malicious emails were aimed at stealing Microsoft Office and SharePoint account passwords. From its member organizations, FINRA, which is private industry group that works as a self regulatory body for brokerage firms and exchange Marcus said the campaign is still ongoing. According to the security alert, phishing emails were sent using a domain of app broker finra.org so you could see where someone might fall for that and made to look like they were sent by Bill woman or Josh drove Nick to FINRA as vice president presidents. FINRA said the phishing emails included the ads PDF, I’m sorry and attach a PDF file that contains a leak link redirecting users to a website prompting members to enter the respective Microsoft Office or SharePoint passwords. So this goes to a point where I’ve said before, don’t open attach attachments that you didn’t expect. Don’t click on links you didn’t expect, if in doubt with links and type them in manually and if and if in doubt about an attachment make a phone call and see if it really came from where it came from. bleeping computer SAP analysis security issues in cloud based products German software maker SAP announced on Monday that has started to fix security issues identified in several of its cloud based products. The company discovered the problems following an internal review and has already started working on eliminating the vulnerabilities. details about the security flaws have been have not been disclosed in an advisory This week the company says that fixing a post will largely be completed in the second quarter of 2020. The list of affected products includes sa p success, faster success factors. Sa p concur sa p callate. Is cloud Commission’s sa p Caldas cloud si p q as well as sa PC for si Sales Cloud sa p cloud platform in SAP analytics cloud. Some of these platforms along with their infrastructure were acquired over the years and company paid billions of US dollars for them. With this SAP inherited all the potential gaps and had to align them to the company’s present contractually agreed or statutory. IT security I’m sorry that should be contractually agreed on statutory IT security standards. It is estimated that around 9% of SAP is 440,000 customers are impacted by the vulnerabilities. They will be notified of the risk and will receive assistance to remedy the problems. Sa Pease investigation is not complete but the company does not believe that customer data has been compromised as a result of these issues. And then effort to ensure that the effective products meet relevant terms and conditions. And in addition to technical, cold remediation, SAP has decided to update its security related terms and conditions. These remain in line with the market peers. The security updates are not expected to have an impact on the company’s financial outlook for 2020. So I guess that’s good news for SAP. So roughly 440 thousand companies are impacted by this. So they will reach out to you and help you resolve it. So that’s that’s a step in the right direction, in my opinion, and here it is, I mentioned it earlier. cyber attack on NTPC further exposes the cybersecurity risks of energy sector so Northwest Territory is Power Corporation. A generator and distributor of electricity in Canada was hit with a ransomware attack. The ransomware attack hit NTPC shutting down its IT systems and impacting the power generation, transmission and distribution systems are company, my NTPC the online payment portal used by NTPC was not working properly and leading the customers to a message saying that the files were encrypted by networker, although not confirm for this case, but the spread of networker ransomware aka mail two is usually associated with the COVID-19 themed phishing phishing emails as observed during its previous attacks. And so here’s some of the previous attacks or the here’s, here’s actually information about an earlier data breach with NTPC. In January 2016 NTPC informed its customers that it had wrongly sent some personal details of its customers to third party, resulting in breach of personal data file containing a list of customer names, meter addresses, and balance account balances was sent out to some customers while responding to some customer inquiries. Other attacks on energy sectors and April 2020, the Portuguese multinational energy giant energy SMD portrait Goal UDP, was hit with Ragnar locker ransomware, where no hackers stole 10 terabytes of sensitive company files and asked for 1500 and 80 Bitcoin which is roughly $10.9 million. In March 2020, the European electricity association was targeted by cyber intrusion incident, although no further details about the incident were disclosed. In February 2020 of the reading municipal light department, our mld was targeted by cyber criminals in an attempt to extort money by encrypting data in an ancient in the station’s computer system. In January 2020, a hacking campaign by Iranian hackers was observed targeting the European energy sector, in which the attackers tried to steal sensitive information using the pupae rat malware. Other attackers by networker in other attacks by networker sorry, in March 2020 network or ransomware was observed using Coronavirus themed phishing emails to target its victims in the same month. Just ransomware was also used to target The Champaign Urbana Public Health District and in February 2020, the Australian toll group admitted that they were targeted by network a ransomware. The toll group by the way, Australian toll group was hit with another attack within the last couple of days. So not not a good year for them. Cognizant we have an update on Cognizant you may remember Cognizant is an MS MSP. So similar type businesses me as my business, except that they make quite a bit more money than I do. And we’ll get to that in a moment. They are. I believe they’re the largest the world’s largest MSP, but I could be wrong, but Cognizant believes it has contained in Mays ransomware attack that hit the MSP in IT consulting firm in late April 2020. According to the first quarter earnings statement, released May 7 still yesterday. In their statement, Congress has said the company believes it has contained the attack and that the actor is no longer operating in the company’s environs. Since becoming aware of the attack, the company has taken decisive actions to remediate the threat while keeping clients regularly informed. The company believes these measures enabled it to continue its operations in a timely, secure manner. In addition, the company has and will continue to take any necessary steps to protect the integrity of its systems. Cognitive provably previously disclosed at the attack may impact company revenues. More details about the attack and remediation are expected to surface on cognisance earnings call for quarter 120 20. Cognizant says revenue was 4.2 billion up 2.8% from a year ago quarter, including a negative 50 basis points impact from the exit of certain content services businesses and a net income was 367 million compared to 441 million a year ago. Now that being said, mes doesn’t just hit you with a ransomware attack. There’s still data. They have not said if that has happened here in Mesa has not released any data. So that tells me one of two things Mays is not done yet. Or Cognizant may have paid some money. But I’m sure we’ll learn more as the day’s progress here. So when there’s another update on Cognizant, I will share and last bit of news before we move on to our hot topics. Critical WordPress plugin bug lets hackers take over 1 million sites. That doesn’t mean they have it means it’s possible. So Elementor Pro and ultimate add ons for Elementor. WordPress plugins have critical vulnerabilities that Elementor Pro has released release patches for so if you are using those in your on your WordPress website, you should be updating Elementor Pro to version 2.9. point four immediately. There’s vulnerabilities that are being attacked as we speak. ways you can check to make sure that your site hasn’t already have been compromised check for any unknown subscriber level users on your site this may indicate that your site has been compromised as part of this Active Campaign. If so, remove those accounts. Check for files named WP dash XML or PC dot php these can be considered an indication of compromised, so check your site for evidence of this file and delete any unknown files or folders found in WP content slash uploads slash element or slash custom dash icon slash directory files located here after a rogue subscriber level account has been created our clear indication of compromise. So again, that is almost 1 million. I think it’s actually a little more than 1 million sites that are using Elementor Pro and another hundred and 10,000 sites using ultimate add ons for Elementor. So if you’re using those, get them updated immediately. Let’s talk some numbers because this if you know, not gonna lie, I try to scare you guys. I try to scare business owners, because they need to be scared. I don’t do it because I want you to purchase on fear I do it because you need to be educated you need to understand the risks that are out there. So if you’re not willing to consider the risk of, you know, you being breached your client information being stolen or whatever else, maybe you’d be concerned about this risk. consumers will opt for competitors after a single ransomware related service disruption. While most consumers are taking necessary security precautions to protect their online accounts. I don’t believe that but if but some of them are. Businesses may not be doing enough to protect their information inadvertently driving sales to competitors that can that can an ark serve research reveals and I found this on help. NET security calm by the way 7% will switch to a competitor. If your systems and applications are back online within 24 hours. 41% will walk away if they still can’t access systems and applications within two to three days. They serve a survey of nearly 2000 consumers across North America, the United Kingdom, France and Germany found that 70% believe businesses are not doing enough to adequately secure their personal information and assume it has been compromised without them knowing it. And as consumers become more educated and cyberattacks become well known, perceived trust becomes more influential and a purchasing decisions, with the study also finding that nearly nine out of 10 consumers consider the trustworthiness of a business prior to purchasing a product or service and 59% of consumers would likely avoid doing business with an organization that had experienced a cyberattack in the past year. These findings suggest businesses must manage Uncharted challenges within the use of cyber criminals, or I’m sorry within the rise of cyber criminals. Now making breaches public regardless ransom pay. So again, we’re talking about me’s and the apple painter. I think Raju and a few others are clop are now publishing the data that they steal if you don’t pay up ransomware related service disruption consumer tolerance thresholds, cyberattacks, have arguably become the largest business threat. However, the quantifiable impact on consumer behavior has not been widely understood. The study found that one in four consumers will abandon a product or service in favor of a competitor after a single ransomware related service disruption, failed transaction or instance of an inaccessible information. It also found that tolerance for these events quickly deteriorates with over 66% of respondents setting that they would turn to a competitor. If an organization couldn’t restore systems and applications within three days following a cyber attack. And over a third of those would be willing to switch after a mere 24 hours of waiting to access their information or make a transaction Moreover, the potential damage doesn’t stop during a shortly during or shortly thereafter a cyber attack. More than eight and 10. respondents admit to sharing their negative ransomware related experiences with family friends or colleagues posting about their experiences online or medium and lying about the incidents. Note these attacks are usually very well publicized. So you have to think about that perspective as well. certain industries fared better than others. While the report concludes their debt consumers are generally intolerant of cyberattacks. There are a few industries where businesses are under even more pressure to keep data secure and operations running. The survey found that nearly half of consumers would walk away from their banking or security provider immediately upon experiencing ransomware related event which would which prohibited them from transacting or accessing information and 43% would immediately seek out a competitive communication product or service and I can’t say I blame them. While there are many negative ramifications caused by cyber attacks, businesses that take protective or I’m sorry, proactive steps in many To get ransomware quickly will benefit in the long run. Over half of the respondents would be willing to pay more for products and services they believe to be more reliable and secure in the banking and securities industry in over 40% would pay more if they believe products and services were more secure from companies in the healthcare insurance and retail categories. So all of you, businesses, these are all almost all of them. compliant type businesses that say you can’t afford cybersecurity because it’s too much money. Well think about that over half of the respondents would be willing to pay more for products and services they believe to be more reliable and secure in the banking and securities industry, and over 40% would pay more if they believe products and services were more secure from companies in the health care insurance and retail categories. Consumers are clearly already hesitant about working with companies hit by cyberattacks, and it just won’t tolerate disruption as businesses figure out recovery and remediation plans after the fact. The findings represent a stark warning for organizations given that one in four of their customers will be gone immediately upon disruption with many more losing patients within 48 hours, and the numbers are there, the ransomware attacks take in many cases take more than 48 hours to recover from. businesses must do more to ensure they’re protecting your data from cyber criminals and mitigating the chance. They’ll experience extended downtime, we recommend a two pronged approach where cyber security backup and disaster recovery are deeply intertwined. So if the thought of your clients data being stolen, or the thought of your business coming to its knees, or you know, I don’t know why business owners wouldn’t already be concerned and we’re going to go over another article in a moment that shows that some businesses are not concerned that maybe this is another one you get hit, you’re going to lose reputation immediately and I’m going to look up the hit that target took after they were their credit card information was stolen a few years ago. Just to give you an idea, but before we do that, patients notified medical records expose that tornado hit secure medical record facility. So I’m going to go through this first and then I’m going to explain why I’m bringing this up. Several healthcare providers have been affected by an unusual data breach at wapa. Wisconsin base stat information informatics solutions LLC. stat provides secure medical records services to several health care providers, which includes scanning paper files so they can be added to hospital medical record systems. On March 3, a staff facility in Lebanon, Tennessee was hit by a tornado, which caused extensive damage to the building and some of the records stored in a facility that notified all affected clients the same day, and representatives of those health care providers visited the site to assist with locating and securing medical records in the facility. to limit the potential for unauthorized access. A tall fence was erected At around the building while the medical records were located and secured to security guards were also posted on the site 24 seven to prevent unauthorized individuals from accessing the building. The majority of the medical records were found in the remnants of the building, but the records were determined to be unsalvageable, and have now been securely destroyed. While it is possible that to an authorized individuals, that unauthorized individuals may have viewed some paperwork relating to patients, no evidence has been uncovered to suggest that this was the case and patients are not believed to be at risk of financial harm. Out of the abundance of caution patients whose records were stored in a building are being notified by mail and will be offered complimentary credit monitoring services. The medical records at the facility contain the following types of information, full names, social security numbers, addresses, dates of birth, medical record numbers, account numbers, medical images, diagnosis, nursing and physician documentation, test results, medications and other types of information typically found in medical records. And so here’s the of the health care providers who were impacted by this Bayfront health in Port Charlotte, Florida, Bayfront health and Buta gorda, Florida. Commonwealth health Wilkes Barre General Hospital, Pennsylvania, Commonwealth health, Moses Taylor Hospital in Pennsylvania and Poplar Bluff Regional Medical Center in Missouri. Now, why did I bring this up? This illustrates a very important point. Your security risk analysis is supposed to go through every risk that is believed to be in existence for your practice for your metal for your covered entity or business associate, associate, whatever it might be. Tennessee is in an area where they do get tornadoes. So tornado is a very real risk. I’d be willing to bet that this business stat did not do a security risk analysis that included tornado potential for tornadoes. So in other words, if you live in an area where you’re you’re constantly under hurricane threats so Florida, South Florida, then you should include that in your security risk in house. If you live in the northeast where blizzards are very real threat, you should include that in your security risk analysis. If you live in an a coastal area where water is an issue, you should you should include really you should include flooding, whenever you have a covered entity or business associate, but that needs to be in your security risk analysis. The security risk analysis should take every possible risk, analyze it and prepare your healthcare practice or business associate for that risk. It’s not meant to be a checklist. It’s not meant to say okay, well, we are we have anti malware software in our computers. So we’re secure. That’s not what it’s meant to be. And that is part of it. You know, that’s, that’s part of your security risk analysis. And every every healthcare practice should have that. You should, you should make sure that your systems are secure from breach and from malware and from ransomware, and all that stuff, you know, and that includes data backups and all that. But this I’m sure that could have done more to prevent something like this from happening, it is tragic. And I’m sure that the numbers will show that the chances of that building getting hit by a tornado were pretty small, but it’s still a possibility and it’s still something that needs to be looked at when you run your security risk analysis at least once a year. So that’s the point of me sharing it is it’s a rare HIPAA breach, but it’s still a HIPAA breach and it still could happen. You know, we’ve we’ve, with Florida you get hurricanes all the time. And they do say that 20 is going to be an act of hurricane season in a way this year is going to wouldn’t shock me the least bit. So, that’s something to think about if you have a healthcare practice and that could be anything, it could be a dentist, the chiropractor, a physician, an optometrist, any hip any business that that falls under the HIPAA umbrella needs to run a security risk analysis and say, okay, we could get hit with a hurricane. Are we prepared for that? And what do we need to do to prepare for that better? So that is, that was the whole point of me sharing that. And plus, it’s one less HIPAA breach I need to report later on in this podcast. And we’re going to go back to the we’re not going back to the article, but we’re going to go back to that topic. So I found this some dark reading. It’s a real short read. Dark reading.com half of companies have suffered a cyber security issue a mid COVID-19 crisis. survey shows 49% expect to experience a data breach or cybersecurity incident in the next month. But it gets scarier than that. Social Justice, social justice sensing and working from home may be helping to stem the tide of the COVID-19 pandemic but they aren’t doing much good for enterprise cybersecurity. According to the results of new study, nearly half, which is 46% of global businesses have encountered at least one. cybersecurity scare since shifting to remote working model, and 49% of the survey respondents anticipate suffering and data breach or security incident in the next month as a result of moving employees to work from home. The study conducted by Barracuda found that an increase in perceived risk has not been accompanied by an increase in security spending. So that’s where it gets scary. So you saw that you getting hit with a ransomware attack which will directly impact your bottom line and your reputation. And then you see this where it says some 40% of companies surveyed said their response to COVID-19 as included cutting their cybersecurity budget in 50% said they would consider cutting staff. If cybersecurity could be maintained. Cutting, they cut it. They didn’t. They didn’t just they didn’t just say, Alright, we need to make sure we’re still doing the same thing. They cut it. And the problem with that is, you now have this population of employees that are working from home. And they are not cybersecurity aware. And that is opening up a whole new wormhole for your business. I’ve worked with a number of employers, businesses over the last now eight weeks to help secure it and I got to tell you some of the things I’ve seen from municipalities from small businesses from healthcare practices from law firms, it’s unreal, and you know that a lot of them are BYOD. So you’re working from home now you need to use your own device. to remote back into the office, they’ll set up Remote Desktop with no security at all use very simple password. They will make sure that you can still access your email but they’re not securing that you don’t turn on multi factor authentication. They’re not educating their people in phishing. They’re not doing anything to secure the business and secure in many cases secure client files and not spending on it is not the answer. That is the opposite of the answer. So I thought it was scary that you know 40% said they are they are cutting spending on cybersecurity during COVID-19. Hopefully that is not a trend going forward. But COVID-19 might be here for a little while. So who knows? All right, we’re gonna continue on our hip education. With a review of the technical Volume One cybersecurity practice for small healthcare organizations that was part of the 405 D project. And as the I never remember what h ICP stands for, but it’s it’s h ICP, also known as hiccup. That is part of the part of the it’s a plan to make sure that healthcare practices are more cyber secure. So we’re going to talk about today cybersecurity practice number four data protection and loss prevention. Let’s start with and again this is all this is all based off of the NIST cybersecurity framework. So that means if you’re familiar with the NIST cybersecurity framework, none of this should come as a surprise to you. But and apparently it does, because I see him care practices across the board USING IT support or other business associates what’s supposed to be business associates support, that are not familiar with this and are not using best practices. So let’s jump in here set the expectation for how your workforce is expected to manage the sensitive data at their fingertips. Most healthcare employees work with sensitive data on a daily basis very true. So it is easy to forget how important it is to remain vigilant about data protection. organizational policies should address all user interactions with sensitive data and reinforce the consequences of lost or compromised data. And so we just talked or we will talk about sorry about employees getting fired for viewing data that they shouldn’t be viewing towards it. A couple of those this week. Establish a data classification policy that categories data as for Israel, sample, sensitive internal use or public use identify the types of records relevant to each category. For example, this sensitive data category should include pH I social security numbers. And if you don’t know what pH is, its protected health information. credit card numbers and other information that must comply with regulations may be used to commit fraud, or may damage the organization’s reputation. And credit card numbers also fall into PCI By the way, so you need you need to look at both of those. So we have classification highly sensitive data that can be easily used to commit financial fraud or to cause significant damage to the organization’s reputation. Examples of such data for patients include social security numbers, credit card numbers, mental health information, substance abuse information and sexually transmitted infection information. access to these data should be restricted to users who require it and who demonstrate proper identification at login. Such data must be managed in compliance with applicable regulatory requirements. Sensitive All other pH I, especially data associated with the designated records, clinical research data, insurance information, human employee data, and organizational board materials. internal data that should be protected yet are not considered sensitive. Examples include organization policies and procedures, contracts, business plans, corporate strategy, and business development plans, internal business communications and in public all data that can be sanitized and approved for distribution to the public, with no restriction on use, prohibit the use of unencrypted storage such as thumb drives, mobile phones or computers require encryption of these mobile storage mediums before everything should be encrypted, not just mobile. Because there have been a few cases in the last few months of servers walking away and desktops walking away all these things walking away. The document references The different NIST framework as well when it comes to the different practices in this document, and we have use of classifications to establish data usage procedures identify, identify authorized users of sensitive data and the circumstances under which such data may be disclosed. So in other words, identify who’s allowed to access it and make sure they’re the only ones accessing it. Train your workforce to comply with organizational procedures and OMC guidance. When transmitting pH I through email, encrypt all pH I sent via email or text, however, patients can request and receive access to their HIV unencrypted electronic communication following a brief warning to the patient that unencrypted communication could be accessed by a third party in transit. And the patient confirms that they will still want to receive an unencrypted communication. So in other words, if you’re going to send an email, and that person is asking you to send it to their free gmail account or free Pop your email account there for let’s say Comcast since we’re talking about them earlier, you need to warn them of the risks because Comcast does not encrypt their email. When emailing pH I use a secure messaging application such as direct secure messaging, which is nationally adopted secure email protocol and network for transmitting pH I DSM can be obtained from EHR vendors and other health information exchange systems. It was developed and adopted through Meaningful Use program and many medical organizations nationwide. Now use DSM networks when you texting pH, I use a secure texting system. And there are quite a few secure test texting systems. But I would, to the point here use the one that your EHR provides if you’re going to use anything, not just a texting system, implement data loss prevention technologies to mitigate the risk of unauthorized access to pH I check with your IT provider to determine if this is feasible for your organization, or reference cybersecurity, practice number four Data Protection and prevention. So data loss prevention is having a disaster recovery, business continuity, disaster recovery system set up. And so the way we do it is we set it up where you have a local backup and then you have an off site backup done through the cloud. And if something goes down, you’re able to get back up virtually within minutes. train staff never to back up. data on control uncontrolled storage devices on Personal Cloud or Personal Cloud services. For example, do not permit employees to configure any workplace mobile device to backup to a personal computer unless the computer has been configured to comply with your organization’s encryption and data security standards. I saw this once where they employee installed their personal Dropbox account on the work computer. I don’t know how they how they were allowed to do that. And why would that wasn’t preventable, but they did and a place picked up on a security scan and the employee they didn’t I don’t know if there were ever recommend, I don’t know what the HR outcome was, but obviously, the Dropbox account was removed. And when they did find stuff in the Dropbox account that shouldn’t have been there. Not only that, but the employee had information in the Dropbox account that he probably did not want anybody else to see. Remember to protect archived data such as records for previous patients to to to it is important to monitor access to the data which may be used infrequently so that cyber attack is detected immediately ensure the absolute absolute absolute data removed or destroyed properly so they cannot be accessed by cyber thieves. Just as paper medical and financial records must be fully destroyed by shredding or burning. digital data must be properly disposed of to ensure that it cannot be inappropriately discovered, recovered sorry. Discuss options for properly disposing of outdated or unneeded data with your IT support. Do not assume that deleting or erasing files means the data are destroyed. And if not, by the way, it’s easily recoverable. Retain and maintain only data that your organization requires to complete work comply with record storage requirements minimize your organization’s risk by regularly removing unnecessary data. And so what are the threats mitigated by this ransomware loss of depth or equipment or data and accidental or unintentional data loss? So, data protection and that is a big part of HIPAA. Not just HIPAA, but healthcare in general healthcare IT protecting your patients information, your clients, those are your clients to protect their information. Right, it’s time for the HIPAA breach report. We have quite a bit of breach news not necessarily breaches but news to share shareholder suicide Last quarter to recover losses caused by data breaches a lab Corp shareholders taking legal action against labcorp. And its executives and directors over the loss in share value that was caused by two cyber attacks experienced by the company in the past 12 months. So you may recall those breaches from last year where labcorp was breached 10,251,784 patients and in companies like quest were were part of that. And so a lot of you know, obviously it was a big breach. labcorp was one of the companies worst affected by data breach at the medical debt collection company, American Medical medical collection agency AMC, so that was also quest was also part of that. They use labcorp services to infiltrate MCA systems and at least 24 of the MCs clients were affected by the breach a second labcorp data breach was reported by TechCrunch In January of this year that involved around 10,000 labcorp documents, which the lawsuit alleges was not publicly disclosed by the company nor mentioned in any SEC filings. The breach was the result of a website mis configuration and allowed the documents to be accessed by anyone. The breach was also not reported to the HHS Office of Civil Rights. Even though TechCrunch researchers confirm that the documents contain patient data. Ramin Eugenio holds shares in labcorp, which lost value as a result of the data breaches and filed a lawsuit on April 23. To recover those and other losses. The lawsuit names labcorp as the defendant along with 12 of the company’s executives and directors, including labcorp CIO Landsberg, Varian, CFO, Glen Eisenberg and actor I’m sorry director Adam shuck Schecter. The lawsuit alleges that prior to the AMC a breach and subsequently labcorp failed to implement appropriate cybersecurity procedures and did not have sufficient oversight of cybersecurity which directly resulted in the two data breaches in an S sec filing labcorp explained the AMC a data breach it costs the company $11.5 million in 2019 in response and remediation costs, but the lawsuit points out that the figure is just a fraction of the total losses and does not cover the costs of litigation default. Several class action lawsuits have been filed by victims of the AMC a data breach that name labcorp. So the total losses are not known to its shareholders and it probably won’t be known for years. Also lawsuit also states that the second breach has not been acknowledged, publicly or in any SEC filings as such Eugenio alleges lab corpse failed in its responsibility to its shareholders and breached its duties of loyalty care and good faith. The lawsuit alleges labcorp failed to implement effective internal policies, procedures and controls to protect patient information. There was insufficient oversight of compliance with federal and state regulations and its internal policies and procedures. labcorp did not have a sufficient data breach response plan in place pH I was provided to MCA without ensuring the company had sufficient cyber security controls in place. labcorp did not ensure that the individuals and entities affected by the breach were noticed, notified in a timely manner, and that the company did not make adequate public disclosures about the data breaches. The lawsuit seeks reimbursement for damages sustained as a result of the breaches and public acknowledgement of the January 2020. data breach. The lawsuit also calls for a reform of corporate governance and internal procedures and requires a board level committee to be set up for an an executive office or position appointed to ensure adequate oversight of data security. So we’ve talked about the hidden costs of of HIPAA breaches before obviously, this was a very large data breach last year, large HIPAA breach last year, but these are the hidden costs. So, you know, OCR hasn’t even I don’t know where they are in the investigation of this breach, and I’m sure there will be something type of settlement when all of a sudden done but did lawsuits and everything else that’s going to come from this are going to be probably far worse than the actual HIPAA breach. settlement. bjc healthcare has announced the email counts of three of its employees had been accessed by an unauthorized individual after the employees responded to phishing emails suspicious activity was detected in the email accounts on March 6, and accounts were immediately secured. A leading computer forensics firm was engaged to conduct an investigation which revealed the three accounts and only been accessed for a limited period of time on March 6, it was not possible to tell if the patient data was viewed or obtained by the attacker. review of the accounts revealed did contain the data of patients at 19, bjc and affiliated hospitals protected health information in emails and attachments vary from patient to patient and may have included the following data elements, patient names, medical record numbers, patient account numbers, dates of birth, limited treatment and or clinical information. which included provider names visit dates, medications diagnosis, testing information, the health insurance information, social security numbers, driver’s license numbers of certain patients were also potentially compromised. All patients affected by the breach will be notified by mail when the email account review is completed. So they did notify and exactly 60 days so good for them. However, three email breaches means no MFA, no training is occurring on a routine basis at bjc. And there is a list of 19 facilities here. Alton Memorial Hospital Barnes Jewish hospital, Barnes Jewish St. Peter’s hospital Barnes Jewish West County Hospital bjc behavioral health PGC in corporate health services bjc homecare bjc Medical Group boom Medical Group Poon Hospital Center, Christian hospital Memorial Hospital Daleville Memorial Hospital East Missouri Baptist Medical Center Missouri Baptist physician services LLC Missouri Baptist Solomon hospital, Parkland health center Boone tear Parkland Health Center at Farmington progress West hospital and Louis Children’s Hospital. Patients notified medical records expose this tornado hit secure medical record facility. We already talked about that. But again, just to review if you when you run your your security risk analysis, you need to consider all potential loss not just things that are common, like theft, but anything that could occur. And and Robert H Lurie Children’s Hospital of Chicago has terminated employee for improperly accessing the medical records of patients without authorization over a period of 15 months. The privacy violations were identified by the hospital on March 5. Employees access to hospital systems was immediately terminated while the investigation was conducted. After reviewing access logs, the hospital found that the employee had access to medical records of 4824 patients without authorization between November 2018 and February 2022. types of information access by the employee including names addresses, dates of birth diagnosis, information, medications, appointments, medical procedures no health insurance information, financial information or social security numbers where access. No reason was given as to why the medical records were access but the hospital says it does not believe the employee obtain misused or disclosing information to anyone else. hospital setting the employee no longer works at the hospital. This is not the first incident of its type to occur at Lurie Children’s Hospital. A similar incident was discovered in November 2018 when the hospital learned that a former employee access to medical records of patients without authorization between September 2018 and September 2019. So it sounds like they have an issue with access controls which we talked about in last week’s podcast so you know, mercy health and we talked about that breach earlier. Last when did it occur in March so we did talk about it a couple months ago. Mercy health fires nurse for multiple privacy violations. This one’s interesting mercy health has also recently taken action against an employee for alleged violations of HIPAA Privacy Rule. A nurse at hackley Hospital in Muskegon, Michigan was terminated on April 3 determination came shortly after the nurse raise concerns in media interviews about the level of preparedness of the hospital for the COVID-19 pandemic, and how the alleged lack of preparedness but put safety at risk. The nurse contacted the Michigan Nurses Association, labor union, which claimed at Mercy Mercy health fire the nurse for speaking out the labor union also filed a charge with the National Labor Relations Board. House termination came on the evening of April 3 days after he had publicly raised concerns about lack of appropriate PCP and the need for improved screening measures to keep nurses and healthcare workers safe during the COVID-19 pandemic. So the labor union in April 21 press release 10 days after the nurse was fired in one day after the press release was issued by the labor union. Mercy health released a press release of its own stating the nurse was fired for multiple violations of HIPAA rules. Mercy health said it does not usually share details about employment matters related to its workers but what’s compelling To speak out due to the misinformation campaign led by the labor union. Mercy health claims the fire nurse Justin Howe was terminated for accessing the medical records of multiple patients over a period of several days. The records were not were were not for patients receiving treatment at campus where the nurse worked and there was no legitimate work reason for accessing those records. Mercy health claims that how was not the only nurse terminated for improper medical record access according to mercy health press release. We have mechanisms in place to monitor for inappropriate access of privileged information. As part of this review process, Mr. Howe, along with the others were terminated for the same just investigative effort is still in process. So kind of interesting case. We’ll wait to see what comes with that. And then we have three more breaches that were reported early this morning. St. Francis healthcare partners in Connecticut is notifying 38,529 patients that some of their protected health information has potentially been obtained by hackers as a result of so instigated cybersecurity incident that allowed an unauthorized individual to gain access to its email system. The attack occurred on December 30, but it took until March 20. Further forensic investigation to determine that patient’s protected health information was potentially compromised. The types of information stored in the email system that could have been accessed included names, medical histories, medical record numbers, clinical and treatment information, dates of service diagnosis, health insurance or health insurance. provider names and count numbers prescription information in all types of procedures performed, no financial information or social security numbers were compromised. The investigation uncovered no evidence to suggest patient information was accessed stolen or misused. steps have now been taken to improve data security practices and all affected patients were have been notified by mail. There’s a few failures here one, obviously with this took more than 60 days to notify. Make your breach notification to sophistication it’s not a thing. phishing attacks are not so sophisticated. If you set up multi factor authentication, and you train your employees, then it’s not a sophisticated attack it can’t happen. The the the statement here is that a sophisticated cyber security incident that allowed an unauthorized individual to gain access to its email system tells me that somebody was fished. Florida internal medicine practice suffers ransomware attack Daniel Ben. Ben data what’s Md ffensive pa is notifying 3314 patients that the protected health information has been exposed as a result of a ransomware attack. The attack occurred on March 25 2020, resulting in the encryption of its computer systems including patient records backup files were not affected so files could be recovered without paying the ransom. And these types of ransomware attacks. files are not typically accessed by the attackers prior to file encryption. However, data access cannot be ruled out. So notification letters have been sent effective paid to affect a patient’s doctor Then debits explained in a breach notification letters that names addresses dates of birth, social security numbers, health insurance, information and medical information were potentially compromised. Either the abundance of caution identity theft protection services have been offered to all affected patients. steps have also been taken to improve security to prevent further attacks in in the future. So here’s a here’s the here’s the thing with this one. They say that in these types of ransomware attacks, files are not typically accessed That is incorrect. And that is a very poor assessment. Very poor statement. Because as we’ve seen multiple times now in the last few months, they’re stealing the files before they encrypt you. They’re spending time to peruse your network, so to speak in encrypting your files. Houston Methodist Hospital is notifying 1987 heart patients that some of their protected health information was stored on portable storage devices that were stolen from vehicle a vendor representative in mid February. The individual was employed by the medical device manufacturer and operated to 3d imaging technology in the hospitals cardiac cath third is Catherine ization lab. The hard drives were left in a vehicle from where they were stolen. The hospital reports that the room where the hard drives were stored, was locked in removal of the devices was against hospital protocol and violated established technical safeguards and contractual obligations. The representative believed the room was only locked due to the lead hour of the day. The hard drives contain medical images that included a patient’s name, gender, date of birth and code number. The images could only be viewed with specialist software that clinic reported the theft to law enforcement and hired a private investigator, but the hard drives could not be located. So means the hard drives were not encrypted. An email an employee of Ascension Eastwood clinic in Southfield Michigan sent an email to patients on April 15th. I’m just explaining the practice was transitioning to telehealth services due to COVID-19 to help prevent the spread of The disease in error was made sending email patients email addresses were not added to the BCC field of the email and could therefore be viewed by other patients. As a result of the error email addresses and in some cases, patients names were disclosed to other patients. Apart from allowing a patient to be identified as a patient of the clinic, no other information was exposed. The HHS Office of Civil Rights breach portal shows 999 patients were affected and that is going to do it for the HIPAA breach roundup and that is going to do it for this podcast. So until next week, stay healthy, stay safe and stay secure.

Transcribed by https://otter.ai

The post ProactiveIT Ep 28 – The Hidden Costs of Ransomware appeared first on Nwaj Tech - Information Tech & Cloud Support.

This is Episode 27!  

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance, and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback.  What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Chrome 81 Released With 32 Security Fixes and Web NFC API

New This Week

Hackers are exploiting a Sophos firewall zero-day

Contact tracing apps unsafe if Bluetooth vulnerabilities not fixed

5 common mistakes that lead to ransomware

Microsoft Teams patched against image-based account takeover

Biopharmaceutical Firm Suffers Ransomware Attack, Data Dump

Millions of Brute-Force Attacks Hit Remote Desktop Accounts

Smart Parking Meter Company Hit by Sodinokibi

Unpacking The 7 Vulnerabilities Fixed in Today’s WordPress 5.4.1 Security Update

Topic 1: Ransomware attacks against key sectors fall amidst coronavirus outbreak

Topic 2:  March 2020 Healthcare Data Breach Report

Topic 3:  Average Ransomware Payments Soared in the First Quarter

https://www.phe.gov/Preparedness/planning/405d/Documents/tech-vol1-508.pdf

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the prodactive IT podcast this week the latest in it in cybersecurity news plus a rough week for WordPress. No one is safe from ransomware and access management for health care. This is Episode 27 Hi everyone and welcome to the productive it podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech a client focused and security minded IT consultant Located in Central Connecticut, you can find a set and watch check calm, that’s NWA j tech.com. All right. First of all, thank you for listening to this podcast. Once again. Wherever you’re listening to this, if you could please like, share, comment, review. All of the above. Anything you could do would be greatly appreciated. And we would listen to virtual hugs about that. And if you’re in a HIPAA compliant business, please go to Facebook and in a search type in get HIPAA compliance and join that group where we share lots of HIPAA information that will help your healthcare practice or your business associate. Remain in the HIPAA green. How about that? We don’t have a question of the week. I was sent a few questions in but they’re mostly around zoom and Google Classroom, things like that. I think we’ve talked enough about zoom. So we’re not going to discuss that here. Here, I will say that Google has launched Google meets, which is supposed to be, it’s really just Google Hangouts rebranded, but they’re trying to compete with zoom, of course, and Facebook is launching, through Facebook Messenger, they’re launching a similar service. So be on the lookout for those. And, you know, use whatever you think is appropriate for your business. But just know that zoom has fixed most of the issues. I think all of the issues at this point. There were a few updates that we need to talk about. So we’re just going to add to the April update, I know today’s may 1. Happy May, happy May Day, but there were some updates to discuss. So first of all, critical security patches released from Magento, Adobe Magento, Adobe Illustrator and Adobe Bridge. You’ll need to take care of those. They are critical severities there was a bunch of work Press updates this week. We’re going to talk about some of them on this podcast today. But WordPress core WordPress core files were updated to 5.4 point one and they will adjust seven different vulnerabilities that we’re going to talk about later in this podcast. There were also updates from Cisco to address, iOS xe SD win solution software. There was updates from VMware for security updates for ESXi. Samba released some security updates, Google released another update to Google Chrome so should be on at 1.0 point 404 4.1 to nine. That is to address some security vulnerabilities. Juniper released updates, open SSL not echoes back last week. Okay, so Juniper released updates. We told you about VMware ESXi. Yes, x i. And we told you about Cisco, so Lots of updates again this week, that is a big list of updates for the month of April. And so I will include the entire list in the show notes. If you need to apply those updates, please take care of it, because you’re leaving yourself exposed. And if you were using WordPress, if you have any plugins that were probably five or six this week to add to have a lot of installs with critical vulnerabilities that had patches including a theme that is no longer supported. So get it updated. And if this theme is no longer supported, then remove it, replace it because you’re leaving your website exposed. Okay. All right. Let’s talk some news here. First up on Zd net hackers are exploiting a Sophos firewall zero day so Speaking of updates, so force releases emergency patch to fix SQL injection bug is bloated in the wild impacting its x GE firewall. product. cybersecurity from so forth has published an emergency security update on Saturday to patch zero day vulnerability. And it’s x g enterprise firewall product that was being abused in the wild by hackers. So first heard its first learned of the zero day I went late Wednesday, April 22. After received the report from one of its customers. The customer report is seeing a suspicious field value visible in the management interface after investigating reports so foes determined that this was an act of attack and not an error in its project. The attack used a previously unknown SQL injection vulnerability to gain access to expose the x g devices. So for certain a security advisory, hackers targeted so for 60 firewall devices that had their administrators HTTPS service or the user portal Control Panel exposed to the internet. So for Cid, to hackers, Use the SQL injection vulnerability to download a payload on the device display a little den store files from the firewall. Stolen data could include usernames and hash passwords for the firewall device admin. For the firewall portal admins and user accounts used for remote access to the device. It also included the firewalls license and serial number and user emails. So posted that so you can expect phishing attacks by the way. So posted that passwords for customers, other external authentication systems, such as ad or LDAP, were unaffected. So that’s good news. The company said that, during its investigation, it did not find any evidence that hackers used a stolen passwords to access extra firewall devices, or anything beyond the firewall on its customers internal networks. So false researchers named the malware asking iraq a detailed step by step analysis as a malware as features and modus operandi was published and it’s linked on the Sophos website and then there is the aim a infographic here of of what Sophos published the patch already pushed to customer devices UK company famed for its antivirus product said it prepared and already pushed an automated automatic update to patch all extra firewalls that have the auto update feature enabled this hotfix eliminated SQL injection vulnerability which prevented further exploitation stop the extra firewall from accessing any attacker infrastructure and cleaned up any remnants from the attack asset. So that has been taken care of by Sophos to good job there. For companies that had devices hacked. So forces recommending a series of steps which include password resets, I would reset your password either way, and device reboots, reset portal administrator and device administrator accounts reboot extra device reset password for all local user accounts and all those passwords were hash it is recommended passwords are reset for any accounts where the extra credentials might have been used reuse. So, in other words, even though it’s hashed, the hash may already have been cracked and is sitting on a dark web form somewhere. So change your password. Also on Zd net contact tracing apps on safe if Bluetooth vulnerabilities not fixed. So we’ve been talking about contract test tracing apps for COVID-19. Right. So essentially, it’s an app in Google and Google and Apple have both said that they will include an operating system update down the road few months down the road. Your issues with there’s concerns that Bluetooth is not stable enough to handle something like this. So with governments increasingly looking into looking to use contact tracing apps to help contain COVID-19 such initiatives are likely to spark renewed interest in Bluetooth attacks, which means there is a need for assurance that these apps are regularly tested and vulnerabilities patched. As more governments turn to contact tracing apps to aid in their efforts to continue to Corona virus outbreak, cybersecurity experts are warning this may spark renewed interest in Bluetooth attacks. They urge developers to ensure such apps are regularly tested for vulnerabilities and release patches swiftly to flow potential holes while governments should provide assurance that their databases are secure and the data collected will not be used for purposes other than as originally intended. So, I, you know, when I first read about this, the potential of this happening, I did of course, express my concerns. You know, there’s there’s a track record that anytime apps are developed to hold sensitive information, that sensitive information gets exposed. So there’s there is concern of course that using Bluetooth which has been compromised before refer to Blue snarfing and think it’s blue jacking was the other other thing but you you’ve heard of these things before, we’ve all heard of Bluetooth being and we all know that. Be careful of where we have Bluetooth turned on and what’s near us and what what’s shareable and so forth. Well, this is another thing that that scares people. Right? And I did see another document somewhere or another article that said only about half of of people polled would be for using this type of technology. And I can understand a concern to completely understand a concern. So something to think about naked security by Sophos five common mistakes that lead to ransomware ransomware is down so far this year. That’s the good news. The bad news is it probably will not. That is not a trend that will continue. I’m sure it will pick up again, a lot of the focus right now is on COVID-19. There’s there may have been ransomware attacks. There’s there’s a lot of reasons why ransomware could be down right now. One is, you know, some of them promised not to hit healthcare during this, this pandemic. Another one is a lot of businesses are shut down right now. So they may have ransomware sitting in their environment and not even know it. It’s a little bit harder to get into To an enterprise environment right now, if people are working from home, though not completely impossible. So there’s a lot of a lot of variables there. So but here’s what you can do to protect your business from ransomware. If the first one, this is again on naked security by Sophos protect your system portals, this is what happened with target. And now that a third party vendor was involved, but this is exactly what happened with target. Crooks often sneak in by looking for remote access portals such as RDP and SSH, that aren’t properly secured, perhaps because they were set up temporarily but then forgotten about, learn how to scan your own network from the outside and make sure that there are services that are open are in and listening for connections are supposed to be there and that they’re on regular security checklist. So in other words, if you have telnet, open close it because nobody uses telnet anymore, and I should should clarify my statement. So the target hack was a few years ago. 2015 if I’m not mistake And I could be wrong. But third party, a third party company was compromised. And then that leaked to a hack of a portal that they use for target. And then the hackers got into the target internal system. Now it’s not the third, not entirely the third party vendors fault. It’s probably more target’s fault than the third party vendor. But that’s how they got into a portal. Number two, pick proper passwords. We’ve talked about passwords, we’ve talked about passwords, strong passwords, means uppercase, lowercase numbers and special characters. And the longer the better. Use a password manager. Don’t reuse passwords. And I’m not sure if it’s here, but use multi factor authentication. It’s not here, but use multi factor authentication, wherever possible, wherever possible. I don’t care what it is. It is here I’m sorry, two factor authentication. Use it on your email, use it on your social media. Use it on Your portals, whatever they are, whatever, whether it’s a CRM or a payroll portal or whatever it is, use it. Number three, peruse your system logs. And this is one that’s overlooked a lot. many if not most, ransomware attacks don’t happen instantly or without warning to crooks usually take some time, often days and sometimes longer to get a picture of your entire network first. That’s how they make sure when they finally pull the trigger that initiates the attacks, they will get this destructive result they want for the ransom they planted demand. So there will often be numerous telltale signs in your logs such as appearance of gray hat hacking tools that you wouldn’t expect your own users to need or use sysadmin operations such as creating new accounts that happen unusual times, and network connections from outside that don’t follow your usual pattern. The Sophos managed threat response team can help you here of course, this is an ad, but you know you have some some logs out there where They collect logs from the network and you’d look for certain types of activity and then review it and act on it as you feel necessary. Pay attention to warnings and that’s number four. If you’re if you’ve set up alerting system to shout out, shout you all the time, you will almost certainly end up with alert fatigue. This is a very real thing if you get 100 alerts, and 98 of them are just a waste of time, you need to adjust your alerting to remove those 98. But be careful not to assume that otherwise interesting warnings can be ignored if they mentioned a potential threat was already blocked. Often threats that pop up on your network aren’t just chance events. They’re evidence that cooks are already poking around cautiously to see which action set off what alarms in the hope of pulling off a much bigger attack later on. And number five patch early and patch often don’t leave yourself exposed to potential holes for longer than necessary. So as a rule, we test patching As soon as it rolls out, especially for operating systems, soon as it rolls out and apply it when we think it’s safe, but usually by the end of the same week that the patches came out so it comes out on a Tuesday. By the weekend it’s patched and on all of client machines. Some things like browsers are updated immediately. In a malware, what we use is updated automatically. Things like that get taken care of as quickly as possible. bleeping computer reports Microsoft Teams patch against image here’s another update image based account takeover. After looking at how Microsoft Teams handles image resources, security, researchers found a way to take over accounts by sending recipients a regular gift. The method could have been used for desktop and web versions of teams to get access to multiple accounts at once and still conversations and threads controlling a subdomain under teams. microsoft.microsoft.com was the main condition for the attack and researchers To to choose from Microsoft received a report about the vulnerability and push mitigations to prevent the attack. So Microsoft had a vulnerability with teams that could have been compromised with a just by sending a gift. It’s been addressed no longer an issue on dark reading comm we’ve we’ve actually talked about this a few times this week. So executive farm, which is a pharmaceutical clinical research organization was hit with a ransomware attack. This article that I have here that we’ll link to, was the first of three that I’ve reviewed. The data that was compromised was personally identifiable information and potentially pH I for for executive farm and also for business partner. PAREXEL. It turns out it was the clop ransomware group and they stole data quite a bit of data actually. And have now posted it on the dark web. Because executive forum is has not paid the ransom, no clue what the ransom amount is. This is a HIPAA violation, HIPAA breach, by the way, and it is a data breach. So make make no mistakes here. They exfiltrated the data that makes it a data breach. So they have the data, they posted it on the dark web. exec form is not playing nice. They’re not, you know, no idea how much the ransom request is no idea how it happened or anything. So there will be more information to follow on this. But he up we’re seeing more and more of this and it was actually three We’ll talk about it later in the show but three healthcare breaches resulting from ransomware. Just yesterday they were reported. Threat Post reports millions of brute force attacks hit Remote Desktop accounts so remote, brute force attacks. have increased dramatically against Remote Desktop. Automated attacks on remote, remote desktop protocol accounts are aimed at taking over corporate desktops and infiltrating networks. So Remote Desktop if you’re not familiar with remote desktop protocol, is Microsoft’s way of being able to connect back to a nother Windows machine in another location. And if set up properly, it’s fairly secure. In other words, it should be done over VPN and strong passwords and multi factor authentication and so forth. But what happens is most people don’t do those things. And I just I personally personally witnessed a municipality here in Connecticut that’s not doing it a rather large municipality municipality at that. So there has been a rash of brute forcing attempts aimed at uses a Microsoft proprietary Remote Desktop protocol and striking millions per week. So That’s a lot. attacks are likely offshoot of cyber criminals looking to take advantage of the unprecedented numbers of employees working from home. So more people are working from home. More people are probably using remote desktop. And here’s what they do. They have lists of usernames and passwords. They drop them into a script, the script runs automatically in the attempt to brute force. How do they know where to go? They look for open port 3389 by using n map or something similar to scan. And if you’re if, if it’s 3389 is open. Now they’ve dropped they run the script. It’s really not that complicated. It’s really that easy script that you can get easily on the internet. On hop for security by bitdefender smart parking meter company, it was sold on eBay and I thought this was interesting and it’s part of the title for the podcast today. You know the part that says no one is safe from ransomware So here we are, we have parking meters that were hit with a ransomware attack company named civic smart from Milwaukee. That selling smart parking meters was hit by Soto Nokia ransomware. And Soto KB is one of those ones that will exfiltrate your data and then put it on the internet for the whole world to see if you don’t pay your ransom and the attackers managed to steal a large amount of data, which they don’t use for further leverage. These days, it seems that the most effective industries have something to do with the Coronavirus when it comes to cyber attacks, healthcare organizations are getting it left and right, even if they are working on possible vaccine against the virus. Unfortunately, bad actors don’t stop even in these troubling times and will use any weakness they find in a system to civic smart attack was perpetrated was soda leukemia ransomware and follow the extraction of 159 gigabytes of data. So there is a lot of a lot of data. Usually this kind of action comes from the attackers using maze which we know is not true anymore. There’s probably six or seven rants Somewhere operators that are using this method No, but it looks like it’s now being employed by other groups as well. According to scoop news report, the attack took place back in March, but the company remains silent and chose to pay the ransom and retrieve the files. So that makes it a data breach by the way. According to initial reports, the leaked data included employee records, bank statements, credit card numbers of customers and even contracts with cities and parking garage vendors. smart parking system is a great idea, and it’s used in many cities from around the world. But like any other service that deals with credit card payments and other sensitive data, security must never be in second place. to new strategy used by attackers. To steal data from affected systems seems to be used more widely in the past few months and it’s slowly becoming the new norm in cyber attacks. The other problem is that the company didn’t say anything about the attack and data leak even after it presumably paid to hackers just means that people’s financial personal data were compromised, but they have no idea about it, leaving them exposed to fraud and other hacks. So what should be happening is you should be getting credit monitoring services should have been notified. And this is why, you know, I know, regulation is, in a lot in a lot of ways sucks, but we need an national federal level data protection plan like the GDPR and the ccpa. Not all states. In fact, most states in the United States do not have something like ccpa, California, California and New York to and a couple other states do. Most states do not I don’t know if Milwaukee does or not, I don’t believe they do. But that’s, you know, that’s why we need it. And then finally, we talked a little bit about the word WordPress update to 5.4 point one. So if you’re using WordPress, which I believe roughly 40% of all websites are now WordPress, you should be on version 5.4 point one And here are some of the security issues password reset tokens fail to be properly invalidated if a password reset was requested for a user, but they then logged in and manually updated the password on the profile page, the email password reset link could still be used. Previously, the password reset link would only be valid invalidated if the user change their email address. There’s not many circumstances in which this type of issue could be problematic unless an attacker already had access to the victim’s email account, which would effectively be a worst case scenario. And that would be pretty bad if you did. Certain private hosts can be viewed by unauthenticated users just changed set had the following comment query ensure that only a single post can be returned on date time based queries. This indicates that it was possible for an attacker to view private post by using date and time based queries, though only for protected posts that were created or updated by the exact same time down to the second end, as an unprotected post. The two cross site scripting issues. In the customizer, these vulnerabilities appear to allow for corruption of post content by various users and could allow for the addition of malicious JavaScript by an automatic by an authenticated attacker with contributor capabilities. A user with the ability to write posts such as contributor or an author, without the unfiltered underscore HTML capability, and an administrator or editor could corrupt data from each other’s traps potentially adding malicious JavaScript to a preview or final version of a post cross site scripting issue in the search block this actually appears to refer to two separate vulnerabilities with the same mechanism in both the RSS block in the search block and attacker with the ability to customize the class of either of these blocks, such as a contributor could potentially set the block class in such a way that the malicious JavaScript would be executed when viewing or previewing the post. cross site scripting issue in WP object cache Object caches used to save trips to the database by caching content from the database and making the dash. I’m sorry, the cache contents available by using a key, which is used to name and later retrieve the cache contents. In a few edge cases, an attacker with the ability to change object cache keys might be able to set one of these cache keys to malicious JavaScript. By default, WordPress does not display the stats nor does it allow users to directly manipulate cache keys. It is impossible it is possible that an improperly program plugin or combination of plugins could allow an attacker to manipulate a cache key result a non escaped value being displayed to an administrator viewing the stats via a plugin or custom code designed to display them. cross site scripting issue and file uploads a particular vulnerability could allow a user with the upload underscore files capability authors and above and a default installation to upload a file with the file name set to malicious JavaScript which might be executed when viewing the file. The Media Gallery and authenticated cross site scripting issue in the block editor. This vulnerability existed in a few of the release candidates and does not appear to have been present in the official release. It was discovered by noggin or guy in the duck and WordPress 5.4. release candidate one and release candidate two and it was fixed in 5.4. release candidate five. So those are your seven vulnerabilities that were addressed. Six of them being cross site scripting issues. update to WordPress 5.4 point one. It is not easy to find websites that are not on the latest version. If you’re not you’re you’re putting yourself in your website at risk. right we’re gonna talk some numbers now for hot topics for the week. The first one I’ve kind of touched already touched on it a couple times in this podcast. ransomware attacks against key sectors fall and midst Coronavirus outbreak. This is on tech republic.com campaigns against government agencies educational establishments, and healthcare providers aren’t proving as successful as expected says security firm MC soft cyber criminals who deploy ransomware are always on the hunt for new victims. That’s true even during a time of crisis such as the Coronavirus pandemic. Those summaries more games have vowed to hold off on attacks against hospitals and healthcare providers as the world bad as battles COVID-19 others are still trying to make a profit out of the potential any potential victim. But as the virus has spread, the number of successful ransomware attacks against certain sectors has actually declined according to a blog post published Thursday by MC soft in 2018 966. Government agencies, educational establishments and healthcare providers in the US were hit by ransomware projections call for the same or worse numbers for 2020. But for the first quarter of the year, only 89 such organizations were affected by ransomware. So you’re looking at a 270, which is a significant drop off. If that play I’m sorry, not 270 would be 360. So that’s a little more than a third of what it was last year. However, as you’ll hear, that probably will not remain reducing the number to a level not seen in several years, drilling down on the results of ransomware attacks during the first quarter hit 38 government agencies 26 educational establishments, and 25 healthcare providers. So now here’s the thing. A lot of government agencies are that are considered not essential or shut down right now. All the schools are remote at this point. So there’s some in some of them are closed. And then healthcare providers, you know, some of the ransomware operators have promised not to hit them. I don’t believe that that’s going to be the case but That’s what they promise. This decline has continued into the start of the second quarter with three government agencies to educational facilities and to healthcare providers victimized by ransomware. Now we just learned about three more healthcare providers a couple days ago. So whether or not the overall number of ransomware attack campaigns has fallen. Why is the level of successful tax against the three mentioned sectors declined MC sauce points to a few factors. First, many government educational healthcare organizations have suspended non essential services during the Coronavirus outbreak leaving a smaller attack area for ransom. Second, while people working from home maybe new target they also represent different challenges for ransomware attackers. Just criminal groups are limited by available personnel and resources and can’t always modify their operations as quickly as desired. And third, many organizations are suffering financially as a result of COVID-19 outbreak. As such, they simply can’t afford to pay huge sums of money to attackers demanding a ransom note posted released recently on its website. ransomware groups said we’re living in the same economic reality as you are. That’s why we prefer to work under the arrangements and we are ready for compromise. Though the number of successful ransomware attacks in the public sector has fallen attacks against private sector have remained at around the same level during the Coronavirus outbreak further when even the client against government schools and health care providers is likely temporary, and MC soft believes the level of attacks will ramp up as the year progresses. The government should as noted in a 2019 report seek to bolster security in these sectors and should do as do so as a matter of urgency MC said in a blog post this is critical given that COVID-19 pandemic could amplify existing security risks around the upcoming election, especially as some states have reallocated elections security budgets to fund efforts related to COVID-19. So it is an interesting warning. And I think it’s a legitimate warning. I don’t think this is going to be the trend for the whole year. We’re going To see a jump when when a the ransomware groups figure out how to get around with the work from home and into the enterprise environments and into the healthcare environments and the government agencies and in the schools and so forth. And the schools are changing a lot right now. So that’s that’s likely to leave vulnerabilities. And the other piece of that pie is, we don’t know. There may be ransomware, sitting waiting anywhere. And so they’re changing their mode. And the interesting thing is the flip side of this is that malware has been reported as 30 up an increase of 30,000%. A lot of times that malware will lead to a ransomware attack. Phishing has seen an 85% increase since the beginning of the year. So phishing as we know 90% of phishing leads there to ransomware or 90% of ransom. Attacks begin with phishing. So it’s not that it’s not happening, it will happen. So don’t let your guards down don’t become the next victim simply because you think ransomware attackers have given up to have it. Now let’s talk about the bad side of the ransomware story for 2020. So far, this is on dark reading calm, average. ransomware. Payments soared in the first quarter. Criminals extorting large amounts of money from big enterprises pulled up the overall average significantly compare with the fourth quarter of 2019 Cove where says the ransomware economy continues to boom even as COVID-19 pandemic wreaks havoc on businesses around the world. new data from co were on ransomware attacks on the first quarter of this year showed that compared with the fourth quarter of 2019, medium ransomware payments held relatively steady at around 44,000. But average payments soared 33% to $111,605. Are you prepared to pay $111,000 to someone because You didn’t secure your system, you know, how much salary is that right there and then to, you know, then there’s other fallouts after the fact now it’s a data breach potentially, and lawsuits and whatever else exists out there. The increase in average amounts of insurance By the way, increasing average amounts reflected to significantly bigger ransom payments that large enterprises paid last quarter to get their data back. Compared with smaller medium sized businesses. This year’s first quarter marks the seventh straight quarter, the average payments have increased as recently as the first quarter of 2019. The average ransom payment cohort study was just $12,762 or less than a 10th of the current average. So you can see a big increase over the last year ransomware as an economics driven industry says bill Segal, CEO and co founder of CO where right now the economics are very favorable favorable to cyber criminals. coworkers, data shows that ransomware attacks increased across the board. Last quarter as threat actors took advantage of the pandemic and resulting economic disruption to go after businesses. The attacks resulted in downtime of around 15 days on average for victims down marginally from the previous quarter. But still disturbingly high. Kovar said many of the attacks involve data exfiltration as well and that’s where you get yourself into trouble. phishing emails are often perceived to be the most favored mechanism for attackers to drop ransomware but insecure Remote Desktop protocol. access points, which are available in dark markets for as little as $20 are even more popular and continued to represent the most common ransomware attack vector last quarter, combined with cheaper ransomware kits. The cost to carry out attacks on machines with open RDP or to economically route lucrative for criminals to resist cool were set. Now just we just told you that RDP There are over a million brute force attempts on RDP per week right now, as in previous quarter small professional services firms such as law firms managed service providers and accounting firms were the most heavily targeted and accounted for nearly 20% of all ransomware attacks that Coover account encountered in this year’s first quarter. public sector entities including schools and local governments and other top ransomware. Target and previous quarters attracted a lot of attention in the first quarter of 2020 as well but in break from pattern almost 50% of ransomware attacks on this cat category were directed at schools. According to co where ransomware have served purveyors typically have tended to tech schools and summer to increase the chances of getting victims to pay up before schools reopen uncharacteristic volume of attacks against school districts. In the first quarter suggests that threat actors were trying to take advantage of the hasty move to distance learning to schools had to implement in response to COVID-19. co where said even as some of the threat actors stop targeting healthcare as others continued going after them making healthcare the second most heavily targeted sector with after professional services firms. The payment payoff, security experts have strongly advocated against organizations paying a ransom to get back access to their encrypted data, and systems. Many believe that ransom payments only encouraged more attacks and more threat actors. In fact, the only reason an organization would even consider paying a ransom is if the business would fail, or falter. If it doesn’t says evil. It is the option of last resort only Siegel says only if your business is at risk of permanent damage because the data loss will be so severe should a ransom be considered. He says, Cove wears data suggests that when organizations do end up exceeding a seeding to ransom demand, their chances of good outcome remain fairly high. 99% of businesses that paid a ransom last quarter got a working decryption key for unlocking their data the average data recovery with these keys itself though dropped or dip modestly to 96% in the first quarter of 2020. Compared with 97% in the prior quarter, so in other words, you have a 96% chance of getting your data back if you pay the ransom, cool were found that enterprises stood a better chance of recovering your data when dealing with the operators of some of the top ransomware. Families such as Rioch, Soto leukemia and Phobos. The operators of these families, particularly ryokan Soto kV have attended have tended to target larger organizations. At the other end of the spectrum, some ransomware variants such as Miss Spinoza, and death hidden tier cause data loss when encrypting data and had decryption keys that were buggy as well. So, of course, these the larger ransomware families will give you the data back because if they don’t, then the next the next enterprise environment that they hit isn’t going to pay the ransom because why would they want you’re not going to give the data back don’t pay the ransom. But as it says in the article is strongly discouraged, because it does paint a bigger target. on you. It’s interesting. There’s some contradicting information here that says, you know, health care and schools were targeted heavily again in the first quarter, but then we just read in a previous article that that they were down significantly so not sure where the data comes from, but there you have it. We do have the march 2020 breach, HIPAA breach report. So the numbers for March, not great. March 2020. Saw 7.69% month over month decrease in a number of reported healthcare data breaches, and a 45.8% reduction in the number of breached records. But that’s from February, when February was one and a half million records breached. Now the number of data breaches of 500 or more, was 36 for the month of March, which is average for the year so far. We had 39 February 33 and January. A little bit lower than 2019 for the most Part. Only a couple of months were lower, lower than that. There was 128,921 Records breached and we have the top 10 breaches, nine of them were hacking or an IT incident. All were healthcare providers except for one one business, or I’m sorry, there was two business associates in the top 10, Stephen c Dean, and one digital health and benefits. The one digital health and benefits was a theft. I’m not sure. I don’t recall seeing that breach reported. So I’m not sure what the theft was, but I’d have to guess, a laptop or some unencrypted device. Remember, if your device is encrypted, it does not count as a HIPAA breach if it’s stolen or lost. But if it’s not encrypted, then it becomes a HIPAA breach, and you have to report it. So the number one breach was ambry genetics Corporation a health care provider 232,772 in individual records all the way down to number 10 Washington University School of Medicine which is also a healthcare provider 14,795 causes of March 2020 healthcare data breaches unauthorized access or disclosure was nine theft six lost to hacking it incident 19 and this should come as no surprise but again here we go location a breach of pH I other was one I’m not sure what that means. Other portable electronic device which could have been the stolen device is to electronic medical records to desktop computer could have also been stolen three email 18 network server nine paper films for and laptops three and again, that could have been the stolen device 18 for email again, I think it was almost 40% of all the breaches. The SCADA like I don’t just don’t understand why we’re not taking care of it. We’re not taking care of it though. It’s not happening. We continue to see phishing attacks succeed time and time again. The breaches by covered entity types so we have 26 healthcare providers, six business associates, which seems to be growing three health care plans in one healthcare clearing house. So business associates are outpacing healthcare plans and clearing houses combined. So six business associates health plan and healthcare Clearing House combined as for the OCR did say it would be increased enforcement against business associates. Now that was before the COVID-19 pandemic. So whenever things do settle down, you can expect to see some enforcement.

Transcribed by https://otter.ai

The post ProactiveIT Ep 27 – No One is Safe From Ransomware appeared first on Nwaj Tech - Information Tech & Cloud Support.

This is Episode 26!  

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance, and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback.  What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Chrome 81 Released With 32 Security Fixes and Web NFC API

New Updates This Week

Apple Releases Security Update for Xcode

IT services giant Cognizant suffers Maze Ransomware cyber attack 

Hackers selling 267 million Facebook records on hacker forum

Hacker returns $25 million after their IP address is exposed

DoppelPaymer Ransomware hits Los Angeles County city, leaks files

New Orleans Hit With Ransomware Again

Nearly 25,000 email addresses and passwords allegedly from NIH, WHO, Gates Foundation and others are dumped online

US #COVID19 Relief Fund Leaks Data on Thousands of Firms

Topic 1: Scripps, Stanford working with Fibit to assess wearables’ COVID-19 tracking abilities

Topic 2:  Google wants to make it easier to analyse health data in the cloud

Topic 3:  Is it Time to Call Ransomware Attacks Data Breaches?

https://www.phe.gov/Preparedness/planning/405d/Documents/resources-templates-508.pdf

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the proactive IT podcast this week the latest 19 cybersecurity news plus more updates and warnings Google and Fitbit becoming more involved with PH I, and is ransomware. a data breach. This is Episode 26 Hi everyone and welcome to the productive IoT podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech, a client focused and Security minded IT consultant located in Central Connecticut. You can find us at and wash tech.com that’s NWA Aj tech.com Hi, welcome to another episode of the productivity podcast. As always, wherever you’re listening to this, if you could like, comment, share, or review the podcast and it is available on almost every major podcast platform, all that I know of anyway, that would be awesome. We would greatly appreciate it because it does help us to spread the word and get new audience and so forth and you know, hopefully help someone out there to prevent a catastrophic cyber attack or compliance issue. And if you want speaking of compliance, if you’re in a HIPAA compliant business, please go to Facebook and in a search type in get HIPAA compliance join that group because there we share all kinds of HIPAA information and anything related to healthcare it and it will help you to remain compliant and Do your job, protect your patients. Ultimately, that’s what HIPAA comes down to. Let’s jump into it. We don’t have a question of the week, let’s jump into the Patch Tuesday updates. And last week was Patch Tuesday. So we had a number of updates that needed to be addressed. So if you missed that, make sure you go back to Episode 25. And listen to that. But we do have a number of patches again this week. So we have first of all Apple releases security update for Xcode, Apple has released a security update to address vulnerabilities in Xcode that a remote attacker could use to exploit the vulnerability. So if you’re using Xcode, make sure you move up to Xcode 11 point 4.1. We have a Google Chrome update that also needs to be addressed that was you know, that’s I think it’s been updated three times this month, but the the most recent update is at 1.0 point 404 4.1 to two so you should end in one to two So make sure you take care of that immediately. Open SSL has released some security updates. So you should be on version 1.1. point one G. Microsoft released security updates for multiple products around the Autodesk FB x library. So any of their products that use Autodesk FBX library have vulnerabilities in them. Those products include office 2016 2019, office 365, Pro Plus, and paint 3d. And it can be used to to remotely attack your systems. So get that updated. What else do we have? I think that’s the updates. We have a couple of warnings as well that we’re going to talk about. We have one other update I’m sorry. So Apple did release or has updated to iOS zero days that have been abused for a while. They affect Apple Mail and on Apple, iOS Apple versions, I’m sorry, iOS version six in 13 point 4.1 you should be on 13 point 4.5 that is in beta right now. And it will eventually be updated to 13 point 4.5. And that will be a full release. So the vulnerability does allow for someone to take over mail and remove emails, delete emails, send emails and so forth. So you should address that ASAP. 13 point 4.5 for iOS. Right as I said, we have a couple of warnings one, the first one from the NSA in the Australian Signals Directorate, which is ASD. They jointly released a cybersecurity information sheet on mitigating web shell malware, malicious cyber attack, cyber actors are increasingly deploying web shell malware on victim web servers to execute arbitrary system commands by deploying web shell malware cyber attackers can gain persistent access, persistent meaning they’re going to On to compromise networks. The information sheet provides techniques to detect and recommendations to prevent malicious web shells. And this is on the system’s website. So there is a link from that posting to the to the information sheet. So if you’re using web shells in your environment, check that out. Also IC three which is an FBI agency, the internet crime complaint center, has released an alert warning of recent increase in extortion, email scams, cyber criminals threatened to release sexually explicit photos or videos of victims unless they agree to send payment. So I’ve I’ve I’ve shared that information, I don’t know probably four or five times on this podcast, or on a daily podcast. No. So I’m sharing it again because I continue to get questions around it. You know, from people that would never or at least I hope they wouldn’t go to porn sites. Things like that. So it’s a scam. And it usually winds up in your spam folder. So if you’re looking for it, and you find it in your spam folder, then it just tells you even more so that it’s a scam. If you’re getting into your inbox, and we need to talk because then you’re getting phishing emails and scams into your inbox, and that’s a problem. But those are the two warnings that came out this week. One from the NSA and one from the FBI. I see three. All right, let’s do a little news. Round up. We have some big news actually. This is on bleeping computer but it’s been reported all over the place and I’ve been trying to get some updates for you. I have not gotten much more in the way of updates but one of the world’s largest msps it may be the largest MSP out there. It service Giant Cognizant suffers Mays ransomware cyber attack and we’re gonna talk a little bit about me as ransomware when we get to the hot topics, more about more along the lines of data breaches, but Cognizant has been hit by what is suspected to be major ransomware. There is not a whole lot more information than not accept them that Cognizant has started to alert their clients and alert them as to how to determine if they have any ransomware. But specifically, mais ransomware on the network, on their networks. Now, because I’m going to talk more about this in a few minutes. I will just say this maze ransomware is one of those ransomware operators that does steal your data before encrypting your network and then telling you if you don’t pay up, we’re gonna release your data to on hacker form, and it will be available to the public. So this will this is this just happened this week over last weekend. So we will see how this plays out. I have not been able to uncover any more information as of yet. On hackery to have hackers selling 267 million Facebook records on accurate form. Currently the trove of 267 million Facebook records are being sold for around $600 on a hacker forum. Fake Facebook has more than 2.5 billion billion monthly active users and when its data is breached, that’s bad news for everyone today is one of those days where personal data of millions of unsuspected users has been put at risk. In December, hacker read reported that a misconfigured Elasticsearch server exposed the personal information of 267 million users. These records mostly belong to users in the United States and included Facebook profiles, full names a unique ID for each account and a timestamp. The good news is it does appear that passwords were not included in that breach. So there’s that but You can expect some spear phishing to come out of this. Also on hacker read a hacker, who got caught basically returned $25 million after his IP address was exposed. This This occurred in China. This was reported on April 21. So this happened on April 20. A Chinese lending platform named lend f.me, using a lending protocol by de force was hacked, resulting in a loss of $24.36 million worth of ether and Bitcoin and USD stable coins. Now in a shocking twist of events, the entire sum has been returned by the attacker. And the reason is because their system was set up to retrieve IP address information. Once he was exposed, the the website Lund f.me said hey, we have your information, you might want to think twice about what you’re doing. And so he returned the money in two different installments. So, you know, if you’re going to hack disguise where you’re hacking from on bleeping computer double pay Merlin’s. So we have two municipalities that got hit this week that we know of. One of those was Los Angeles County called Torrance, the city of Torrance of Los Angeles much upon area. California has allegedly been attacked by a double payment ransomware having encrypted unencrypted data stolen and devices encrypted. So again, the trend is still the data, encrypt everything and then demand money. So in this case, they’re demanding about $690,000 in in Bitcoin to get the decrypter. And of course, what will happen is if Torrance doesn’t pay up, which is as of right now it doesn’t look like to have then the top hammer gang will release the data that they have stolen, they have 20 gigs worth of files. They did release a little bit to show that they do have it. Basically they released the the hierarchy of the files system that was stolen. So they it looks like they stole the entire file system, whatever it was, and they’re sharing some of that on their forum and saying don’t pay us the $690,000. We’re going to release the rest. Not to be outdone New Orleans once again in the ransomware news department. I’m getting this there isn’t a lot of information on this for some reason, but I’m getting us on wwL tv.com. Orleans Parish assessor’s office hit by ransomware attack official said no personal info lost, which is probably why it’s not showing up on any of the ITC cites It is unclear when the ransomware was discovered and what kind of damage it did to the system. New Orleans, the Orleans Parish assessor’s office is latest government agency to be hit with a cyber attack the agency which handles property assessments and taxes in the city of New Orleans said in a statement Friday that it was working with the FBI to investigate the security breach. The Orleans Parish assessor’s office is working closely with Federal Bureau of Investigation after our server was breached by ransomware official said in a statement no personal or confidential information was stolen due to the multiple levels of authentication in the assessor system and all all the office functions will continue as the data critical to the operation of the office is still accessible. The office said it would continue to reevaluate homes for the 2021 tax year and the public facing sections of the assessor’s office website would not see any changes. It is unclear when the ransomware was discovered and what kind of damage it did to the system. The city of New Orleans was crippled at the end of 2019 by a severe ransomware attack that forced the city to reform are all government computers delaying all levels of city governance. The state of Louisiana suffered a similar attack which shut down OMB services for several weeks, there’s no indication of whether the latest attack was related to either of the previous ones. So New Orleans seems to be right in in the targets of the ransomware operators for summary On MSN, we reported this on our daily show. MSN reports nearly 25,000 email addresses and passwords allegedly from NIH, who gates Foundation’s are and others are dumped online. Unknown activists have posted nearly 25,000 email addresses and passwords allegedly belonging to the National Institutes of Health, World Health Organization, the Gates Foundation and other groups to combat the Coronavirus pandemic, according to the site intelligence group, which monitors online extremism and terrorist groups. Now when you hear who did this, where they suspected this I should say, you’re gonna be you’re gonna be a little surprised while site was unable to verify whether the email addresses and passwords were authentic, the group said that the information was really Sunday and Monday and almost immediately used to ferment attempts at hacking and harassment by far right extremists. In Australian cybersecurity expert Robert Parker Potter said he was able to verify that the who email addresses passwords were real little whose origins are unclear appear to have first been posted to 4chan a message board notorious for its hateful and extreme political commentary and later to paste into tech storage site to Twitter and too far right extremist channels on telegram in a messaging app so most of us probably know what telegram is. Think think Twitter would not really twitter twitter owns it’s encrypted trying to think of it what am I trying to think of think WhatsApp, but but not video calls and neo nazis and white supremacist capitalized on the lists so that’s the surprising part to me anyway, and publish them aggressively across their venue said read a cat sites executive director using a data far right extremist work calling for a harassment campaign while sharing conspiracy theories about the Coronavirus pandemic. The distribution of these alleged email credentials were just another part of months long initiative across the far right to weaponize the COVID-19 pandemic. The report by site based in Bethesda, Maryland said the largest group of allegedly emails and passwords was from the NIH with 9938. Found in this list posted online, the Centers for Disease Control and Prevention had the second highest number with 6857. The World Bank with 15 and 20 in the list of who addresses and passwords total 20 732. smaller numbers of entries were listed for the Gates Foundation, private philanthropic group whose co founder Microsoft co founder Bill Gates last week, announced 150 million dollars in new funding to combat the pandemic. Also targeted was the Wu Han Institute of biology, a Chinese Research Center in the city where the pandemic began, that has been accused of a role in triggering the outbreak. So here we go. With white supremacists getting involved in online extortion and hacking and data breaches and so forth. It’s kind of scary to be honest with That, you know, most people don’t think of these groups as being as having high levels of access to tools and ability to do these things. And it’s that’s actually not true. So it’s going to be interesting as we move forward, because there is a lot, a lot of conspiracy theories are out there around COVID-19. And there seems to be an increasing number of hostility on both sides of this thing. So hopefully, we can all calm down and come to cool level heads and stuff like this doesn’t continue. Also, speaking of COVID-19, the SBA was breached. And as we know, the SBA is giving out loans and in some cases on grants to help small, small businesses and you know, I’m not going to get political here on this but it didn’t really work the way they expected. I don’t think but anyway, US COVID-19 relief On the x data on thousands of firms This was reported on info security magazine calm but it’s been reported in a few different places. Thousands of us businesses may have had personal information PII leaked online after a government agency error led problems with applications for economic relief. The Small Business Administration admitted the error and your letter to affect a company’s widely reported in the us this week. It claimed that a problem was discovered with the online portal used by businesses to apply for economic injury disaster loans, which is idle for sure. Ideal. unspecified personal Identifiable Information link to 7900 businesses may have been disclosed to the other applicants of the program. So it wasn’t it wasn’t malicious attack. It was an error, but it may have exposed information to other businesses. They do say that the PPP portion of the of the stimulus stimulus package was not impacted. So that is good news. I suppose. But beyond the walk, you know, just watch your credit, watch your, your banking information and so forth. Make sure that your business does not become compromised from this Get, get some identity monitoring some breach monitoring going on if you need some breach monitoring, if you want me to check since and an email to support at and wash dot tech and wha tech, and we’ll be happy to check for you. And if you want monitoring, we could talk about that too. But we’ll check once for free. No problem. I have no problem doing that. So just reach out to us. Or you can just message us on Facebook. It’s m.me dot Hold on. I’m gonna mess that up. I was getting the Facebook address wrong. It’s m.me slash and wash tech m.me slash NW AJ tech. That’s our Facebook Messenger. You can also message us there We got a few hot topics two of them are these mega corporations trying to get involved or more involved I should say in healthcare. The first one being reported in healthcare IT news calm scripts Stanford working with Fitbit to assess wearables COVID-19 tracking abilities. We see an enormous opportunity to enhance disease tracking for improved population health during the COVID-19 pandemics at Scripps Research translational Institute’s Dr. Eric Topol, Scripps health and Stanford medicine have joined with Fitbit for a new study to gauge how well wearable devices can help track trace and isolate COVID-19 and other infectious diseases. The Scripps Research translation translational Institute recently launched an app based research program called detect that can analyze wearable health data, such as activity levels, heart rate and sleep and to more quickly detect viral illnesses caused by Coronavirus, influenza or other infectious diseases. The Stanford healthcare Innovation Lab, meanwhile, recently launched its own COVID-19 wearable study, which is exploring how data collected from wearables like heart rate, heart rate, skin temperature and blood oxygen saturation can be used to predict the onset of an infectious disease before symptoms start. So not just COVID-19. But other things like the flu. With Fitbit scripts in Stanford, other institutions are welcome to join in a consortium they say plan to assess how well such device driven approaches could be scaled up for public health response to outbreaks like COVID-19. Earlier this year, Scripps published evidence that wearables can help predict onset flu and similar diseases before symptoms start. The goal of the new consortium is to build on that research. With special focus on public health emergencies like this one, researchers will run many studies independently with a findings aggregated and shared across the consortium. Fitbit will help boost consumer awareness and help its customers participate in the effort so you will have to opt in. opt in. It will also donate wearable devices to scripts Stanford and others Fitbit users can learn how to participate in the studies through the company’s COVID-19 resource web. And there is an article on this page on this post, which will be a link to on the show notes. It’s looking like consumers devices will have a big role to play in any large scale track and trace effort to stem the tide of COVID-19. This past week, Apple and Google announced plans to develop API based API enabled interoperability between iOS and Android products and eventually build Bluetooth based contact tracing functionality into their respective operating systems to give public health officials better visibility into how Coronavirus might be spreading. Fitbit, meanwhile, also rolled out a new feature this week that can connect you To telemedicine services through its partnership with vendor plus care. From our previously published work, we know that data collected from consumer wearables can significantly improve the prediction of influenza like illnesses, said Dr. Eric Topol, director and founder of SRT AI. In a statement we see an enormous opportunity to enhance disease tracking for improved population health during the COVID-19 pandemic, and are pleased to join this new consortium to bring value to the research community. By bringing together these and other leaders in scientific research, we hope to rapidly advance science and innovation in the fight against COVID-19 by promoting consumer participation and critical release research efforts, supporting frontline health care workers and donated wearable devices and sharing learnings quickly and openly across research partners added James Park, co founder and CEO of Fitbit. So it’s interesting because you know, we’re you have to opt in so both the Fitbit thing and The Apple and Google thing you have to opt in even once the app on Google thing is OS based, you have to opt into it now, so not everybody’s gonna opt in. And I think a big part of that is do we trust Fitbit, Google and Apple to not release our PHR to people we don’t want it to get in, get in the hands of and then there’s the whole tracking piece so now we’re giving it not that it doesn’t already exist, because it absolutely does GPS is on all smartphones now. And you can be tracked, even if you turn GPS off, you could still be tracked, it’s not as accurate but you could still be tracked. But we’re essentially saying yes go ahead and track me track my movements track you know, so there’s there’s some gray area there that I’d like to see them address if they’re going to move forward with this because that those areas kind of scare me. You know, there’s even some talk online of, of using a chip implant. To track things and I know for a fact that is not going to sit well in America. So I would like to see more information as to how they plan to roll this out what safeguards are in place, there’s a lot of interoperability going on here. That tends to lead to potential breaches. And so obviously, there’d be a lot of concerns in that area. Speaking of Google, on Zd net, Google wants to make it easier to analyze health data in the cloud. google has opened up its cloud healthcare API to allow doctors to analyze data using cloud computing technologies. So you know, another API in place here. And if you know anything about API’s, you know that they are historically not secure. So this is another issue to consider with with these these large mega companies work together to you know, under the under the Healthcare umbrella. Trying to choose my words carefully here under the healthcare umbrella. There may be some opportunities here for the bad guys to sneak in. And I think that’s the concern that I have with a lot of this. But anyway, Google has expanded the availability of its cloud healthcare API in a bid to improve healthcare interoperability, and help providers drive insights from a myriad sources of medical data. Google’s cloud healthcare API allows healthcare organizations to collect and manage various types of medical data via the cloud, including digital imaging and communications in medicine. Also, daikon for short di c om, alpha level seven and East healthcare interoperability resource standards that’s Did I say East it’s fast healthcare interoperability resource. fH IR standards. This data can be fed through analytics and machine learning programs so that healthcare providers can identify patterns that could help improve patient care, which, you know, if that’s, that’s great, you know, let whatever we could do even if it’s to take a few minutes off of somebody’s healthcare that could save lives. As Google notes gathering a unified view of the multitude of data formats and inputs often possesses a Herculean Herculean effort, not least due to the highly fragmented nature of the healthcare systems, meaning the different systems use different formats and different EMRs EHR. So they’re not it’s going to take a lot of effort to have them all. All become the same format, all readable for everybody, which is something that HHS and OCR and other organizations have been trying to accomplish for years now. This is not new on C was trying to work on this as well. interoperability was always in place doesn’t always work well because you know the same reason that information isn’t always easily translated to whatever system the next doctor in the next healthcare system might use. It is hoped that running capture data through AI and machine learning while identify patterns that could help improve patient outcomes, which is an issue that has taken center stage as healthcare providers around the world scramble to react to the COVID-19 pandemic. We know that the pandemic is impacting every aspect of the healthcare industry differently and that needs organizations that the needs organizations are rapidly evolving Google said in a blog post. Our goal is to bring our technology expertise to bear in helping with experts, your experts so that healthcare organizations can focus on providing the best care to as many people as possible. Google launched its cloud healthcare API in early access release in March of 2018. The company has been working on partnership with Mayo Clinic since 2019. To demonstrate how cloud based AI technology could transform healthcare delivery. Mayo Clinic has since been using Google’s cloud API healthcare API to enable the storage and interoperability of its clinical data. Google said dr. john Halla, Maka allama halamka, President of mayo clinic platform said, we’re in a time where technology needs to work fast, securely and most importantly in a way that furthers our dedication to our patients. Google clouds healthcare API accelerates data liquidity among stakeholders and in return will use will help us better serve our patients. The issue of interoperability remains a tricky subject with healthcare battles over data formats and ownership stymies efforts to join up healthcare systems and make patient data available to healthcare professionals whenever the end whenever wherever they need it. So imagine, you know, two giant healthcare systems that use different data formats. They’re not going to want to budge and change those formats because of the massive costs that would be involved and the training That would be involved in the US. inroads have been made recently through the passing of rules by centers of Medicare and Medicaid Services, and National Coordinator for Health Information Technology OMC to make it easier for healthcare organizations to exchange patient data for patients to access their own information. So we’ve talked about that before but rights of access so Google said its cloud healthcare API was designed to scale and support interoperability and patient access. It added that the COVID-19 pandemic had made the need for increased data interoperability more important than ever. elsewhere. The Internet giant has been harnessing its mobile technology to aid effort to track the corona virus outbreak. We talked about that a couple times already. In a partnership with Apple and the COVID-19 tracking via smartphones, the operating systems through Bluetooth are not out yet. But that is something that is being worked on. So again, Google to go dipping your hands into healthcare. And you know, it might be prime time that it happens because of COVID-19. And because it’s not even just the outbreak right now it is the concern that fall in winter might be worse when combined with the flu. So we’ll see what comes with that. I’m sure there’ll be more talk around that as well. I’d love to hear your thoughts. If thoughts and concerns, you know, what do you think? What do you think about Google Cloud healthcare API, working with more healthcare providers to try to slow down this pandemic? What do you think about them? We’re going with Apple tech to come up with a way to trace people who may have COVID-19 what do you think about Fitbit? It’ll be interesting to see what people think and where it goes from here. And, you know, obviously, there are some, some concerns some risk factors involved too. So we’re going to try something a little different here. We’re going to talk about whether or not ransomware attacks should be coming. a data breach indices. This is not a new topic. It’s been around for a little while. It’s been kicked around for a little while. But this comes up this week because of the ransomware attack on Cognizant, know, Cognizant is a very large, it vendor, an MSP. They have, I believe 300,000 employees, and I think I saw $15 billion in revenue last year. They were hit with a ransomware attack and have lots of customers and they’ve warned their customers that this has happened. So now they’re dealing with the ramifications of that. What are the ramifications? So the attack was maze ransomware maze was the first one, I believe to say the maze ransomware operators were the first one to say if you don’t pay up, we’re going to release the data we have stolen to the public. So In some cases, not a big deal, because, you know, the company probably doesn’t have any sensitive information, but maybe they do. Who knows. But in some cases like Cognizant boot can just about guarantee they have health care providers and other, you know, law firms and financial firms that probably have some sensitive information and have some compliance issues. So now it becomes an issue. So now, maze ransomware. And now some others. So don’t mcareavey Doppel primer and a few others have said, we’re going to hit you a ransomware. But before we hit you with the ransomware, we’re going to steal your data. And if you don’t pay that ransom demand, we’re going to post that data on our hacker forums. And so now you’re releasing your sensitive information and potentially client sensitive information to the world. That is a data breach by definition that is a data breach. So if if in the case, let’s say Cognizant here, has, I don’t know, let’s say they have 500 gigs of data, client data sensitive data could be you know, credit card information, PII in some cases, it could be pH I if to have this information, and it gets shared to the world. That is a, I mean, it’s already been breached. So Mase already has it, that is the definition of a data breach. the theft of data from one company to one company is a data breach. So it means has gone in, taken the data, taking it off of cognizance network, brought it to wherever they’re going to store. That is a data breach. You know, a data breach could be as simple as a thumb drive that goes missing or a laptop that goes missing all the way to something like this where or a data breach could be, you know, you’re left to an Elasticsearch database or an s3 bucket open to the public. On the internet. That’s a data breach because Now it’s available to more people that shouldn’t be seeing it. And so we hear these things all the time. They’re all data breach, they all qualify as data breaches. And we don’t. We don’t have data breach laws everywhere yet, it will, it will eventually happen to us, we’ll have to catch up and have their own version of GDPR, which would which this would fall under GDPR. In Europe, this would fall under the ccpa, California Consumer Protection Act. New York has the New York shield law. So all of these things would fall under, under if Cognizant, and I’m not even sure Cognizant is based, I believe they’re based somewhere in Europe. But this would fall under data breach for those, those you know, whether it’s Europe or the states, individual states, um, it qualifies as a data breach and because of the size of the organization, you can bet there would be significant penalties in any of the cases. So Mays ransomware in the last few months. has hit South wire which is down south, I believe in Georgia and demanded a significant amount of money. I believe it was $6 million in Bitcoin. And there hasn’t been an update to that. But they did the same thing. They leaked the data on their forms, and said pay up. Oh, we’re gonna release more. They don’t release it all at the same time. Yeah, it was $6 million. They don’t release it all at the same time, but they do release some just to show that they have and then they keep releasing a little bit at a time to say we do have it. Eventually did publish 14 gigs worth of files, which is, you know, if it’s just documents, that’s a lot of files. chub was it just was in March earlier this year. Earlier this month, they were hit. Allied universal was breached. Chubb is an insurance carrier, by the way, they they’re a big cyber Insurance Agency. They sell a lot of cyber insurance. That’s their main focus, I believe, and they were hit with Mays ransomware. So that means their data was pulled off of Chubbs internal network. And Mays kept it and Mays again, there hasn’t been a lot of updates since since the last one at the end of March. I’m sorry, it was last month, not this month. So it’s been about a month since we’ve gotten an update on that. But chub was also hit and chub if you’re in the IT world, you know that they’re one of the one of the players in cyber insurance. Now they’ve been breached, do you trust someone who sells cyber insurance to provide cyber insurance to you if you’re in it or any business for that matter, when they have been breached? now it becomes a reputation issue as well, not just a data breach, but it is a data breach. They took the data off of their network, they now know who has potentially now know who has cyber insurance from Chubb. And what does that mean? That means now that that those companies, those individuals could become phishing attacks and nine we all know it’s 90% of ransomware attacks begin with a phishing attack. And if it’s made, it becomes a data breach if it’s if it’s Doppel paper or soda mcareavey, it becomes a data breach. Allied universal. I don’t have a lot of detail on that one. But they were also hit with a data breach, major ransomware attack, which was a data breach. They did leak the stolen data. And now we have cognitive so Cognos, it just happened a few days ago. And there are others. These are some of the bigger ones. Cognizant just happened. Or, Oh, I forgot one. In December we had one for city of Pensacola. Right. Do you remember that was $1 million ransom request. City of Pensacola in a few days later, there was a shooting on I believe a military base wasn’t related. So Mays was quick to point out they had nothing to do with that. But city Pensacola really, really took a big hit in that one week period and their data was breached their data was stolen and leaked. So then and what does this tell us? So we have a municipality. Well there’s one on Italy as well. There’s South wire which is a what it sounds like they make they make wires and things like that. There’s one here. Allied Where did it go? allied universal which I’m not sure what allied universal is. You have Chubb which is a cyber cyber insurance carrier provider. Allied universal is a security company it says facility like physical security. You we did have one on Hammersmith It was called which was a facility in the UK that was preparing to test COVID-19 vaccines and this As I said, we’re not going to attack healthcare facilities during this pandemic. And they had attacked right before the period before this was called a pandemic. They, so, that aspect of it, they said, we’re not going to do it. They did it before they said they weren’t going to do it. But they released the data on their forms after they said they would not attack any healthcare facilities. So what what is the point I’m trying to make here? And then of course, you have Cognizant, they don’t care what industry you’re in, they’re going they’re opportunists. They’re going to attack whatever they can get. And they’re going to try to make money off of whatever they can get. The question here is, is this such as should this be considered a data breach? And if you think about the basic, very basic definition of a data breach, is when someone breaks in, steals your data, and leaves what that data and then does whatever they do plan to do it that data right. The data is no longer in your control. That is is a data breach. Mais Sodano KB Doppel payment and a few others now are doing just that they break in, they don’t do a physical break in and do it through your, you know, a lot of times through phishing, or some other vulnerability that they’ve they’ve found on your, your systems. They steal the data. Then they encrypt everything. And they leave you a message saying pay this ransom, or we’re going to start releasing data. So in that now that the ransom amounts have gone up, because they’re saying,

Transcribed by https://otter.ai

The post ProactiveIT Ep 26 – Is Ransomware a Data Breach? appeared first on Nwaj Tech - Information Tech & Cloud Support.

This is Episode 25!  

Intro

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance and more.  We also bring you real world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback. What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

QOTW: How Can I Secure My Zoom Meetings?

Chrome 81 Released With 32 Security Fixes and Web NFC API

Gambling company to set aside $30 million to deal with cyber-attack fallout

New Wiper Malware impersonates security researchers as prank

Bad Actors Infiltrated New York’s State Government Computer Network

Cyberattacks Target Healthcare Orgs on Coronavirus Frontlines

TikTok users beware: Hackers could swap your videos with their own

Exclusive: Personal data of 1.41m US doctors sold on hacker forum

PPE, COVID-19 Medical Supplies Targeted by BEC Scams

Topic 1: Apple, Google Team on Coronavirus Tracking – Sparking Privacy Fears

Topic 2:  Cybercrime May Be the World’s Third-Largest Economy by 2021

Topic 3:  Free tools and services for businesses during the COVID-19 crisis

HIPAA Penalties Waived for Good Faith Operation of COVID-19 Community-Based Testing Sites

Court Rules McHenry County Health Department Must Disclose COVID-19 Patients’ Names to 911 Dispatchers

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the proactive IT podcast this week the latest in it in cybersecurity news, plus Patch Tuesday Coronavirus tracking from your phone and free tools to tackle work from home challenges. This is Episode 25 Hi everyone and welcome to the productive it podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech a client focused and security minded IT consultant Located in Central Connecticut, you can find a set in watch check comm that’s NWA j tech.com. All right, before we jump into things, I want to thank you for listening, wherever you’re listening to this, whether it’s Apple, Google, Stitcher, whatever podcast platform you’re listening to this on, if you could, like review, share, comment, whatever you can do to spread the word, it would be greatly appreciated. We really just are trying to educate people so that we can somehow reduce the amount of cyber attacks that exist today and educate people on on the opportunities that exist in the cyber world. Also, if you are in a HIPAA compliant business, speaking of education, go to Facebook and in a search type in get HIPAA compliance join that group. Because we do educate each and every almost daily, almost daily, I share something on there in that group. So it’s very educational for those of us in healthcare or those of us that are business associates of healthcare providers. Alright, let’s jump into the Patch Tuesday updates because it is Patch Tuesday this week was Patch Tuesday. So we have quite a bit of news we already talked about this month, Google Chrome was up updated to Chrome 81. Firefox was updated to 75. Both of those to address security concerns. Juniper Networks releases security updates. That was a week or two ago, Microsoft Office had some updates to adjust some crash fixes. And then VMware, I’m not sure if I reported that week. Last week, VMware vCenter, have vCenter Server had some updates to address address some flaws. So if you’re using VMware, I’ve received a bunch of emails on that for some reason. I don’t know why that’s the focus right now. But I did receive a bunch of emails from some of the vendors that I use about that as well. So it’s pretty significant. If you’re using VMware update it. This week, Oracle released a bunch of updates to tackle 400 And five bugs in their software. Not going to go into a lot of detail on that. But if you’re using Oracle in your environment, chances are you have Oracle, you have patches that you need to apply as soon as you can. Microsoft Of course released their Patch Tuesday updates this week, they address three zero days and 15 critical flaws on the zero day vulnerabilities or OneDrive for Windows elevation of privilege vulnerability, Adobe font manager library remote code execution, there are three of those phone vulnerabilities. And then there are 15 critical patches as well as a bunch of other patches. So the critical patches, mostly the same that we’ve talked about in the past, some remote code execution, some SharePoint chakra scripting engine and then scripting engine generally Hyper V remote code execution. So there are a few that need to be taken care of. Intel also released some updates until April platform update, including some high severity security fixes. And they include Intel nook for firmware until modular server compute module until data migration software until pro set wireless Wi Fi software until binary configuration tool and Intel driver and Support Assistant. So you’ll want to apply those as well. Adobe had a few updates. So the Adobe updates include updates for cold fusion after effects in digital editions. As I’m looking at this, the VMware did release another update for V realized log insight. So get that taken care of Cisco and Google released more updates. So Google, you should be Google Chrome is shut down at 1.0 point 404 4.113 For Cisco we have updates for IP phone web server, remote code execution and denial of service vulnerability multiple vulnerabilities in Cisco UCS, director in Cisco UCS Director Xpress four v four big data, wireless LAN controller 8802 point 11, generic advertisement service denial service vulnerability, wireless LAN controller, cap whap, denial service vulnerability, WebEx network recording player and Cisco WebEx player arbitrary code execution, vulnerability, mobility Express software, cross site request forgery vulnerability. I will t filled network director denial service vulnerability, Unified Communication manager path traversal vulnerability and arrow net service series access points client packet processing denial of service vulnerability so quite a few patches from Cisco this month, just released yesterday. So Cisco and Google, you should update those just came out yesterday. So update those and then of course Test and roll out your Microsoft patches and your your and your Intel patches as quickly as possible because some of these are active exploits. We did get a question of the week the question of the week was around how to protect zoom. And I did go over that last week in the podcast. So I’m just going to touch on that real quick. Again, the best things you can do just a few I wrote a blog post it’s a blog post is on watch tech COMM And wha tech comm 12 ways to secure your zoom meetings. 12 easy ways to secure your zoom meetings to be more specific but Tom probably the most important things is to add a password to your meetings, don’t share the meeting invitations publicly, like on social media and to enable the waiting room because waiting room means you have to approve anybody coming into the meeting. So that’s three of the 12. And there are more on that on the on the website. So go check that out. But that’s probably I would say those are probably the three best. And of course, there’s always password and two factor authentication that we’ve talked about ad nauseum on this podcast. So I’m not going to talk about it here. So hopefully that answers your question. Um, we’re gonna move on to the news. All right, first up on Zd net gambling company to set aside $30 million to deal with cyber attack Fallout. In the middle of a merger SP tech will have $30 million placed in escrow to deal with the repercussions of the past cyber attack. Online betting company SP tech will have to place 30 million in escrow as insurance for covering the fallout from a cyber security incidents incident that took place last month. The company agreed to do so as part of a renegotiated acquisition terms with diamond Eagle acquisition Corp Dec for short, it blank check company that acquired us protec and rebel platform DraftKings and is planning on merging the two later this year. In a filing with the US securities exchange commission da da de AC said SP tech must place 10 million in cash and 20 million in stock and an escrow fund. For the next two years. The funds will be used to deal with the expenses caused by a cyber security incident that took place on March 27. As reported by legal sports report at the time as the text platform went down in an incident that looked like a classic ransomware infection. Hundreds of third party websites that relied on SP tech sports betting and online casino platform went down GSP tech was down for almost a week before it resumed service with international partners but not with its us customers. The company’s waiting is still waiting for approval from us GM gamma regulations before returning service to us partners. D AC which agreed to pay around 600 million test B tech last year is expecting lawsuits for lost revenue from both international us partners and established the $30 million fun to deal with any fallout from last month’s security incident. If no litigation ensues, the cash and locked up, stocks will return to SP tech ownership. Expenses go over the $30 million emergency fund da da si said it would dip into another 70,000,025 million in cash and 45 million of stock that also sits in escrow. The second fund was set up part of the initial acquisition deal as a safety blanket for unforeseen as protec related operating funds in litigation. If 200 million is still not enough, t AC said it would pursue further funds from SB Tech’s current owners. So there you have it, Tom, when you’re selling a business, make sure you don’t have any pending litigation because it could cost you even after you’ve agreed to the terms of the sale. bleeping computer Reports new wiper malware impersonated security researchers as a pay as a prank. A malware distributor has decided to play a nasty prank by locking victims computers before they can start windows and implement the affection on to well known and respected security researchers. Over the past 24 hours after downloading and installing software from what appears to be free software and crack sites, people suddenly find they’re locked out of their computer before windows starts when locked out to PC will display a message stating that they were infected by vitalik Ramirez and malware hunter team who are both well known malware and security researchers and have nothing to do with this malware. So vitalik crumb as part of the Sentinel one team Sentinel one labs and the other one malware Hunter. Team is another security research team. here’s a here’s a sample of the text. Hello, my name is vitalik Gomez I infected your stupid PC you idiot write me on twitter at V k underscore Intel if you want your computer back If you do not answer if I do not answer right my husband twitter.com slash Mao is ma L. wr hunter teen to protect your effing computer in future install Sentinel one antivirus I work here as a head of labs I telecom as Inc 2020. Another variant calling itself Sentinel ones labs ransomware has been distributed targets only by teller comas and discloses his email address and phone numbers so I’m kind of a cruel prank just know that you know Sentinel one Labs is not behind this by teller criminals and malware hunter team are not behind this. So hopefully you shouldn’t be downloading things from from crack websites. Anyway. These are the sites that take software, legitimate software, find a crack to bypass the licensing, keys and so forth. And installed on computer typically what happens with those is you’re not just installing that software. Also installing something else it might be a key, a key. A key key logger. It might be some other malware might might might be a way to take over your computer when it wants to to use for Distributed Denial of Service could be ransomware as the case is here. So something to think about before you use pirated software. The state of security justice on chipper tripwire.com bad actors infiltrated New York State Government computer network, so officials revealed that malicious actors had succeeded in infiltrating new computer networks serving New York State’s government. According to Wall Street Journal officials revealed on April 13 that New York’s Office of Information Technology had discovered a security incident in late January, its analysis unveiled that those individuals responsible for the attack had constructed tunnels into some of New York servers in the state used for relaying encrypted data. That information ranged from motor vehicle records to pay information for 250,000 employees employed in New York state agencies and public universities in response to the findings discussed above New York brought in helped to determine the extent of the security incident Richard as a party, senior adviser to New York Governor Andrew Cuomo revealed that the subsequent investigatory effort uncovered no evidence that personal data of any new york resident employee or any other individuals were compromised or have been taken from our network. The state is currently working with Federal Bureau of Investigation to pinpoint the identities of those responsible for the breach to people familiar with that collaboration tool Wall Street Journal, that a foreign actor was likely responsible for the security incident. In the meantime, state officials decided to augment government systems existing digital security measures. They did so by installing additional digital security software and resetting passwords at agencies affected by the breach. Among them was the state’s comptroller office, which confirmed to the wall street journal that I had implemented certain measures to harden its digital security posture. No statement regarding the breach was available on New York’s Office of Information Technology website at the time of this reading, which was April 15. So it was Wednesday. On news it attack comes less than a year after the New York State enacted to stop hacks and improve Electronic Data Security Act, which is shield for short, which is kind of ironic, really, because the state implemented this and they are they have been compromised. Hopefully data was not stolen. You know, we wouldn’t want that to happen. But it would be ironic if it did. Threat post cyberattacks target healthcare orgs on Coronavirus, frontlines, not really new news, but again, I’m going to state it because it needs to be stated repeatedly. cyber criminals aren’t sparing medical professionals, hospitals and healthcare orbs on the frontlines of the Coronavirus pandemic when it comes to cyber attacks. ransomware attacks and malware recent malware campaigns revealed that cyber criminals aren’t sparing Healthcare firms, medical suppliers and hospitals on the frontlines of the Coronavirus pandemic. Researchers have shed light on two recently uncovered malware campaigns one target and Canadian government healthcare organization and the Canadian medical research university and the other one and the other hitting medical organizations and medical research facilities worldwide. email sent to those unnamed organizations purported to send COVID-19 Medical Supply data critical corporate communications regarding the virus or the corona virus details from the World Health Organization but actually aim to distribute ransomware info stealer malware and more. These recent campaigns are the tip of the iceberg when it comes to cybercrime targeting organizations in the healthcare space. Researchers said despite prior reporting by various sources indicating that some cyber threat attackers activity may subside in some respects during the COVID-19 pandemic unit 42 has observed quite the opposite in regard to the COVID-19 themed threats. Particularly in the realm of phishing attacks at Adrian McCabe, Vicki Ray and Juan Cortez security researchers with Palo Alto Networks unit 42 team. Between March 24 and 30th, researchers observed various malicious emails attempting to spread ransomware to several individuals associated with an unnamed Canadian government health organization actively engaged in COVID-19 response efforts as well as a Canadian university that is conducting COVID-19 research. The email sent from the spoofed who email address no reply at who it contained a Rich Text Format file that purported to spread information about the pandemic when opening RTF file tempted to deliver a ransomware payload that exploits a known vulnerability in Microsoft Office, which allows attackers to execute arbitrary code. Now vulnerabilities CVE 2012 dash 0158. So if you’re using something that hasn’t been patched since 2012, because that’s the year is 2012. That means that that’s when the vulnerability was destroyed. And then then you have other things that you need to talk about what your security team. And so then goes on from there to talk about what, what types what they’ve discovered with these attacks. So the whole point of this is, yes, the cybersecurity threat landscape is very real. And it had and the number of attacks has increased dramatically, including phishing attacks, which is probably the number one type of attack at this point in it. And now remember, 90% of ransomware attacks, begin with a phishing attack. So if you are finished successfully, then there’s a good chance you are going to get hit with ransomware. Next, and we’re going to talk about some phishing attacks on healthcare later on in this episode, because there have been someone who is one where the attacker was in for a few months. Nick, a security by Sophos reports Tick Tock users beware hackers could swap your videos with Their own mobile app developers Tommy Miskin, tala has backery just published a blog article, entitled Tick Tock vulnerability enables hackers to show users fake videos as far as we can see there, right? This is according to the article on naked security by so forth. We replicated the results with a slightly older Android version of tic toc from a few days ago. 15 point 5.4 for the test included deleted the very latest builds on Android and iOS number 15 point 7.4 and 15 point 5.6 respectively. We used a similar approach to misc and Hodge backery. To look at the network traffic produced by Tick Tock we installed packet capture or T packet capture sorry, app on Android and then ran the TIC Tock app for for a while to flip through a few popular videos. So I’m gonna just give you the the summary here. So essentially what happened was they ran t packet capture which captures all the traffic between From in your network, as long as you’re on the network, it can capture all the traffic. So it’s similar to Wireshark. And you do end up using Wireshark at the end of this. And so what they grabbed was a bunch of traffic from tik tok. Some of it was encrypted. Some of it was not what wasn’t encrypted was to get requests that show images and videos in the data fetch was that was not encrypted. Plain old, unencrypted HTTP requests include a profile pictures, still frames from videos and videos themselves. And now because you’ve captured this information, you could swap it out with some other information. So that’s the that’s the newest thing with tic toc that we need to be on the lookout for and I’m sure now that it’s out there, it will be exploited. On that being said, I would highly recommend if you’re using Tick Tock or know anybody using Tick tock, think twice Talk until it’s until it’s secured and it could prove that it’s secure. I would just leave it alone. On hack read calm. personal data of 1.41 million US doctors sold on hacker forum cyber criminals are taken advantage of the COVID-19 pandemic from selling fake Coronavirus, vaccines and testing kits to setting up malware infected fake live maps of the infection crooks can go any level to make cheap and quick book bucks on hacker forums. In the latest a cyber criminal selling personal and contact details of 1.41 million doctors based in the US this can turn into a disaster for doctors and healthcare staff busy saving lives amid the pandemic hacker.com has learned that the database and discussion was stolen on April 11. From QA dot find a doctor calm, an online service that lets people search for the healthcare professional book instant appointments and consult with doctors online. The targeted website is based in Edison New Jersey and owned by Millennium technology solutions, and look at it shows it claims to average stood 100,000 plus doctors and 5000 plus members. The website allows both doctors and patients to registers themselves. With their email Jeff dresses though patients are required to snap a photo of themselves, or upload one from their PC to register the membership. We can confirm that patients photos or medical records are not among the stolen data. However, the what includes what is included in the data is enough to target doctors. For instance, the sold records include details like full names, genders, name of hospital organizations, where they work, location, mailing address, practice, address, country phone numbers, license number and much more. The good news is that trove of data does not contain email addresses, which means doctors are safe from phishing and malware scams, but based on the leak records, finding the error their email addresses will be a piece of cake which is very true by the way. Hacker comm was able to find dozens of doctors in New York based on the sample data we have seen. Furthermore, cyber criminals can use available phone numbers. To carry out a phishing attack or even phishing which is so smishing is phishing over text SMS and phishing is voice phishing. A malicious technique involving sending or of text messages while phishing links to steal financial data or redirect the victim to website dropping malware. Simply put, attacking options for cyber cyber criminals with this data are infinite. And there is a phishing phishing attack going around right now it’s saying you know, you may have come in contact with someone who is infected with Coronavirus and and there’s a link so that is not real. Do not click on it. We are going to talk a little bit about a plan Apple and Google have for tracking COVID-19 but we’ll get to that shortly. And then our last bit of news before we move on to our hot topics threat posed PP and COVID-19 medical supplies targeted by BTC scams. FBA I said government agencies aiming to buy a critical items like ventilators have unknowingly transferred funds to threat actors much has been publicized about the shortage of personal protective equipment and other supplies for healthcare facilities in the United States during the COVID-19 pandemic. Now, the FBI is warning that threat actors are taken advantage of efforts to procure PP, and critical equipment such as ventilators with new business email compromised, that’s bc for short, and other scams aimed at defrauding go seeking supplies. And a warning posted to the FBI website. The law enforcement agency said it was aware of multiple incidents in which state government agencies were duped into sending advanced funds to both domestic and foreign fraudulent brokers and sellers of things like in 95, Mass and gallons. these so called Advanced fee schemes are among several new fraud campaigns the feds have observed alongside more typical bc scams. The common theme is that they all use socially engineered emails, tried to fool people to try to fool people into sending funds To what they think are legitimate entities instead directing payments to accounts that bad actors can access in advance fee schemes. related to procurement a victim prepays partially or in full a purported seller or a broker for a good or service and then receives little or nothing in return FBI officials explained in the post. In one case, a purchasing agency believed it was working with someone with whom already had a an existing business relationship showing the sophistication of the attack according to the FBI. By the time the person purchasing agencies became suspicious of the transactions, much of the funds have been transferred outside the reach of the US law enforcement and we’re unrecoverable. Indeed the COVID-19 pandemic has brought threat actors out of the woodwork with a raft of new scams and attacks aimed at the multiple and complex aspects of the crisis. Many texts have focused on individuals interested in receiving accurate information about the pandemic and have used email based attacks and spread to spread malware. One campaign for example, you socially engineered emails promising access to important information about cases of COVID-19 and the receivers local area. Instead of providing this to fake messages evaded top email detection software and spread malware that steals the user’s Microsoft login credentials. And another example is a spear phishing campaign used emails claiming to be from World Health Organization to send an attachment to unleashes the info stealer, locate Loki bot. If downloaded and open, the agency also provided some warning signs to look for. For those in charge of procuring supplies. These signals include someone initiating the contact with the buyer, especially from a difficult to verify channels such as telephone or personally email, the seller or broker being an entity with which the buyer has not previously done business or solid that can’t be verified with the manufacturer of the products, the entity aims to distribute. Another red flag is an unexplained interest urgency on the part of the seller to transfer funds or last minute change in the wiring instructions. That part is previously agreed to authority sent. To mitigate these types of attacks, the FBI recommended several steps that procurement agencies can take. These include avoiding prepayment scenarios altogether by routing payments to a domestic escrow account, with funds to be released to the seller upon receipt of the Promised items. Other efforts to shield organizations includes having a trusted independent party ensure that the items for sale are physically present and verifying the contact information such as email addresses match the actual sender of the message is according to FBI schemes aimed at healthcare facilities continue to ramp up recent research shed light on to recently uncovered malware campaigns one targeting Canadian government healthcare organization and a Canadian medical research university and the other hitting medical organizations and medical research facilities worldwide. So we just talked about those a few minutes ago. The email sent to these unnamed organizations purported to send COVID-19 Medical Supply data critical corporate communications regarding the virus or Coronavirus details from the World Health Organization but actually aim to distribute ransomware info stealer And more. Another thing you can do to avoid being scammed. This way bc scam is to verify the sender, make a phone call. It only takes a few minutes verify that they are who they say they are. And if you’re not sure, then then reach out to the FBI and see if they can shed some light on it. But you shouldn’t really be doing business completely over email unless you know the person and are comfortable with the person and can verify who they are. All right, as promised, let’s talk about Apple Google team on Coronavirus tracking. And then this of course sparks fears of privacy issues. This is on threat post. This has been reported in multiple places now. But we’re going to take it from threat post.com Apple and Google announced that decentralized Bluetooth technology will soon be rolled out for Coronavirus contact tracing privacy implications are worrisome for some Apple and Google are teaming up to launch technology that traces the spread of Coronavirus via apps for iOS and Android users despite the company’s insistence that privacy will be of utmost importance. Some in the security space, remain wary of data privacy concerns. Around the newly announced technology, Apple and Google plan to use decentralized Bluetooth technology and smartphones to help users track whether they have been exposed to someone who has tested positive for the virus also known as contact tracing. The way it works is this any Android or iOS user who has opted in is assigned an anonymous identifier beacon, which will be transmitted to other nearby devices via Bluetooth. This is similar to Bluetooth signal tracing technique used by Singapore and a Coronavirus tracking app called trace together world In March, when two people who have opted into the tracking into the contact tracing are in close contact for a certain period of time, their phones will exchange their anonymous identifier beacons. If one of the two is later diagnosed with the corona virus, that infected person can enter the test result into an app such as compatible app from public health authority. Then the infected person can consent to uploading the last 14 days of his or broadcast beacons to the cloud. And the other person who has been in close proximity to the person infected will then be notified via the phone that an exposure to someone who has tested positive for Coronavirus took place. This technology will be rolled out in two phases. The first phase will be an application programming interface released in May that public health agencies can integrate into their own mobile apps. Many such Coronavirus tracking apps are already available such as COVID symptom tracker, and private privacy private kit safe paths. The second phase will work at an operating system level and will work at opt in basis for Android and iOS users in the coming months. The OS level version is more robust solution than an API and would allow more individuals to participate if they choose to opt in, as well as enable interaction with a broader ecosystem of apps. And government health authorities said Apple and Google and a Friday statement, privacy transparency, transparency and consent are of utmost importance in this effort. And we look forward to building this functionality in consultation with interested stakeholders. Both Google and Apple’s just that they are taking extra privacy precautionary measures for the contact tracing technology. First of all, all Bluetooth based tool is opt in only and first of all, the Bluetooth based tools opt in only an explicit user consent is required. The tool doesn’t collect personally identifiable information, or user location what’s being collected is the proximity to other devices, not the location of devices at Apple. The anonymous identifier beacons themselves will will be random And rotating every 15 minutes so that there’s no way to track the device. They’re associated with Google said the identifiers that have been collected by a phone will also stay in the phone. The data linked to the identifier beacons will only be used for contact tracing by public health authorities for COVID-19 pandemic management’s at Google and Apple. Despite apple and Google’s emphasis on privacy, some remain concerned about its implications, particularly with collecting, handling and handling of sensitive healthcare data, which would be a concern of mine. And Google’s been trying to get their hands on on pH I for a while now, and have succeeded in some some cases. Sergio Caddo. kouta go Rome, Vice President of threat intelligence at Draco’s, for instance, outlined his concerns with the technology in a Twitter thread, calling it literally a real time walking health report. He also worried that the data would be used to discriminate against people as fear of Coronavirus will rise as we leave large scale quarantine. The explosion of Coronavirus tracking in general has low security The experts were the ACLU late earlier this year. Earlier this week for, for instance released a report called the limits of location tracing and an epidemic detailing the issues with phone location tracking as a solution to contain Coronavirus including weather data is anonymous who gets to access the data and how the data is used when the life cycle the data is. In the sick crisis, we need to seriously consider how technology might help improve public health said ACL use J. Stanley and Jennifer’s Tisa Granick in the white paper. This investigation must be based on realistic understanding of what technology and data can and cannot do. Less we divert attention expertise and financial resources from other simpler but time tested methods that are more effective in particular, policymakers should understand the limits of existing location data and devices for automatic contact tracing. Despite that one in four responses to a threat post leader poll reader polls are still sending we’re okay with sacrificing a portion of their personal privacy in exchange for some form of cell phone tracking that could in theory reduce Coronavirus, infection rates and save lives and when asked if an app existed that told you who in your neighborhood was infected with the Coronavirus, would you use it over a third of respondents said they would use it was 33.6%. Moving forward Google and Apple stress that they will continue to make their work available around Coronavirus contact tracing for analysis now, so a couple of couple of questions I would have number one is once eventually just Coronavirus pandemic will go away. So when that happens, what happens with these apps? What happens with the data? And do these apps now get used for other types of tracking? So that would be my first question. My second question is we’re trusting users to upload their data. So they get tested positive, and they upload their data to this app. How do we know they’re going to do it? You know, how do we know that that’s actually going to happen and then we’re also like it says, setting ourselves up for some form of discrimination because Now if you know there’s a hotspot and you know people in that area, I mean, I go to the store now and I get dirty looks and I’m not sick. So imagine now if you know people were sick in that area, or you know, someone you’ve been in contact with, you could you know, we’re not in touch with a lot of people at this point. So we could deduce who you’ve been in contact with, that could be infected. And then the final thing that I’ll say to this is this if arm if you if they have if it’s months away from being released at the OS level, what does that say about this virus? Do we not think it’s going away anytime soon? Do we not have a solution is the semi quarantine that we’re under? Is that really working? I don’t know. I mean, the numbers seem to be leveling off. So we’ll see. But those are the concerns. I would imagine privacy concerns about HIPAA concerns about We’ll see what comes of this and if and how many people will truly opt into it. I don’t know. Next up dark reading com cybercrime may be the world’s third largest economy by 2021. This is on dark reading.com as I just said, I think the underground economy is undergoing an industrialization wave and booming like never before as organizations go digital so there’s crime. Today, cybercrime is a massive business in its own right and criminals everywhere are clamoring to get a piece of the action as companies and consumers. That’s trillions to stake to claim in digital universe. That’s why the World Economic Forum’s WTF global risks report. 2020 states that cybercrime will be the second most concerning risk for global commerce over the next decade until 2030. It’s also the seventh most likely risk to occur an eighth most impactful and the stakes have never been higher revenue, profits and brand reputations of enterprises are on the line mission critical infrastructure. is being exposed to threats in nation states are engaging in cyber warfare and cyber espionage with each other. putting things into perspective Walmart, which racks up, America’s greatest firm earnings generally generated a mind blowing 514 billion dollars in revenue last year. Yes, cybercrime earns 12 times that. Both sell a huge variety of products and services. In fact, in terms of ermine earnings, cybercrime puts even Tesla, Facebook, Microsoft, Apple, Amazon and Walmart to shame. Their combined annual revenue totals just 1.28 billion. cybercrime markets have also split up into groups as the bad guys take pains to gather in secretive exclusive discussion boards to avoid scrutiny from follows from police and fraudsters. They’re constantly evolving portfolios portfolio of cybercrime services includes everything from distributed denial of service attacks and malware to phishing campaigns. Trojans and massive stolen data sets are available to anyone who’s willing to sell for them. cybercrime is undergoing an industrialization wave and offers Everything that a regular legal company does product development, technical support, distribution, quality assurance and even customer service. cyber criminals Rob and then sell new technologists a secret strategic plans that will give their buyers an edge over the competitors. Hackers steal military secrets, renewable energy innovations and more. cybercrime is a team effort, cybercrime is a growing concern and also less risky than committing traditional crimes such as bank robbing. In fact, the WTF says that in the US the likelihood of catching cybercrime actors and hauling them into court is estimated to be as low as point 05 percent. And when they do, it’s usually pretty big news. With a smoothly operating team flogging a broad set of services cyber criminals can earn roughly 10 to 15% more than their traditional counterparts. But there are you on and gaps between the revenues that different hackers pull in. It depends on the job the risk they incur, and how many people work for the organization. The top earners can rake in more than $2 million per year. Sometimes Imagine that the average hackers geeky teenager and a hoodie hiding in a dark basement. Some of them might be this way, but today’s cyber criminals are more polished. They do everything from recruit staff to point executive. Some groups even have public personas who ensure the hacker group maintains a sterling reputation. This is important on the dark web where hackers transact most of their business. UK is National Cybersecurity Center has highlighted that organized cyber criminals have different rules to make the operations run smoothly. There are team leaders who coordinate the work and are responsible for staying one step ahead of the law. They guide to data miners to people who system has ties. Stolen data coders who write and alter malicious code and intrusion specialists who have infect and infiltrate target companies, furthers call center agents phone people and and pretend to be computer support staff. Their job is to install malware on victim computer money specialist launder money. Most Popular ransomware in DDoS extortion according to Europol exploit kits are no longer the top products. But the replacements are not proving to be as sophisticated or popular. Theft via malware has been declining as a threat and is placed the cyber criminals of today use ransomware and DDoS extortion which are easier to monetize. For example, take booter services. These are mercenary DDoS soldiers who use large scale botnets or manipulated cloud accounts to produce a malicious flow of data that stops it cold their attacks can last for days and costs anywhere between $10 for a small tech to thousands of dollars for more complex jobs. They could be part of a ransom scheme, vandalism or sabotage or simply a way to disguise a multi vector attack while occupying two victims IT resources University of Cambridge was found that such assaults have become so common that the purchasers even include school aged children. Your poles internet organized crime threat assessment 2019 report describes how DDoS attacks are one of the most serious threats facing global business. They prefer DDoS targets of victims of criminals last year were banks and other financial institutions. public organizations such as police departments and local governments, travel agents, internet infrastructure and online gaming were also favorite victims. Some bad actors were rested, but they failed to make a dent in the growth rate of DDoS attacks, or on the dark web infrastructure that makes them possible. According to Europol. A new paradigm digital services are essential to organizations of all sizes from small online shops to global giants. His services are annoyingly slow or offline for hours or even days, the firm’s revenue and reputation will take a hit. Once it took once it took a while for news about the sort of disruption to get around. But these days are gone. Today, everyone knows everything almost instantly. That’s why using botnets are cash cows for cyber criminals. They can use them in DDoS attacks to extort money, and website owners by threatening attacks that will take out their services or awareness of this and other risks is growing, and other companies and more companies are spending on cyber risk management. Nevertheless, the WTF says that cybersecurity spending is still far from what it needs to be given the scale of the threat. Now, I talked a few minutes ago about using pirated software using pirated operating systems. And this is one thing that happens when you do that. They can then create, they can enter in your computer into a bot your entire network into a bot if you are using pirated software, and then use it in a DDoS attack. So the DDoS the victim is then brought down but so is your network your computer’s at that point. So something to think about stop using pirated software. It is illegal First of all, and second of all, this is what happens when you do allow for these types of things. And then finally on CD now I thought this was pretty cool. To me, it’s important when we’re in at a time, like we’re in right now a time of difficulty that you see two types of people, you see those that tried to take advantage of the situation. And in some cases, that’s the bad guys, the hackers and I don’t like to use the word hacker I like the word, bad actors and bad guys that do these ransomware attacks and phishing attacks and so forth. But then you also have the flip side of that you have people that go out of their way to try to make these bad times these challenging times, a little easier. And so Zd net put this article together of free tools and services for businesses during the COVID-19 crisis. And I actually was approached by a couple as well. So I have a deal with ID agent for 90 days free and I saw another one alert logic was offering 90 days free and so there’s a lot of that going around. And then of course the last check, we’re offering a few things for free right now. Remote remote support for the first hour for how care providers and educators. We’re doing free remote remote support completely. And then we are doing compromise breach assessments for free as well. But so here’s a list of companies that are providing free tools during this time at lesion at Asia in the collaboration and productivity software provider is making its flagship cloud products available for for free for teams of up to 10 people. This comes in addition to his existing free offerings for teams of all sizes, and the offer is not time bound. The new free offerings include cloud based edition about lesion signature product, the project tracking software JIRA, it also includes access to cloud editions of the collaboration software Confluence, which is kind of like a SharePoint, JIRA Service Desk and the project management software. JIRA Core now will tell you this with JIRA Service Desk. There have been reports that people miss configuring them and opening them up to attack so be careful with that.

Transcribed by https://otter.ai

The post ProactiveIT Ep 25 – Free Tools to Tackle WFH Challenges appeared first on Nwaj Tech - Information Tech & Cloud Support.

This is Episode 24!  

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback. What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Chrome 81 Released With 32 Security Fixes and Web NFC API

Cyber Security News

Google Mobility Reports Show Impact of Lockdown

Topic 1: 12 Easy Ways to Secure Your Zoom Meetings

Topic 2:  Beyond Zoom: How Safe Are Slack and Other Collaboration Apps?

Topic 3:  Two schoolkids sue Google for collecting biometrics

https://www.phe.gov/Preparedness/planning/405d/Documents/resources-templates-508.pdf

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the proactive IT podcast this week the latest in it in cybersecurity news plus securing zoom. How safe are other collaboration applications and email continues to be the way and this is episode 24 Hi everyone and welcome to the productive it podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech a client focused and security minded IT consultant Located in Central Connecticut, you can find a set and watch tech comm that’s NWA J. tech.com. Hi, thank you for joining us during this pandemic, we know you could be nowhere else right now. So thank you for joining us. Because I don’t know, I guess you could be watching TV. Wherever you’re listening to this, if you could like, share comment, or review would be spectacular. I would greatly appreciate it. I would drive to your house except I’m not allowed to right now. And if you aren’t a HIPAA compliant business, please go to Facebook in a search type in get HIPAA compliance and join that group. Because we share HIPAA information all the time. And you’ll find it valuable, you’ll help it’ll help your business and you’ll become a little more compliant, a little less scary to patients and to the HHS. We did not we did get a couple of questions this week, actually, but they’re going to be answered throughout the show. One of the questions was, how to deal with all of the Facebook news and warnings and so forth. The other one was I received a few times today or this week, sorry. emails. Click on people getting emails that say that they’ve been viewed on their webcam doing certain activities that most people wouldn’t be proud of. So we’re going to go over that too. Because there actually was a new story on that. But let’s start with the updates. like we always do the Patch Tuesday updates, of course, Patch Tuesday is next week to 14th. So no Microsoft Windows Updates yet, but there is a Microsoft update. We’ll get to that in a moment. But first of all, Chrome 81 was released with 32 security fixes. So you’ll want to update Google Chrome, Firefox 75 was released with Windows 10 performance improvements and I believe there were some issues security issues addressed there as well. So you’ll want to update Firefox as well. And that’ll be across all your different operating systems. Juniper Networks was released a security has released a security update to address multiple vulnerabilities and various Juniper products. So if you’re using Juniper, get that taken care of. and Microsoft as I mentioned, Microsoft released to April 2020, office updates with crash fixes. And I’m going to read from bleeping computer on this when Microsoft released the apple, April 2020, non security Microsoft Office updates that come with crash fixes, as well as performance and stability improvements for Windows Installer, additions of office 2016. For instance, this month’s series of office non security updates fix an issue where word 2016 would crash when trying to save certain documents in an unexpected crash issue impacting OneNote 2016 when the user agent string is longer than 128 characters so after installing Office 2016 kB 4484101. in OneNote 2016 kB for 475586 updates, you’ll be able to save any document formats and use OneNote with user agents of any length without the apps crashing unexpectedly. So make sure you apply your Microsoft Office 2016 updates and that is all the Patch Tuesday update news I have for you this week. Of course next week we’ll have a lot more wait It’s time for all the news that is fit for print or web you know, whichever. First up and info security dash magazine com Google mobility reports show impact of lockdown. So unless you’ve been living under a rock, and if you are then it doesn’t really matter. But unless you’ve been living under a rock and you know most countries are locked down to some degree at least including the US A lot of states including Connecticut, where I am, are pretty much locked down we I mean, we’re not told we have to stay in house but we’re strongly encouraged. So this is this is along those lines Google mobility reports show impact of lockdown Google published reports today that use aggregated phone location data to show how closely lockdown regulations are being followed around the world. company said its COVID-19 community mobility reports would provide insights into what has changed in response to work from home shelter in place and other policies aimed at flattening the curve of this pandemic. The reports use aggregated anonymized data gathered from cellphones to chart movement trends over time specifically, they reveal how busy popular destinations such as shops, parks, recreation spaces, grocery stores, pharmacies, transit stations, residential areas in more places had been since the majority of countries as people to stay at home. Initially report will cover 131 countries and regions and show trends that have emerged over several weeks with Most recent, included at least 48 hours old now I did look and I and this is a few days ago out of my own curiosity. I believe there’s 195 countries around the world. So this is originally 131 countries. I don’t know if that’s still true. Today’s reports show a traffic comparison over a five week period between February 16 to march 29. So this is a week ago now, data gathered from a little more than about 10 days ago. data gathered from UK shows that visits to transport stations are down 75% while 85% fewer people are frequenting public recreation places such as restaurants, cafes and movie theaters. In Italy were around 14,000 people have died and that number is higher now after contract contracting the Nobel Coronavirus strict lockdown measures have resulted in 94% fewer people’s in shops, restaurants and cafes and parks have been footfall dropped by 90% by contrast is Sweden where no strict measures have been introduced. To keep people in their homes. Google found that 18% fewer people were in work 24 fewer were used, reusing recreational spaces, and use of transport stations had dropped by 36%. Only data from users who have turned on a location history setting will be used to create different reports. Currently, the setting is turned off. By default, people have location history is turned on, can turn it off at any time from the Google account. You can also delete location history data directly from the timeline. Google says the reports will not intrude on privacy of individual people because no personally identifiable information, like an individual’s location, context or movement is made available at any point. So take that as you may. You know, Google says their PII is not involved. Turn it on, turn it off. But it is interesting to me to see these statistics and that’s why I share this. Hopefully you are staying home to prevent the spread. The Hacker News reports how just visiting a site could have hacked your iPhone or MacBook camera. This was on April 2. If you use Apple iPhone or MacBook Here we have a piece of alarming news for you. Turns out merely visiting a website not just malicious, but also legitimate sites, unknowingly loading malicious ads as well. using Safari browser could have let remote attackers secretly access your device’s camera, microphone or location, in some cases safe passwords as well. Apple Apple recently paid a $75,000 bounty reward to an ethical hacker Ryan Pickering, who practically demonstrated the hack and help the company patch a total of seven new vulnerabilities before any real high attacker could take advantage of them. fixes were issued in a series of updates to Safari, spanning versions 13.05 released in January 2018 and Safari 13.1 published on March 24. If the malicious website one camera access all I had to do was masquerade as a trusted video conferencing websites such as Skype zoom, or, or zoom sorry picker and set. When chained together. Three of the reported Safari flaws could have allowed malicious sites to impersonate any legit say victim trust and access camera or microphone. By using the permissions that were otherwise explicitly granted by the victim to the trusted domain only. So that has been fixed so make sure you do have the latest version of Safari on your your iPhone or iPad. The Department of Justice says zoom bombing is illegal could lead to jail time. This is also on bleeping computer. The Department of Justice and offices the United States Attorneys are warning that zoom bombing is illegal. And those who are involved can be charged with federal and state crimes as more people are working from home or conducting distance learning due to the Coronavirus pandemic. Zoom video conferencing software has become heavily utilized for remote meetings, online classrooms, exercise classes and family and friend get togethers and I have used it for all those things. So it is that is very true. Since then, people are crashing or zoom bombing online meetings to record them as pranks to be shared on YouTube and tik tok or to spread hate offensive images and even threatening language and it has it has happened. All of those things have happened not to me. But all of those things have happened to effort. Some people tell these stories already. Zoom meeting IDs are also being traded and shared on discord, Reddit and hacker forums according to Zd net, where they’re used to conduct zoom raids that hijacked and disrupt an online meeting or class and I’m going to talk about later on in this podcast, how to protect yourself from these attacks. Now, zoom did I believe today? I’m recording this on Thursday, April 9, did Saturday say then zoom meeting IDs would no longer be shown in the zoom window. So embalming is illegal in a press release. On the Department of Justice website. United States Attorneys for Michigan have stated that people involved in Zoo bombing could be charged with federal and state crimes that lead to fines and imprisonment. You think Zoo bombing is funny. Let’s see how fun it is. After you get arrested stated Matthew Schneider, United States Attorney for Eastern Michigan. If you interfere with a teleconference or public meeting in Michigan, you could have federal, state or local law enforcement not going to door if the if an injury was found to be backing or hacking or into, or disrupting online meetings, classrooms and conferences charges may include disrupting a public meeting, computer intrusion, using a computer to commit a crime hate crimes fraud transmitting threatening communications. This week, the FBI released an advisory bazoom bombing attacks that asked the victims of teleconferencing hijackings to file a complaint with the internet crime complaint center IC three. So, if you have been zoom bombed, continue to listen to this podcast, because I’m going to tell you how to prevent that. But also you should report to the FBI IC three. All along the lines of zoom bleeping computer also reports public service announcement fix zoom install is being used to distribute malware. attackers are taking advantage of the increased popularity of zoom video conferencing service to distribute installers that are bundled with malware and adware applications. As people are spending more time indoors and performing physical social distancing, many have started using this meetings for remote work exercise classes and virtual get togethers. Knowing this threat actors have started distributing zoom client installs bundled with malware such as coin miners remote access Trojans and adware bundles. Today Trend Micro reports that they have found a zoom installer being distributed that will also install a cryptocurrency miner. On victims computers, we found a crypto coin miner bundled in with the legitimate installer of zoom video conferencing app learning users to want to install the software but end up unwittingly downloading a malicious file. The compromised files are not from zooms official Download Center and are assumed to come from fraudulent websites. We have been working with zoom to ensure that they’re able to communicate this with users appropriately. So this is not anything that zoom can do. There’s nothing zoom could do to prevent us except educate users. You should be downloading from zoom.us. And again, I’m going to talk about these things in a little bit. Threat post Skype teams apps hide a raft of malware so it’s not just zoom. This is Microsoft Application now, hundreds of thousands of malware files are disguised as well known social conferencing and collaboration apps. Popular conferencing apps have become a major cybercrime lawyer during the COVID-19 work from home era, and Skype is the undisputed leader. When it comes to being impersonated by malicious downloads researchers have found an April analysis from Kaspersky uncovered a total of 120,000 suspicious malware and adware packages in the wild masquerading as versions of the video calling app. It should be said that Skype isn’t alone and being targeted. The research found that among a total of 1300 suspicious files, not using the Skype name 42% were disguised as zoom, followed by WebEx and we’re going to talk about WebEx as well. 22% goto meeting 13% flock 11% and slack 11%. With the rise of social distancing, Kaspersky experts investigated the threat as good for social meetings applications to make sure users are safe in their communication experiences enjoyable. The firm said in an email analysis social meaning applications currently provide easy ways for people to connect via video, audio or text when no other means of communications are available. However, cyber fraudsters Do not hesitate to use this fact and try to distribute various cyber threats under the guise of popular apps. So something to think about is not just zoom. I know everybody’s throwing their arms up about zoom. But it is Skype and Cisco WebEx in other applications as well. Interpol, this is bleeping computer again, Interpol. ransomware. tax on hospitals are increasing. The International Criminal Police Organization or we know it as Interpol warns that criminals are increasingly attempting to lock out hospitals out of critical systems by attempting to deploy ransomware on their networks despite currently ongoing COVID-19 outbreak just doesn’t come as a surprise even though some operators behind various ransomware strains have told bleeping computer last month that they will stop targeting health and medical organizations during the pandemic. Once since then May’s release data from drug testing company encrypted before their statement of not targeting healthcare well, Raju continues to attack hospitals, despite most of them being flooded with new COVID-19 cases every day. So the mains case was Hammersmith. We’ve talked about it a couple times. I’m not sure if it’s further down in this article, but in UK they were preparing to test COVID-19 vaccines. They were hit by ransomware before me said they would not attack any healthcare facilities. And but the release of the data happened after this that they would not do it. So Russian speaking threat actors have also talked to European companies in pharmaceutical and manufacturing industries incidents suspected to involve ransomware last week, Microsoft that said that it has started to send targeted alerts to dozens of hospitals regarding vulnerable public facing VPN devices. Those were pulse VPN and gateways located on their networks to help them prevent rebels sort of mcareavey ransomware attackers from reaching their networks following this trend and oppose it. Crime threat response team at its cyber fusion center said over the weekend that it has detected a significant increase in a number of attempted ransomware attacks against key organizations and infrastructure engaged in the virus response. After this discovery, the Interpol says that it has issued a purple notice alerting people to in all it’s not 194 member countries to to the heightened ransomware threat. Now, this is his talks about hospitals, attacks on hospitals, but this is going to be healthcare across the board people. This is going to go from massive hospital systems all the way down to single member healthcare practices. So we definitely need to everybody’s on attack right now. It’s not even just healthcare to everybody. We need to keep our guard up during this time, even more so than usual. And here’s a few suggestions in this article. You’ve heard all of these before on this podcast. So but we’ll go over it again because it is it is important that we do this open only email download software applications from trusted sources so back to zoom in Skype only trust from only download from their websites. Do not click on links or open attachments and emails which you are not expecting to receive or come from an unknown sender secure email systems to protect from spam which could be infected, backup all important files frequently and store them independently from your system. Ensure you have latest antivirus software installed on all systems or mobile devices and that it is constantly running and use strong unique passwords for all systems and update them regularly. And add to that use multi factor authentication. Now, on top of that, this is attended by me. In US SBA, there are a few different loan options and financial help for small businesses in the country. If you’re going to apply for them, because you are putting in a lot of sense of information, including your social security number, that business tax ID, your bank account information, your name and address and a lot of sensitive information. So Make sure you’re going to sba.gov don’t go to don’t click on any links, just type in sba.gov. If you’re going to move forward with that type of information, type in your bank’s website address directly as well. Because this is it, they are going after all types of businesses and people out there. So at this time because our guard is down because we’re more concerned with what’s going on with COVID-19 All right, just reported today is probably good news. Zoom taps x Facebook Cisco amid security snap foods lawsuit. The online video conferencing service added Alex Stamos to the team and has formed an expert advisory board to grapple with the pains of its COVID-19 growth spurt. So zoom jumped from about 10 million users per month to two articles 200 million. I don’t remember the exact number but a significant increase in the last few months. As it faces a major lawsuit zoom is taking a significant step to bolster security Privacy efforts by recruiting an industry heavy hitter former Facebook says So Alex Stamos to provide a special counsel has also named third party experts security advisory teams. The popular video conferencing service is making the changes as it faces a class action lawsuit filed by one of its shareholders on Tuesday, and US District Court for the Northern District of California. It alleges that the company made materially false and misleading statements that overstated its privacy and security measures. And it claims that zoom didn’t disclose its lack of end to end encryption. Zoom has experienced a raft of security related Growing Pains during a boom in usage amid the COVID-19 lockdown as people take work environments, school lessons and dates with friends. Online zoom now says that it aims to clean up the tissues from both the product side product side and taking a high level executive approach. Zoom founder Eric Yan said in a blog post published Wednesday, swim has been seen tremendous growth and new use cases emerge over the past few weeks. And we are committed to ensuring that the safety privacy and security of our platform is worthy of the trust of all of our Users he wrote. So good news for, for those concerned about security on zoom. And you should be of course, concerned especially if you’re working with sensitive information. But this is good news that they’ve hired someone who’s going to address this for sure. Cisco, also on threat post Cisco critical update, phishing attacks, steals WebEx credentials. So emails purporting to be Cisco. Critical security advisories are actually part of the phishing campaign trying to steal victims WebEx credentials. An ongoing phishing campaign is reeling in victims with a recycled Cisco security advisory that warns of critical vulnerability campaign urges victims to update only to steal their credentials for Cisco’s WebEx web conferencing platform. Instead, the campaign is looking to leverage the wave of remote workers who in the midst of Coronavirus pandemic have come to rely on online conferencing tools like WebEx as well as zoom and other platforms with the Spike. In online meetings compromised WebEx credentials could be a cybercriminals golden ticket into web conference calls where sensitive files and data are shared among other malicious activities. Targeting users of teleconferencing brands is nothing new said Ashley Tran with CO fences phishing defense center in a Thursday analysis but with most organizations adhering to guidelines that non essential workers stay home. The rapid influx of remote workers is prime picking for attackers trying to spoof brands like WebEx. We anticipate there will continue to be an increase in remote working fishing in the months to come. And I’ve been saying that and you know, so this is WebEx we talked about Skype and we talked about zoom already. So the attacks are on the rise, we need to be vigilant. Don’t click just think before you click that’s, you know, something I’m going to work on for 2020. I had planned on working on it but I’ve been super busy with addressing my clients issues and even some new clients working, working from home and so forth. Researchers said the phishing emails are being sent with various attention grabbing subject lines such as critical update or alert and come from the spoofed email address meetings at WebEx COMM And so critical update or alert playing on people’s fears, as I say phishing always, always plays on emotions and usually that’s fear. So don’t click on those and avoid being becoming another phishing statistic. In our final bit of news, NASA under significantly increased hacking phishing attacks, NASA has been significantly increasing. malicious activity from both has seen sorry has seen significantly increasing malicious activity from both nation state hackers and cyber criminals targeting the US space agency systems and personnel working from home during the COVID-19 pandemic. mitigation tools and measures set in place by NASA Security Operations Center successfully blocked a wave of cyber attacks. agency reporting double the number of phishing attempts attempts exponential increase in malware attacks, and double the number of malicious sites being blocked protect users from potential malicious attacks. So there have been an increase in domains registered with the word zoom with the word Skype. And I’m sure what at this point with WebEx, maybe NASA COVID-19, there’s a bunch of them. So we have to be careful what we’re clicking through to and what we’re looking for when we go on the internet. So there again, NASA is reporting an increase. This means everybody’s being attacked. It’s not just NASA not just hospitals, everybody. voted. It’s time for our hot topics in what is hotter. Well, besides COVID-19 what is hotter than zoom right now? So I wrote a blog post about it as well. So the title of the blog is 12 easy ways to secure your zoom meetings. And this applies to a lot of different things though. So I wanted to go through this and help you to understand how to secure your meetings. While some of the issues were definitely zoom, some of them some of the issues could have been prevented by users understanding how to use zoom as well. So 12 easy ways to secure your zoom meetings. This is a blog on nosh tech, watch tech COMM And wha tech comm It’s been a while since I’ve put a new blog post up. So you know, go there, check it out, leave us a comment. That would be great. So we’re living in interesting times, to say the least there’s no doubt about it. COVID-19 has changed the way we work and live and in some cases permanently. People who have never worked from home suddenly find themselves doing it full time. The COVID-19 pandemic has also challenged the technology world in ways it’s never seen. Before, there’s been a huge increase in phishing attacks, scams and malware, use an COVID-19 pandemic as a means of infiltrating victims. employees and business owners that are not entirely comfortable working remotely are finding that security challenges are different and somewhat unique when plugged into their home network. I have spent the first three weeks of our partial quarantine helping businesses and individuals prepare for life during a pandemic in isolation. I help us secure securing their computers and networks connected to resources and applications necessary to complete their work, helping with void and most almost every case, helpless setting up and using zoom. Zoom is a powerful tool. The primary reason for using zoom is video conferencing and collaboration. They have plans that allow you to host video conferencing calls with up to 100 people for just $15 a month. They even have a free plan that allows you allows up to 100 people so long as you keep the meeting under 40 minutes now I have heard that there they have lifted down Temporarily the 40 minute limit. So I’m not sure if that’s true, I haven’t challenged it. We have a paid account, so we don’t need to use the free account. But I’ve heard that. There are of course, other plans that include more features, but almost small, most small businesses will find $15 plan more than enough. You could do more than zoom. More with zoom then host meetings. Here are some of the other things I have done with zoom, screen share remote support, record videos, including screen captures, and then upload to social media. Record podcasts, have one to one meetings, virtual training. As you can see, it’s pretty useful tool. The ugly side of Zoom Zoom exploded in popularity when the pandemic began to unfold, and went from 10 million people using in December of 2019 to 200 million in March. That’s some intense growth. It was of course fueled by the COVID-19 pandemic and employee employers telling their employees to stay home and work zooms platform has remained stable throughout I have not had any issues and have only seen a few complaints about connectivity problems to the IRA news day after posted this there was an outage, I believe was Saturday, there was an outage that could have been attributed to the load on ISP as well. As I was writing this, there were four. Okay, so I put it in here. As I was writing this, there were reports of zoom web being down, but I was able to connect with zoom has run into problems with vulnerabilities and attacks. In the last few weeks zoom has been attacked by random people jumping into meetings. This is called zoom bombing. Those people then shared pornographic materials hate messaging and disruptive behavior. There have also been a few vulnerabilities discovered and I’ve linked a few articles here. So zoom lets attackers still windows credentials, run programs via UNC links. Ex NSA hacker drops new zero day Doom for zoom on Mac OSX zoom kills iOS apps, data sharing Facebook feature and zoom also came under scrutiny for privacy concerns during their increased usage. They have addressed all of those issues though. So as you can see, there’s a lot to deal with. There’s good news though. Zoom has patch all the time. have issues already. Zoom has also allocated all engineers who are working on feature improvements and additions to the development of improved security. Zoom CEO Eric s yawn, recently wrote a blog post post, adjusting to vulnerabilities and concerns essentially explained that recent growing pains to get to the vulnerabilities and challenges, it was very transparent with what has been done, what has been done and what they will be doing going forward. assumes issues are not solely theirs. They are also being belong to the businesses and consumers using the platform. Security is everybody’s responsibility. And until everybody takes it seriously, these things will continue to happen. I attempted phi, I attended five meetings over zoom last week, three of them did not have a password on them. I attended one just today that did not have a password on it. So as I’m recording this, this is Thursday, April 9. So how do you secure zoom meetings? Here’s a list of 12 things you could do to secure your zoom meetings going forward. Use a password for your meeting. When you set up your zoom meetings, you can add a password the password can be whatever you want it to be, it automatically generates a six digit number, but it doesn’t have to be numbers. You can also edit existing, existing existing meetings to add a password. Use the waiting room. This feature makes it so you have to approve anyone who wants to join to zoom in. If you’re not sure what the person who the person is, you can screen them to ensure your meeting is not a zoom, not zoom box. Do not share your zoom meeting information publicly. Don’t share it on social media. The best thing you can do is to require people who want to attend to RSVP and then send them the meeting information. Ensure your zoom client is updated do not use outdated zoom clients. So since I wrote this, which is five days ago, there’s been two updates to zoom so on windows so make sure you do update it. Disable participant screen sharing Akin can grant screen sharing to individuals as needed. Lock lock the meeting once everyone has joined require host to be present during the meetings. before the meeting starts secure meetings with end to end encryption. Yes, this feature is available through has been, though it has been publicized that it is not. And so when I wrote that that was what was being told to us, but on April 7, the CEO Eric Jaan zoom meetings aren’t into encrypted despite misleading marketing, and a link to the article on that one to allow only authenticated users to join meetings. This means users need to create an account on zoom.us to join a meeting. You can further limit this to specific email domains if it’s relevant to your meeting. Use generating meeting IDs instead of personal meeting ID if you do not. If you do use a personal meeting, Id do not share pictures of your meetings to social media or on the internet. This makes it easier to find your meeting. Now again, as I said earlier, zoom has now removed the meeting ID from the zoom window. Do not download the zoom client from anywhere other than zoom.us. There has been a surge in domains being purchased that include the word zoom to suggest that there will be malware and phishing attacks. Launched using zoom to get you Your attention. So we already reported on that. And of course my favorite user secure password and enable two factor authentication on your zoom account. Logging into zoom, US will give whoever logs in access to your meeting and account security information. Setting up to two factor authentication dramatically decreases the chance that someone can brute force your zoom account. 12 steps to secure zoom meetings might seem like a lot, but the steps are pretty easy. Some of them are configured by default. It also helps to spend time logged into your account on zooms website to understand the different features. Zoom is a great productivity tool. But like anything else, growing pains will challenge its stability, security and bring into question as policies. It seems zoom is on top of things rapidly fixing any vulnerabilities and addressing concerns that come up. As long as Zoom’s clients do their part. We could ride this pandemic out together using one of the few tools that have kept us connected and made this planet a little smaller, stay healthy, stay safe and stay secure. And so I close all my podcasts now but I also close out that blog All along. So one of the last things I talked about here was understanding the features. And then what I see is a lot of people want to want to turn on the green screen feature where you have, you know, a custom background. And that’s interesting to me because a lot of people are spending time during nap, but nobody’s spending time turning on two factor authentication on zoom.us. So get that turned on, because it’ll, it’ll slow down the spread for sure. along the lines of zoom, we have an article here from threat posts. So we’re going to go over beyond zoom, I’ll stay for slack and other collaboration apps. I’m a big fan of slack as well. We use slack for communication purposes. So this is interesting to me. COVID-19 effect on work footprints has created an unprecedented challenge for it and security staff. Many departments are scrambling to enable collaboration apps for all but without proper security. They can be a big risk as the Coronavirus pandemic continues to worsen remote collaboration platforms now fixtures in many workers new normal are facing more scrutiny. popular video conferencing app zoom may currently be in the service security hosty. But other collaboration tools such as Slack, Trello, WebEx and Microsoft Teams are certainly not immune from cyber criminal attention. Organizations leaning on these platforms, security should be top of mind. A failure to lock down slack at all, could lead to data breaches brand damage, malware infestations, and more. Researchers say that attackers are hard at work looking for new weaknesses to achieve. All the latter fortunately enough best practices can go a long way to shrink in the risk collaboration App Security bugs not hypothetical the risk posed by collaboration platforms is far from hypothetical. In March for example, a critical vulnerability vulnerability was found a slack which could allow automated account takeovers and lead to data breaches according to hacker one bug bounty report HTTP request, smuggling bug and proof of concept was used to force open redirects within slack. We reported this by the way leading users to rogue client outfitted with slack domain cookies with victims attached to the malicious client. Their session cookies would could be harvested and later used to take over the account. The attack could also be automated. Automated account takeover attacks like slack just had to deal with our pervasive said Jason Kenney, a hacker in residence at sequence in an interview, we see this takeover attempts all the time the hackers learned login or password recovery of workflow and start the attack on the logins. They know about most of the time, these attacks have been automated utilizing bots to take over as many accounts as possible. Aside from Slack, Cisco WebEx has had its share security flaws in March Cisco patch two eyes security vulnerabilities, the video conferencing platform which if exploited could allow an attacker to execute code on an affected system and earlier in the year and adjust that bug that would let strangers bargain on password protected meetings. No authentication necessary, presenting a serious data exposure concern. And of course, there’s zoom, which has gained widespread popularity for personal work use. Since stay at home orders went into effect across the country. The company has faced an onslaught of security woes in the last two weeks, including a pair of zero days and a various privacy problems. Apart from exploding security bugs, cyber criminals have other attack vectors when it comes to collaboration apps like Slack, Microsoft team, and others have messaging components that can be used for phishing attacks, and to deliver malware payloads through links and attachments just like email. External attackers can leverage stolen credentials or conduct brute force and credential stuffing attacks. To gain access to these platforms that Garrett Lansing field CTO at stealth bits, speak into threat ports, they can then compromise the information those credentials provided access to using it to either complete their mission or for intelligence to attack other targets within a company. They could also go as far as to impersonate the employee in conversations and send malicious attacks, attachments to people Onto employees workstations at lesion, which is which has a service desk type software. A lot of a lot of businesses may the lesion service desk public facing during this work from home time and they have been exposed as well where people are impersonating employees and things like that. Collaboration apps also subject to miss configuration, popular online collaboration platform Trello, for instance, which is used to corporate used in corporate settings to organize to do lists, and coordinate team task has a problem that is indexed by Google, if its boards are set to public and we reported that a while ago to and public boards specific contents can also be searched using a special search called dork. This setting is surprisingly easy to implement by mistake researcher said as evidenced by incident earlier this year at office space company Regis. In that case, a Trello board exposed the performance ratings of how Hundreds of staff. The troll incident was due to end users setting their boards to public and not fully realizing how easy it was for someone else. To search for the public ports James mcquaig and security awareness advocate at no before told threat post the group’s had that created the boards. were posting it sensitive information and dust exposing the unnecessary risk to the organization. To companies collaboration platform enables external communication, it can present yet more opportunities for attackers, for instance of an attack, attacker were able to get into a Developers channel inside a retail organization, they might help with a problem and actually inject their own flaws that can’t explain made cart jumps to mind, a person could simply say you can add this JavaScript file to the next production drop. There are ecosystems weaknesses, too. For instance, slack offers a software library containing add ons that can be installed in just a couple of clicks sodas, Microsoft Teams and attacker could create a slack On the advertiser some great features but also reads channel data said Matt gayford, Principal consultant at crypsis group. If and user mistakenly installs the add on they could expose all slack channels to the attacker in terms of actual attacks, or to have your free our CTO and co founder of safeguard cyber told threat post that coordinated campaigns against corporate instances of collaboration platforms can be difficult to pinpoint, making things challenging for security teams. The first step to compromising users collaboration accounts might initially look business email compromised or social spear phishing at first explained as an example he detailed one attack impacting slack that his company was involved in mitigating slack strength and vulnerability is connected this to other apps. He said for one customer we were brought in because they had an instance where a hiring system was mapped to an HR Slack channel, a resume that was infected word doc uploaded to the system, which they pushed a notification to the HR channel where hundreds of employees opened In the document at the same time, so and this article goes on to talk about the risks and best practices. But, you know, this is just another example of how collaboration tools and work from home tools and things like that. communication tools can be used. It can be abused very easily and taken advantage of. So, it’s not just zoom, we’ve all heard about zoom for the most part, but it’s also Skype, Microsoft Teams, Slack, things like that, while Cisco WebEx so it’s probably most important to be as careful as you can be. And I know I keep stating that, but it is what it is we need to we need to we need to remain vigilant. We need to make sure we’re doing our due diligence and we need to analyze everything in a hyper connected world right now. And I know it’s easy to not do that. I know it’s easy to overlook things when we’re focused more on what’s going on with COVID-19 and work from home and homeschooling, and all of that good stuff. So just, you know, ride the storm, do your best. And of course, if you have questions, feel free to reach out to us. But I’m going to share one more thing naked security up by Sophos to school kids who Google for collecting biometrics to school children have sued Google alleging that it’s illegally collecting their voiceprints face prints and other personally identifiable information to students were identified only as HK JC in a complaint, which was filed on Thursday in San Jose, California in the US District Court of Northern California. The children are suing through their father Clinton Farwell. The complaint notes that Google has infiltrated the country’s primary and secondary school systems by distributing its Chromebook laptops, which come pre installed with his G Suite for education platform. That suite includes student versions of Gmail calendar, drive, Docs, Sheets, And other Google Apps. In order to use those apps, the kids had to speak into the laptops audio recording device, so Google could record their voices. And they had to look into the laptops, cameras, so Google could scan their faces. So I will say, my kids, or, you know, my son took home a Chromebook. And he did not have to do those things for that for the for the Chromebook to work in order to use this obstacle. Okay. I read that how according to lawsuit, over half of the nation’s schoolchildren use Google’s education products, including those in Illinois, most of whom are under the age of 13. Oh, no, it comes into play because it’s got the strictest biometrics privacy law and the land to biometric Information Privacy Act HIPAA, that requires private entity entities like Google to first get our informed consent before collecting our biometrics including face prints and voiceprints. The complaint alleges that Google’s violating both PIPA and initial strictest federal online children’s privacy law, the children’s online privacy protection act COPPA COPPA requires websites and online services to fully and clearly disclose their data collection use and disclosure practices, and that they obtain verifiable parental consent before collecting using or disclosing the data they collect from children younger than 13. Incredibly, the complaint says Google is violating both of these privacy protection laws at the same time. The lawsuit says that they that besides face prints and voiceprints Google’s also illegally creating collecting storing using students PII including physical location websites, they visit every search term they use in Google search engine. And the results they click on the videos they watch on YouTube personal contact lists, voice recording, safe passwords and other behavioral information, all without verifiable parental consent from the complaint. Google has complete control of the data collection use and retention practices of G Suite for education service, including biometric data and other personally identifying information collected through the use of service and using uses this control not only to secretly and unlawfully monitor Provide profile children. But to do so without the knowledge or consent of these children’s parents. The plaintiffs are requesting a jury trial. They want Google to stop collecting the data and to destroy whatever data it has this tweet, just I’m sorry, the suit is also seeking 5000 per student for each of Google’s alleged intentional or reckless violations and 1000 for each negligent violation. This, of course, is not the first time that Google’s had to do this. There was something earlier this year out of New Mexico. And here we are. So Google’s being sued. I don’t know what will come of it. I’m curious to see what Google’s response is. You know, I don’t know how much that would be through the school and how much of that would be Google itself because I know that my kids did not have to do voice or facial recognition to set up the Chromebooks. And they don’t use they actually don’t use Gmail for email. Which I thought was interesting, because they’re using Microsoft but um, you know, my son did mention COPPA. The other Day, and that caught me off guard. I didn’t know that he knew anything about it. But apparently, he has been talked to about it at school. So maybe it’s the school system. So we’ll wait to see what happens. What comes with this complaint and lawsuit going forward? All right, it is time for the HIPAA education portion of our podcast and I’m going to talk about email. And the reason I’m going to talk about emails because the number of phishing attacks and email compromises around the healthcare industry, it just continues to astound me that it’s I believe it’s 40 something percent of all the HIPAA breaches are through email. So what I’m going to share with you is the health industry cybersecurity practices which short for short is called hiccup. It’s h ICP, managing threats and protecting patients resources and templates. And what I have, what I’ve shared in the in the show notes is the framework. It is a document for small businesses for small healthcare providers, small organizations, so practices, and it isn’t it is mapped to the NIST frame cybersecurity framework. So we’re going to talk what specifically about email so this talks about a bunch of different ways that a bunch of different things that you need to look at during a risk assessment and address during a risk assessment in healthcare. So this is specific to health care health industry cybersecurity practice. I will say this though it could be used pretty much for any business. And so it talks about different areas including endpoint protection systems access management, data protection and loss prevention network management incident response, medical device security, cybersecurity policies and so forth. So, we’re only going to focus on email for the purpose of this podcast because it is something that needs to be addressed. And in this document, it says, For email protection systems, these are the different things you should be doing. First of all, a baseline configuration of information technology, industrial control systems is created and maintained incorporating security principles, Eg concept of least functionality. So if you have email, which of course you do, everybody does. You need to based on configuration to understand what exactly your email is capable of. And you could be checking things like is we able to access email through a website? You know, in the case of if we’re using Office 365 or can we go to Outlook dot office comm and log in through there, and I will tell you, for most of my clients, that is locked down, they cannot log into office. I’m sorry outlook dot office COMM But you know, maybe there’s a reason for you to have that turned on. So if you do have it turned on do you have multi factor authentication setup? Now Microsoft is now making it mandatory for multi factor authentication. Your email will basically stop working in Outlook and other third party tools. If you don’t have multi factor authentication turned on. To Can I set up my email on a mobile device, again, up to the practice, some practices might have a need, maybe only certain people need to have mobile access to email. And again, this this could apply to any business. And if you do, how are we securing that even further? Does that mobile device have biometrics turned on? Is that device locked? Do you have device locking capabilities device wipe capabilities? Do we have MDM setup on that device? The laptop here If you have a laptop and most healthcare providers will have laptops, do we have biometrics on that laptop? Does it have a password on it? Does it have the remote wipe? Is it encrypted? Are the emails encrypted end to end encryption? Do you have a BA with that email. So all of these are through baseline configuration ba being business associate agreement. And there are a few email providers that will sign it the two biggest ones being office 365 through Microsoft and Google’s G Suite. But if you don’t have a business associate agreement, then you need to walk away from that email provider and find something different. So that’s a lot of stuff that you need to address in a baseline configuration. Data transit is protected is another area. So we talked about this with zoom. Do you have encryption is it in when it’s when your emails in transit isn’t encrypted, so you can send encrypted email. Some of the email providers will will have the ability to send encrypted emails again, G Suite and office 365. But there are third party systems out there that can encrypt your email as well. One example would be xyx, z ix. Users devices and other assets are authenticated. Eg single factor multi factor commensurate with the risk of the transaction, Eg individual security and privacy risk as risks and other organizational risks. Kind of going back to our baseline configuration, are we doing everything we can to protect the devices and the email? Are we ensuring that the security and privacy risks are addressed now? So HIPAA, HIPAA is an ongoing process, right. And if you are actively following HIPAA active if you have an active HIPAA program, then you are constantly Looking at these things, and making sure things are up to date. So I’ll give you a simplified example I go in on a regular basis and just make sure that AWS s3 buckets are still not available to the public because all the time we see how AWS s3 buckets were left out, to be viewed by the public, you know, has sensitive information including some some well known healthcare breaches. So I will check even though I know it’s turned on, I go back and I check every few weeks or so to make sure it’s still turned on that not they don’t have public access. So that’s a simplified example. We need to continue to run security analysis and and privacy risks and so forth, to make sure that something hasn’t fallen through the cracks. Since the last time we checked, and right now, we’re distracted as a nation as a world we’re distracted right? And so COVID-19 is gonna be But it’s tension we have relaxed. Tell them tell them edge capabilities right now. So you could use FaceTime or Facebook messenger to to practice telehealth. I said, Tell them that it’s telehealth and but eventually that’s going to go back to normal. We’re maybe not as focused on hip as we normally would be, because of the COVID-19 pandemic. And eventually it will go back to normal. So what happens when it goes back to normal is somebody going to provide another assessment and another analysis another audit to make sure that things are where they need to be. And that’s where the that’s where, making sure that users devices and other assets are authenticated through single factor multi factor authentication commensurate with the risk of the transaction. So if we’re using email, and this is about email, it should always have multi factor authentication because every single email breach had had pH I in it, every single one and it’s always the standard You’re going to hear we’re going to do the HIPAA breach report after this, so is the standard. We’ll take an action to prevent this going forward. But it shouldn’t. It’s not hard to set up multi factor authentication. It’s not hard to make sure your emails encrypted, it’s not hard to make sure we’re at least minimizing the amount of healthcare information that is inside of our email programs. But it continues to happen. So making sure that the devices are authenticated. So smartphone may be authenticated. The laptop authenticated via multi factor authentication would be the preference making sure you know, the VA uses card you have to have the card plugged into the the RFID card plugged into the laptop before it’ll work. If it’s not, if you walk away, then the laptop is no longer accessible. You know, things like that. So and of course to have health insurance mission for veterans. And of course, so that’s federal, so they need to have a lockdown. All Users are informed and trained. So this is something we talk about a lot. The continued phishing attacks that are successful, and a lot of times it’s multiple email accounts that get get compromised. Right? That means there’s not an active training program and training for email protection systems is how do you use it? How do you recognize phishing emails, then you do some testing, you send a phishing simulation, to your employees to the healthcare workers, and see how they respond. And if they don’t respond, the way they should respond, then you get additional training is this isn’t you know, going and fire them. Now this is additional training. And that actually leads to the last point the phishing simulation which we just mentioned, the organization’s personnel and partners are provided Cybersecurity Awareness education and training. trained to perform the cybersecurity related duties and responsibilities consistent with related policies, procedures and agreements. So you could send a COVID-19, submit a simulation to your employees and see how they respond to it. And if they don’t respond the way you want them to review it, train them and test again. They should be ongoing. All Users are informed to train and all users are kept up to date on the latest cybersecurity threats. are we telling our employees, hey, there has been a huge increase in COVID-19 related phishing attacks. are we telling them that maybe we are maybe we’re not I don’t know. But we need to be you need to educate your employees. And it needs to be ongoing. It’s not a set it and forget it. event. You can’t just do it in January and hope that the next 12 months are nice and safe. No, it has to be ongoing. And this is where we’re falling short. This is the email protection system. Part of the NIST framework and part of the HIPAA health health industry cybersecurity practices, managing threats and protecting patients resources and templates. So again, I’ll have the link, it’s a PDF document is 71 pages. This is the one for I think it’s just one for small practices, but they have one for small and then you have one for medium and large practices. And it goes into a bunch of other areas too, not just email. So it’s a good resource to take a look at and if you have any questions, of course, reach out to us and we’ll we’ll help you in any way we can. All right, it is time for a HIPAA breach report. Not a lot to share with you today. First up the Pharmacy Benefits consulting firm comm Phyto has started notifying 3600 of it. Clients employees members and their dependents that some of their personal information has potentially been accessed by an unauthorized individual who gain access to an employee’s email account. email account breach was detected on December 12. And an investigation was launched to determine the scale and scope of the breach. Assisted by a third party security firm can Fido determine on January 17, that an unauthorized individual had access to the email account for a period of two weeks which is a really long time for email between November 29 and December 12. It was not possible to determine if information in the email count was downloaded but the possibility could not be ruled out. comprehensive review of the email account revealed it contain names, dates of birth, health insurance information, social security numbers, prescription information, treatment information and clinical information such as diagnosis and provider names. individuals affected by the breach were notified on February 10. Complementary credit monitoring services have been offered to individuals whose social security number was exposed breach has prompted Fido to provide further security awareness training to its employees and additional procedures have been implemented to strengthen email security and that is exactly the point of the HIPAA education piece. That should have been done before, not after healthcare resources group are provider of billing services to Barlow respiratory Hospital in Los Angeles, California discovered that an employee’s email account again, was accessed by no unauthorized individual. An investigation was conducted which revealed the email account was accessed between November 4 and November 30. So that’s 26 days, and analysis of the email account revealed emails and attachments containing a limited number of protected health information of current and former Barlow respiratory hospital patients. A third party firm was engaged to review the account to determine what types of impairment of information had been compromised. The review was completed on February 27, and revealed patient names had been exposed along with one or more of the following data data elements date of birth. Social Security number driver’s license number medical record number patient account number health insurance information treatment information and medical billing or claims information. Health Care Resource Group sent notifications to affected patients on behalf of Barlow respiratory hospital on April 7, one year’s membership to credit monitoring and identity theft restoration services has been offered to affected patients so at least they didn’t have the standard press release. The dis was late last week the oldest our bone Center for Human Services and Indiana based provider of mental health and addiction recovery. Healthcare Services has announced that you unauthorized individuals have gained access to email accounts of two of its employees. It is unclear when the email accounts breach occurred and for how long and unauthorized individuals had access to email accounts. And its website substitute Breach Notification the artists Otis our Bowen center said an independent digital forensic investigation revealed on January 28, that pH I had potentially been accessed As a result of the attack, the review of the accounts has now been completed to determine which patients have been affected and those individuals have been individually notified by mail. No mention was made about the types of information that were potentially compromised Otis, our bone center said the investigation did not uncover any evidence to suggest that any pH I had been misused as a result of the breach, but out of the abundance of caution effective individuals have been offered complimentary membership to credit monitoring and identity theft protection services through crawl and response to the breach notice our Bowling Center has taken steps to improve email network security and is working closely with leading cybersecurity experts to improve the security of its digital environment. The Department of Health and Human Services breach portal indicates the compromised email accounts contained to protected health information of 35,804 patients. University of Minnesota physicians has discovered to employee email accounts have been compromised as a result of responses to phishing emails. No education do we just talk about that. In each case the phishing attacks were detected shortly after email accounts were compromised, and action was taken on January 31, and February 4 to secure the accounts. an unauthorized individual had access to one account for less than two days, and a second account was accessible for only a few hours. A comprehensive investigation was conducted by third party computer forensics experts, but it was not possible to determine if any emails in the accounts were viewed or copied by the attackers review the email counselors was conducted by third party specialists who determined the email accounts contain patient names, telephone numbers, addresses dates of birth, demographic information like race, gender and ethnicity, social security numbers, insurance ID numbers, location of treatment provider names, limited medical history information in case numbers. You when physicians started sending notification letters to affected patients on March 30, and is offering complimentary membership to credit monitoring and identity theft protection services through Colfax 12 months 12 months, you went physician said multiple email security controls were in place at the time. The email accounts were attacked including multi factor authentication. employees had also been provided with security awareness training and phishing simulation exercises are regularly conducted. refresher training has now been provided to employees and human physicians is looking into measures that can be implemented to further improve improve email security. OCR breach portal indicates 683 patients were affected by the breach. So this one is a little interesting because they say multi factor authentication was turned on. So I’m not sure how they were cracked, broken into but it is what it is. Um, that is going to do it for this week’s episode of the productivity podcast. So until next week, stay healthy, stay safe and stay secure.

Transcribed by https://otter.ai

The post ProactiveIT Ep 24 – The Attack on Communication appeared first on Nwaj Tech - Information Tech & Cloud Support.

This is Episode 23!  

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback. What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Google Releases Security Updates for Chrome

Note..Patch MS SQL and Citrix ADC Netscaler for known vulnerabilities

US Small Business Administration Grants Used as Phishing Bait

COVID-19: Hackers Begin Exploiting Zoom’s Overnight Success to Spread Malware

‘Secure’ Backup Company Leaks 135 Million Records Online

FCC will require phone carriers to authenticate calls by June 2021

Top Email Protections Fail in Latest COVID-19 Phishing Campaign

IRS Warns of Surge in Economic Stimulus Payment Scams

FBI Warns of Attacks on Remote Work, Distance Learning Platforms

Microsoft is Alerting Hospitals Vulnerable to Ransomware Attacks

Marriott Reports Data Breach Affecting Up to 5.2 Million Guests

Topic 1: COVID 19 – The New IT Reality

Topic 2:  Cybersecurity Lawyer Who Flagged The WHO Hack Warns Of ‘Massive’ Remote Work Risks

Topic 3:  A Note from Zoom’s CEO

OCR Issues Bulletin on Civil Rights Laws and HIPAA Flexibilities That Apply During the COVID-19 Emergency

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the Proactive IT podcast this week the latest in it in cybersecurity news. Plus it zooms world now, the impact of Cova 19 on it and security and Microsoft helping hospitals. This is Episode 23 Hi everyone and welcome to the productive IoT podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech a client focused and security minded IT consultant located in Central Connecticut, you can find us at and wash tech comm that’s NW Aj tech.com. All right, we start off this episode like we start off every episode is the Patch Tuesday portion of the podcast, we normally start off. Well, let me start off by saying if you could share, comment, like review, this podcast, whatever that you can do on your platform, which is greatly appreciated, because we’re really trying to reach more people to talk about compliance issues and it issues cybersecurity issues. And the more that it is like and reviewed, the more people will see it, the more it’ll move up in the rankings on the different podcast platforms. And we’re, we’re doing our job and we’re happy about it. We love to give and that’s what that’s really what this podcast is about is giving. And then secondly, if you’re in a HIPAA compliant business, if you go to Facebook and type get HIPAA compliance into the Search. You can join that Facebook group and we share tons of HIPAA information in there. Questions, articles, breaches, all kinds of stuff. And of course, the podcast. So check that out. join the group, and you’ll learn you’ll learn lots of stuff. I promise. We normally have a question that a week I do not have a question that did not get a question this week. You know, everybody’s brains is somewhere else right now, understandably. So I hope everybody’s staying healthy and dealing with the quarantine as it may be in some areas, including my area. Just get through this. Well get through this together. Hopefully, while you’re home, you might consider starting your own podcast or something along those lines because it does help it it’s a way to get out there. We’re going to talk a lot about zoom today, but you can use zoom to facilitate things as far as Patch Tuesday goes. We only have one update So far, and that is Google has released an update to Google Chrome. And you should be on version 18 point 0.398 7.162. And that is a security update. So you’ll want to take care of that is a pee. Zoom did have a lot of patches, and but we’ll get to that later. And Patch Tuesday for the month of April is April 14. So we still have some time. Before we hear anything, we still got 12 days to 11 days sorry, before we hear anything about what we can look for forward to for Microsoft. But along Microsoft lines, there has been an increase in attacks on unpatched versions of Microsoft SQL and Citrix ADC netscaler and they are going after hospitals. So if you’re using Microsoft SQL for and it’s facing the internet, I mean you’d have it even if it’s not but if it is public facing and you have weak passwords, you better fix that. Because brute force is, is being used to attack these servers and then if they haven’t been patched recently, you’re going to have problems. And also Citrix ADC the same thing. Citrix ADC netscaler has an update to it. If you have not patched to the latest version, you need to now because they are being actively exploited. Alright, we have a lot of news to share this week. There was a there is a lot of zoom news. I’ve decided to remove some of it from this episode because we’re going to talk about the CEO of zooms response to a lot of issues and in most of the issues that are publicly known at this point, are included in that response. So we’ll get to that in a little bit. It is one of our hot topics this week. First up on bleeping computer us small business, small business administration grants used as phishing bait so attackers are attempting to deliver REME COEs Remote Access Tool payloads on systems of small businesses via phishing emails impersonating the US Small Business Administration. They are taking advantage of the financial problems experienced by SMBs during the current cobit 19 pandemic to lure them into opening malicious attachments camouflages disaster assistance, grants and testing center vouchers despite using broken English, which is a key indicator of a phishing email By the way, within the phishing emails, the malicious actors made sure that the overall layout is as close as possible to the real thing using the official us SBA logo and footer info as IBM x force threat intelligence researchers found the victim is presented with an application number and is urged to complete the application before March 25. So that date has come and gone but I’m sure some people will still try it. In order to do this victims are requested to sign the attach form and upload it to the SBA website. Also, since the attackers method of asking for grant information is identical to the process used by the real us SBA, some SMEs might fall for this chicken open the malicious attachment. So this was reported after March 25, by the way, but it is still out there. And I’m sharing this because it talks about the payload after that, but because there is a huge, huge, huge increase in I’m going to talk about more of them, but a huge increase in scams, phishing attacks, ransomware attacks everything around kovat 19. So Cova 19, the stimulus plan on hospital reports and all of these things are being used to try to trick people into doing things and it’s going to work on doubtedly will work. We need as a as a whole. We need to remain vigilant and say No, I didn’t request this information. This wasn’t for me. No, I don’t believe this was sent to me on solicited. It’s just stop, stop clicking is really all I could tell you stop clicking. If you need help with phishing, reach out to us and we will set something up. We can do it remotely. We don’t have to do it. We don’t have to come to your office or to your home. We can talk about it remotely over of all things zoom. But we could also talk about it over the phone. And we can check we can set you up so that you are protected. But just reach out to us please because it’s it’s really serious right now. Also, the Hacker News Cova 19 hackers begin exploding zooms overnight six success to spread malware. So this article talks about an increase in the purchase of domains around zoom. So you know, like zoom, remote meetings, calm or something like that. There was a huge thing. crease in early March in the number of domains purchased. And the idea is that they will then launch these domains, trick people into going to them and downloading what looks like zoom but isn’t zoom or maybe it is zoom wrapped with something else, and then installing malware onto the computer and systems that are going to be used. And then from there, it could spread even more. So if it’s in an enterprise network or even if it’s, you know, somebody working remotely connected to the enterprise network, it could spread ransomware to that network. So we will see an increase in ransomware attacks and malware attacks around zoom, I’m sure in the coming months. info security magazine secure backup company leaks 135 million records online. So the company is SOS online backup they have 135 million records in an exposed I believe it was an s3 bucket. But let me just verify that totaling 70 gigs and made it metadata related to user Oh no, I was sorry. It was their own storage. So 70 gigs of metadata related to user accounts on SLS online backup does include a structural reference descriptive and administrative meta data covering many aspects of SOS online backups cloud services VPN mentor reporter explains so VPN mentor has been very business very busy the last few weeks. The Trove also included PII such as name, emails, phone numbers, business details for corporate customers and account usernames. So not a good look for a source online backup. You of course, want your backup company to remain secure and make sure that data is not left out in the open. They will be subject to ccpa because they are a California based business. So That could be even more problems for them. And they may also have to deal with GDPR because they have clients in Europe. So we’ll we’ll keep an eye on that and see what, what comes of that. And gadget FCC This is actually good news for people tired of robo calls FCC will require phone carriers to authenticate calls by June 2021. The agency says the move will help combat the scourge of robo calls. The FCC announced today which was March 31. All carriers and phone companies must adopt the stir shaken protocol by June 30 2021. The regulatory requirement is designed to combat robo calls, specifically, specifically those that tried to hide their phone numbers by allowing carriers to authenticate caller IDs. The agency says the widespread adoption of stir shaken will reduce the effectiveness of illegal spoofing. help law enforcement agencies identify bad actors and most importantly, allow carriers To identify spammers before they ever call your phone FCC estimates fraudulent call schemes cost Americans approximately $10 billion. That’s a bee. Every year FCC Chairman Ajit pi started pushing carriers to adopt the protocol in 2018. Congress also mandated the technology when it passed the Trust Act last year. While the regulatory requirement to support stir shaken is a step in the right direction, it won’t magically solve the scourge of robocalls. Overnight, it’s not enough for carriers to merely implement the protocol on their own. They must also test that their implementation works with other networks. In other words, it’s not something your wireless provider can just turn on. Moreover, as a consumer, you may also need a device that can display the color verify notification when someone calls you. Most modern smartphones support the feature out of the box, other handsets will will need to be updated. What I have noticed one positive about the pandemic if there are any, is that there is a huge decrease In a number of robo calls, and I’m not the only one that sees it, there’s other peoples that have reported the same thing. So it’s interesting. Threat posts reports top email protections fail and latest kovat 19 phishing campaign and effective spoofing campaign promises users important information about new coronavirus cases in your local area, scooting past Proofpoint and Microsoft Office 365 ATPs. This was determined by ko fence phishing defense center PDC discovered new phishing attacks that use socially engineered emails promising access to important information about cases of Cova 19. And the receivers local area according to a blog post published Tuesday by conference researcher Qian manabi. So it’s interesting. I know we reported on the daily podcast that there is a phishing campaign around local hospitals saying you know there’s a person that tested positive and you may have been in contact with them. Well, this may be the same thing and it’s somehow skirts, Proofpoint and Microsoft Office 365 ATP So, this is why we have to remain vigilant. You have to know what a phishing email looks like so that you can report it or delete it, whatever whatever method you have in place in your organization. bleeping computer reports IRS warns of surge in economic stimulus payment scams, internal revenue. Of course, the Internal Revenue Service today issued a warning to alert and this was April 2. So yesterday, today issued a warning to alert about a surge in coronavirus related scams over email, phone calls or social media requesting personal information while using economic impact state payments and alert. So what they’re doing is they’re calling up saying, Hey, we need your checking account to develop to deposit the payment. And then of course if once you give up that information and probably some other information they’ll ask for to ask you to verify your social security number. Things like that. You have now become a victim. And scammers can use a wide range of tactics to trick the targets into sharing their personal or financial information ation with some of them potentially tempting to emphasize the word stimulus checker stimulus payment. The official term is economic impact payment, ask the taxpayer to sign over the economic impact payment check to them. Ask by phone, email, text or social media. So notice phone it’s not just phone calls, phone, email, text or social media for verification. Why would the IRS use social media I mean, think about that. IRS does not call people they do not text people. They do not email this then you mail in the in post through the post office. So they may ask by phone, email, text or social media for verification of personal, personal and or banking information, saying that information is needed to receive or speed up the economic impact payment. And I could promise you the IRS most likely has your checking account information already anyway, suggest that they get a tax refund of economic impact payment faster by working on the taxpayers behalf the scheme Could be conducted by social media or even in person and then mail taxpayer a bogus check perhaps in an odd amount and tell the taxpayer to call a number or verify information online in order to cash it. So we’ve seen that scam before using different methodologies but same scam. Also on bleeping computer FBI warns of attacks on remote work and distance learning platforms. FBI internet crime complaint center IC three issued a public service announcement today about the risk of attacks exploiting the increased usage of online communication platforms from remote working and distance learning caused by the source code to a pandemic. So another name given to the cobit 19 pandemic. FBI says that it is expecting an acceleration of exploitation attempts of virtual communication environments used by government agencies, private organizations, and individuals as a direct result of the Cova 19 outbreak. Computer Systems and virtual environments provide essential communication services for telework and education. In addition to deducting regular business, I see threes PSA set. Some pieces of advice they give you software use do not use software from untrusted trusted sources. So if you’re going to use zoom download from zoom.us make sure you update it frequently. Also under attack, video teleconferencing, hijacking, conferencing, eavesdropping, remote desktop access is being attacked. So use a reliable Remote Desktop Access Tool and it should be locked down it should be multi factor authentication and complex passwords. And then also rented it equipment and pre installed malicious tools is an issue. And so here are the tips share do not should not should not share links to remote meetings, conference calls or virtual classrooms on open websites or open social media platforms. Do not open attachments or click links within emails from senders. You do not recognize enable Remote Desktop access functions. Do not enable Remote Desktop functions like RDP or virtual network computing VNC unless absolutely needed. If you go and use RDP you should do it over VPN. Provide exact information on children when creating user profiles. Use initials instead of full names. Avoid using exact dates of birth. Avoid including photos upon attachments or click links within emails received from senders you do not recognize or I’m sorry, open to not open attachments not upon Do not open attachments or click links within emails received from senders you do not recognize. do not provide username passwords, birthdate social security numbers, financial data or other personal information in response to an email or phone call. Do not use public or non secure Wi Fi access points to access sensitive information and do not use the same password for multiple accounts. I feel like I’ve talked about these things before. Hmm. bleeping computer. Microsoft is alerting hospitals vulnerable to ransomware attacks. Microsoft, this is actually pretty cool on their behalf. But Microsoft has started to send targeted notifications to dozens of hospitals about vulnerable public facing VPN devices and gateways located on their network. The pulse VPN, which is another device, I should have mentioned earlier in this in this in the episode, another device that needs or another system that needs to be patched if you have not done so. Because it is if you have not patched it has been a vulnerability known for a few months now, if you have not patched it, then you are going to be targeted. And if you’re using this for your hospital, then you are probably already being targeted. So pulse VPN devices have been known to be targeted by threat actors with this vulnerability. It’s thought to be behind the Travelex ransomware attack by rebel or sort of mcareavey. Soto and Kimi is not one of the ransomware groups that said they would stop the attacks on hospitals Mays is one of them, but they have continued from what I’ve read. Other attackers such as Doppel, painter and Ragnarok ransomware. Were also seen in the past utilizing the Citrix ADC netscaler vulnerability that we talked about earlier. So, again, if you’re using pulse VPN or Citrix ADC netscaler you need to make sure that you are on the most recent version because you are exposing and so Microsoft is checking for you, but you’re exposing your hospital or your your business, whatever the case may be. So here’s some tips for Microsoft hardened internet facing assets apply latest updates security updates, use threatened vulnerability management, perform regular audit, remove and remove privileged credentials. thoroughly investigate and remediate alerts, prioritize and threat commodity malware infections as potential full compromise. So in other words, a foreign computer is impacted, treated as a full compromise Include IT pros and security discussions ensure collaboration between sec ops sec admins IT admins into in configure service servers, and other endpoints securely. So that’s always been an issue in a lot of businesses where those teams sec Ops, sec admins and IT admins, they don’t necessarily work well together. Build credential hygiene use MFA or NLA and use strong randomized just in time local admin passwords apply principle of least privilege. monitor for adversarial activities hunt for brute force attempts monitor for cleanup of event logs and analyze logon attempts. hardening hardened infrastructure use Windows Defender firewall enabled simple tamper protection, enable cloud delivered protection and turn on attack surface reduction rules and ANSI for office VBA. And finally, on bleeping computer Marriott reports data breach affecting up to 5.2 million guests Marriott international today revealed that personalization Roughly 5.2 million hotel guests was impacted in a data breach incident detected at the end of February. At the end of February, we noticed that an unexpected amount of guest information may have been accessed using the login credentials of two employees at a franchise property The company said it in a statement. We believe this activity started in mid January. Upon discovery, we immediately unsure the login credentials were disabled, began an investigation implemented heightened monitoring and arranged resources to inform and assist guests. Although an investigation of this incident is ongoing, Maria says that currently there is no reason to believe that the information involved included Marriott Bon voyage account passwords or pins payment card information, passport information national IDs or driver’s license numbers Marriott has set up a self service online portal for guests who want to determine whether their info was involved in this data breach and if so what categories of personal data were involved? In addition, Marriott bond boy members who had their information potentially exposed in the incident had passwords disabled and will be requested to change their password on the next login, as well as prompted to enable multi factor authentication. According to Marriott, the following guests information might have been involved in a breach and various combinations for each of the affected customers. Contact emails like name, mailing address, email address and phone number, loyalty account information account number of points balance but not passwords, additional personal details like company gender and birthday month. partnerships and affiliations linked airline loyalty programs and numbers and preferences, like your stay room preferences and language preferences. So this is the second time in less than two years that they have been hacked or compromised. So Marriott’s got to get their act together a little bit I think here. That being said, this is enough information to launch launch spear phishing campaigns. So something to be on the lookout for if you have stayed at Marriott recently, you should check into Whether or not you may have been compromised in that incident. It is time for this week’s hot topics and unfortunately, they all centered around Cova 19. So that, you know, that’s not really the focus of this podcast but because it impacts cybersecurity, we have to report it. So the first one is on Forbes written by john Webster Cova 19 the new it reality. I am one of my co workers are now engaged in a research project to determine how they impact Cova 19 and the resulting social distancing measures are impacting enterprise IT the impact is significant and cause for pause to consider what is changing daily. Here’s what we’ve heard in conversations with enterprise IT operations so far. Security is not primary concern to the point that some projects that were active before the pandemic are now being put on hold, or even abandoned while security projects are accelerated. One healthcare IT executive we spoke to, has seen a near doubling of outside attacks on the internal healthcare delivery systems over the last few weeks. Personally, I find this as evil as it gets. And he’s right, it is evil, but it is going to continue and it will probably increase. But to the point zoom just announced, and I’m going to talk about it shortly that they are putting all future in other projects aside to to help with the security. And so we’ll get to that in a moment. Data Protection is now a second priority behind security, in fact, to go hand in hand, which is also true, that is worth more than gold on the dark web. So just keep that in mind. Because at home workers are more vulnerable to attack and farther away from direct support. Their data is more at risk. backups are more frequent, which puts increased demand on data protection systems trying to handle the increased load network bandwidth is being increasingly challenged to handle the load of workers trying to stay connected in order to remain functional. As one IT operations staff member said it’s the last mile problem that’s slowing us down. Train IT staff is an even greater demand in areas that are now deemed critical. As noted, these include security and data protection, cloud infrastructure and network management are two more disaster recovery and business continuity plans are at least being partially activated to deal with the stay at home workers. This is particularly the case for systems that now must be managed and maintained remotely post 911 it executive realized that it wasn’t just systems that needed to be covered by disaster recovery plans. The absence of hands on operational stuff needed to be considered as well. I will say from assisting many people in the last few weeks with setting up work from home. This is not 100% accurate. I’ve seen some scary things from government system. I’m not going to go into detail on local government, I will say that that is not set up properly. RDP direct from a BYOD. Bring Your Own Device. So a personal laptop being used to RDP into a workstation at a government job, a local government job. So it’s this is not being taken seriously still, and that is a recipe for disaster. Cloud workload migration and remote systems management projects are accelerating. However, the problem here is that cloud providers may have to respond by rationing capacity, because of the spike in demand. And I did hear already, I believe was Microsoft Azure in UK was having issues because of that. A longtime user of one of the major cloud providers was told yesterday that his requests for new capacity can’t be fully met because of the cloud provider has seen the same spike in capacity demand from their other large users. We need to recognize the new reality. As an IT community and come together over ways to deal with it, there are positive ways to approach these challenges. It seems to me that continued functioning of healthcare systems, for example, should now be a national priority as they face every one of the challenges I’ve noted here, expect to see more on this topic here in the coming weeks. So it’s, these are great points, especially in healthcare. And these are going to be challenges. So even when this pandemic is all said and done, it will eventually go away. We’re going to see that these things are going to be attacked and need to be taken care of going forward. It is a new world. You know, once eventually will go away we will eventually will return to normal for the most part, but some things will have to change and those things will have to change. And PR not a source I normally use but we’re using it today. npr.org cyber support cybersecurity lawyer who flagged a hoo hack. That’s World Health Organization warns of massive remote work risk. A large number of companies are rolling out mandatory work from home policies to help limit the risk posed by the corona virus outbreak. But cybersecurity experts warn that those remote setups invite new hacking risks. The Federal Bureau of Investigation recently issued warnings of an uptick in fraudulent crimes tied to the corona virus, particularly by scammers posing as official health agencies. This month, the hacking group tried to break into the World Health Organization. The breach was discovered by Alexander ballasts, a hacker turned Information Security lawyer who founded the New York based Blackstone Law Group. Although rebels can’t be certain about the identity of the hackers. He says the group replicated a portal used by the remote who employees that he describes is very, very convincing rebels spoke to NPR Steve Inskeep about the designs of such attacks and some best cybersecurity practices people should use to defend themselves against hackers. The group that targeted who we have been watching for quite a while and that group has in fact, our to several other employees, other clients who is not one of Blackstone’s clients By the way, and we have been monitoring the internet for indications that the group has reawakened or reactive reactivated some of its infrastructure. And that’s what we’ve detected with aspect risk with respect to live attack against the World Health Organization. It’s very difficult to say with any near certainty exactly who this is, there are some indications that the group by the name of dark hotel, which is known for targeting executives, checking into hotels and hotel Wi Fi, and things like that may be responsible for this particular type of attack. What we do know though, is that the group we’ve been watching is very sophisticated, their attacks are very sleek, they’re very well researched. The attackers perform a significant amount of reconnaissance on those configurations and systems of who they attack. And they painstakingly create portals that look exactly like the victims portals. And that’s where that’s what we saw with the HU on 13th of March. We saw URL, a web being created and put together that exactly mirrored the doorway to the World Health Organization’s internal file systems. So it was external link to the internal file systems that the portal the remote, that portal that remote employees would use to access by the who, let’s say if they were working from home. That’s what this group replicated. We have seen this group not only replicate the portals of who but major research universities in many other integral governmental organizations like the who, in fact, the same day, that the who was targeted by this particular group. They also targeted the UN, certain components of the United Nations. They have all the hallmarks of being a state sponsored or state affiliate group, and that means that they will be could be considered what’s known as an abt or an information security teams that stands for an advanced, persistent threat, essentially a force to be reckoned with. People are very used to seeing this, these portals that are asking for their usernames and passwords. And if you look at the web address or the URL that’s associated with this particular type of attack, it’s very, very convincing. I was glad to hear on the back end of this, though, from what we know from the who that that attack was on successful. So we did report that last week it wasn’t successful. Well, I think it’s for the obvious reason anybody would want to target the World Health Organization right now. It would be for intelligence gathering purposes and gaining an advantage. I mean, right now, any advice, any advanced information about preventative measures, cures vaccines, even country by country infections, and statistics is going to be extraordinary value that can be valuable to a country’s private industry, especially if they’re trying to get a leg up on the respect to let’s say, palliative care care, the distribution of testing kits and even the creation of a vaccine. I suppose it would also be very helpful to somebody who’s working in the stock market absolutely would most certainly be valuable because they are dealing with right now is a different class of information that is moving markets data from the world World Health Organization certainly moves the market one way or the other. And we’ve witnessed that over the last few weeks, it’s bounced significantly in in both directions. This means that more personal devices more off premises endpoints, so to speak, being used to handle and process business data, including highly sensitive data like trade secrets, and business plans. Because of this, all of our client companies have had to dedicate a massive amount of IT resources to support all of these remote working arrangements, including the deployment of best cyber hygiene practices, things are known things that are known as MFA, or to FA in particular, using something other than just a password to access company resources is critical these days, because the bad guys know that people reuse passwords or they have variations on a theme of passwords. There have been so many data breaches with all of our passwords for so many years. Now that there’s a always a password that you can associate with individuals. And so with the bad guys, the threat actors will try as a password spraying. Just taking your username with your password and variations on a theme of your password and trying to brute force their way into your office systems. So again, we’ve talked about this extensively, don’t reuse passwords. There are ways to deal with this password one on one. You know, I’ve talked about it, I’ve written about it. And you could just look up on our website. There’s an article on there, and I’ve shared it on social media. So look for that. We need to do better multi factor authentication and two factor authentication should have already been activated. If it’s not, then you need to do it now. And then, we’ve talked a lot about zoom this week, and we’re going to talk about it right now. This is a letter written on zooms blog, a letter from Eric Yon, who is the founder and CEO of zoom. And this is to address the increasing issues being found with zoom and there’s been a handful of issues this week reported, comp vulnerabilities in attack. and so forth. So let’s let’s read this to our zoom users around the world whether you are a global corporation that needs to maintain business continuity and local government agency working to keep your community functioning. A school teacher educating students remotely or a friend that wants to host a happy hour to spark some joy while social distancing, you are all managing through unique challenges brought upon us by this global health crisis. During this time of isolation, we at zoom feel incredibly privileged to be in position to help you stay connected. We also feel an immense responsibility usage of zoom has ballooned overnight, far surpassing what we expected when we first announced our desire to help in late February. This includes over 90,000 schools across 20 countries that have taken us up on our offer to help children continue their education remotely. To put this growth in context. As of the end of December of last year. The maximum number of daily meeting participants, both free and paid, conducted on zoom was approximately 10 million in March this year, we reached more than 200 million daily meeting participants both free and paid. We have been working round the clock to ensure all our users new and old largest mall can stay in touch in operation. Now we’ll say this. I’ve heard reports of issues with zoom. As far as usability, like functionality. I have not experienced any and if they’re 200 million people on this thing every day, I think they’re doing a great job of maintaining the usage of zoom that is still works, even though they’ve seen this huge increase in usage. For the past several weeks supporting this influx of users has been a tremendous Undertaker. undertaking, not Undertaker undertaking. In our sole focus, we strive to provide you with uninterrupted service in the same user friendly experience that has made zoom the video conferencing platform of choice for enterprises around the world. While we while also ensuring platform safety, privacy and security. However, we recognize that we have fallen short of the communities and our own privacy and security expectations for that I’m deeply sorry and I want to share what we are doing about it. First, some background, our platform was built primarily for enterprise customers large institutions with full IT support. These range from world’s largest financial services companies, to leading telecommunications providers, government agencies, universities, healthcare organizations and telemedicine practices. Thousands of enterprises around the world have done exhaustive security reviews of our user network and data center layers and confidently selected zoom for complete deployment. However, we did not design the product with foresight that in a matter of weeks, every person in the world would suddenly be working, studying and socializing from home. We now have a much broader set of users who are utilizing our product and a myriad of unexpected ways presenting us with challenges we did not anticipate when the platform was conceived. Now, I’ve been using zoom for years, at least five or six years, and I’m not an enterprise business. So I get that This what they’re saying that their target is enterprise businesses, and I’ve used it in enterprise environment. But I’ve also used it on a personal level. I’ve used it for all kinds of things, remote support, screen sharing webinars, recording videos, recording podcasts, just a bunch of things. And I’m even seeing today where people start a zoom session and then use Facebook to stream it live. So it’s used for a myriad of reasons, as he said, and I don’t believe maybe their target was enterprise, obviously, because that’s where the, the big bucks will be. But they definitely targeted smaller businesses as well. However, we did not design the product with Okay, here we go. I read that already. There’s these new mostly consumer use cases have helped us uncover unforeseen issues with our platform. Dedicated journalists, and security researchers have also helped to identify pre existing ones. We appreciate the scrutiny and questions we have been getting about How services works about our infrastructure and capacity and about our privacy and security policies. These are the questions that will make zoom better both as a company and for its users. We take them extremely seriously, we’re looking into each and every one of them and addressing them as expeditiously as we can. We are committed to learning from them and doing better in the future. But before I lay out what we intend to approve, I want to share what we have done so far. So what we’ve done with the flood of new users part of the challenges ensuring that we provide the proper training tools and support to help them understand their own account features, and how best to use the platform. We have been offering training sessions and tutorials as well as free interactive daily webinars. to users, we have proactively sent out many of these resources to help familiarize you users with zoom. They have training and tutorial rep webinars, live daily demos, upcoming webinars, video trainings webinar, signups for various platform trainings, were taking several steps to minimize customer support. Time. wait time When they reach out with questions, we’re listening to our community of users to help us evolve our approach. We have also worked hard to actively quickly adjust specific issues and questions that have been raised. So these are some of the more recent issues now. On March 20, we published a blog post to help users address incidents of harassment, or so called zoom bombing on our platform by clarifying the protective features that can help prevent this, such as waiting rooms, passwords, muting controls and limiting screen sharing. And in parentheses, we have also changed the name and content of that blog blog post, which originally referred to uninvited participant as party crashes given the more serious and hateful types of attacks that have since emerged, that terminology clearly doesn’t suffice. We absolutely condemn these attacks of these types of attacks, and deeply feel for anyone who’s meeting has been in has been interrupted in this way. So the types of attacks he’s talking about, there have been incidents of people sharing pornographic images. In probably video, I’m not sure people showing swastikas on on video. So these are the types of things that are very disturbing, especially if it’s a school or a business meeting on March 27, we took action to remove the Facebook SDK in our iOS client and have reconfigured it to prevent it from collecting unnecessary device information from our users. So there was an issue with the zoom app. On iOS. If you logged into Facebook, it was collecting additional information they have since fixed that, on March 29, we updated our privacy policy to be more clear and transparent around the data we collect and how it is used explicitly clarifying that we do not sell our users data. We have never sold user data in the past and we have no intention of selling users data going forward. So this was one of the concerns that was sent to me that they are selling user data or sharing user data with China that the research and development team is in China. So that has been clarified, they’re not doing that. for education users, we rolled out a guide for administrators on setting up virtual classroom, set up a guide on how to better secure their virtual classrooms. Set up a dedicated K through 12 privacy policy, change the settings for education users enrolled in our K through 12. programs or virtual waiting rooms are on by default, change the settings for education users enrolled in K through 12 program so that teachers by default, are the only ones who can share content in class. So that is in direct response to some incidents that the FBI reported about people crashing in and some of those incidents included swastika and then somebody yelling and screaming and eventually sharing the teachers address home address. So on April 1, we published a blog to clarify the facts around encryption on our platform acknowledging and apologizing, apologizing for the confusion. We permanently removed the attendee attention tracker feature updated for to to clarify that it’s permanently removed released fixes for both Mac related issues raised by Patrick Wartell. So there were some issues around how the zoom app is installed on Mac, so you need to update it if you have not. We released a fix for the UNC link issue which was on on windows that has been fixed and there is an update. So you need to update if you have not already and permanently removed the LinkedIn Sales Navigator app to identify After identifying unnecessary data disclosed by the feature updated for to to clarify that it has permanently removed what we’re doing. In the next 90 days, we are committed to dedicating the resources needed to better identify, address and fix issues proactively. We’re also committed to being transparent throughout this process. We want to do what it takes to maintain your trust. This includes enacting a future freeze effectively immediately and shifting all of our engineering resources to focus on our biggest trust, safety and privacy issues. Conducting a comprehensive review with third party experts and Representative users To understand and ensure the security of all our new consumer use cases, preparing a transparency report that details information related to request for data, records or content, enhancing our current bug bounty program, launching a Cisco counsel in partnership with leading cisos from across the industry to facilitate an ongoing dialogue regarding security and privacy best practices, engaging in a series of simultaneous white box penetration tests to further identify and address issues. Starting next week. The CEO will host a weekly weekly webinar on Wednesdays at 10am. Pacific Time to provide privacy and security updates to our community. transparency, transparency has always been a core part of our culture. I am committed to being open and honest with you about areas where we are strengthening our platform and areas where users can take steps for their own to best use and protect themselves on the platform. We welcome the continued questions and encourage you to provide us With feedback, our chief concern now and always is making users happy and ensuring that the safety, privacy and security of our platform is worthy of the trust you all have put in on us. Together, let’s build something that can truly make the world a better place. Sign up. Well, Eric s. Yuan, founder, CEO of zoom. So I think it’s a great step forward. I understand the concerns that many people have. But it is it is what it is. You know, it’s really just growing pains and unexpected, you know, unexpected, rapid, rapid growth, where these problems appeared, that maybe they weren’t aware of maybe they were aware of, I don’t know, but they have addressed them very quickly. And they’re very, very transparent about addressing it. So I would still put my stock in zoom. Going forward. Will there be more issues, probably. But you could see that they’re addressing them and I think there is still some lingering issues. But they’re addressing them. And you could see that they will be taken care of quickly as they come up. And in reality, you can, you know, a lot of software applications, they get tested in a small test environment or a development environment. And it’s not until they’re released to the user base, that a lot of problems surface. And I’ve seen this, I’ve seen this in the enterprise environment. I’ve seen this in the real world. I’ve seen this many times where you test test test and everything looks great. The minute you release it to the to the user base, you find more problems. And sometimes there are security issues. Sometimes it just bugs. So zooms on top of it. They’re being transparent, they’re addressing issues very quickly as they come up. I don’t think we have anything to worry about as long as you’re doing your part. So add the passwords, use the waiting room. Don’t share it publicly. Things like that. Right, it is time for the education portion of the podcast. We we are in unprecedented unprecedented times right now. So, things have changed. We’ve talked a lot about the telehealth change the relaxation of the rules. But the OCR issued a bulletin on civil rights laws and HIPAA flexibilities that applied during the Cova 19. Emergency and this is on hhs.gov. Today the Office of Civil Rights, which was March 28. At the US Department of Health and Human Services is issuing a bulletin to ensure that entities covered by civil rights authorities keep in mind that obligations under laws and regulations that prohibit discrimination on the basis of race, color, national origin, disability, age, sex and exercise of conscience and religion in HHS funding programs, including in the provision of health care services during kovat 19 OCR is particularly focused on ensuring that covered entities do not unlawfully discriminate against people with disabilities when making decisions about the treatment during the Cova 19 healthcare emergency. OCR enforces that Americans with Disabilities Act, section 504 of the Rehabilitation Act, the Age Discrimination Act in Section 1557 of the Affordable Care Act, which prohibits discrimination in HHS funded health care programs, or activities. These these laws like other civil rights statutes, OCR enforces remain in effect as such persons with disabilities should not be denied medical care on the basis of stereotypes, assessments of quality of life, or judgments about a person’s relative worth based on the presence of absence or of disabilities or age. decisions by covered entities concerning whether an individual is a candidate for treatment should be based on an individualized assessment of the patient and his or her circumstances. On the best available objective medical evidence. So it is going to be interesting to see how this plays out for sure, because we’re already seeing cases of people being sent home and then later getting sicker or dying. We did see one incident where someone was sent home because they didn’t have insurance and they died. And I believe that was in California. So it is going to be interesting to see how this plays out. Our civil rights laws our civil our civil rights laws protect the equal dignity of every human life from ruthless utilitarianism, said Roger Severino OCR director at HHS is committed to leaving no one behind during an emergency and helping healthcare providers meet that goal. Persons with Disabilities with limited English skills and older persons should not be put at the end of the line for health care during emergency Severino ad. And I’m sure some of that is in response to what happened in Italy. So we’ll keep Data mine. There’s a bulletin. So there’s one bulletin that talks about and it’s six pages long, so I’m not going to read it but you can find it. On the hhs.gov site, the I’ll have the course the link will be in the show notes so you’ll be able to link to it. But there is the OCR is notice of enforcement discretion, allowing providers to serve patients while where they are through commonly used apps like FaceTime, Skype and zoom to provide telehealth remote communication. So we talked about that. And zoom actually does have a telehealth version that you can purchase. When we returned to normal obviously, you can do that. You can do it now too. I’ve set up clients on it, but it’s not necessary at this point. So you can provide telehealth services over FaceTime over Facebook Messenger and things like that as long as not shared with the public and as long as you tell the patient Have the risks that exist by using these applications that are not secured and don’t have a business associate agreement. We’ve talked about that already. So I’m not going to dwell on that one guidance that empowers first responders and others who receive protected health information about individuals who have tested positive or been exposed to Cova 19 to keep up to help keep both first responders and the public safe. So we’ll we’ll go through that. That’s pretty quick. OCR issues guidance to help ensure first responders and others receive protected health information about individuals exposed to Cova 19. Today, the OCR at the US Department of Health and Human Services issued guidance on how to how covered entities may disclose protected health information about an individual who has been infected with or exposed to Cova 19 to law enforcement, paramedics and other first responders and public health authorities in compliance with the HIPAA act of 1996 Privacy Rule. Guidance explains the circumstances under each Under which covered entity may disclose pH, such as the name or other identifying information about individuals without their HIPAA authorization and provides examples including when needed to provide treatment when required by law, when first responders may be at risk for an infection and when does one disclosure is necessary to prevent or lessen a serious and imminent threat. This guidance clarifies the regulatory permissions that covered entities may use to disclose pH I to first responders, and others so that they could take extra precautions or use personal protective equipment. The guidance also includes a reminder that generally covered entities must take reasonable efforts to limit the pH I used or disclosed to that which is a minimum is the minimum necessary to accomplish the purpose of the disclosure. Our nation needs our first responders like never before and we must do all we can to assure their safety while they’re, while they assure the safety of others said Roger Sue Marino OSHA director, this guidance helps ensure first responders will have greater access to real time effects. extra information to help keep them in the public safe, added Severino so and then there’s a link to the guidance. Again. This is well, it’s not as big a document but, you know, I’ll just skim through the through the highlights. When disclosure is needed to provide treatment for example, HIPAA permits a covered skilled nursing facility to disclose pH I about an individual as Cova 19 to emergency medical transport personnel, who will provide treatment while transporting the individual to a hospital emergency department when so such notification is required by law. For example, HIPAA permits a covered entity such as a hospital to disclose pH I about an individual who test positive for Cova 19. In accordance with state law requiring reporting of a confirmed or suspected case of infectious disease to public health, to notify public health authority to in order to prevent or control spread of disease. For example, HIPAA permits a covered entity to disclose pH I to a public health authority. Such as the CDC, or state, tribe, tribal, local and territorial public health departments that is authorized by law to collect or receive pH I for purpose of preventing or controlling disease injury or disability, disability, including for public health, surveillance, public health investigation and public health interventions, when first responders may be at risk of infection. For example, HIPAA permitted covered County Health Department in accordance with state law to disclose pH I to a police officer or other person who may come into contact with a person who tested positive for Cova 19 for purposes of preventing or controlling the spread. When disclosure of pH I had to first responders as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public, a covered entity may disclose pH to prevent or lessen a serious and imminent threat to a person or the public. When such disclosure is made to someone they believe can prevent or lessen the threat, which may include the target of the threat. For example, HIPAA permits a covered entity consistent with applicable law and standards of ethical conduct to disclose Ph. I, about individuals who have tested positive for covered 19 two Fire Department personnel, child welfare workers, mental health crisis services personnel, or others charged with protecting the health or safety of the public if the covered entity believes in good faith that the disclosure of the information is necessary to prevent or minimize the threat of eminent exposure to such personnel and the discharge of the duties. So this is there could be some gray area there. And when responding to a request for for PhD by a correctional institution or law enforcement official have having lawfully lawful custody of an inmate or other individual. So, hopefully that clears that up for some people, one of those might have a little bit of gray area. Hopefully that makes things a little bit clearer for some of you. And then the final piece that we have from no CR is guidance on how healthcare providers can share information with the CDC family members of patients and others to help address the Cova 19 emergency so that the previous one pretty much addresses that. So we will move on from there and talk about the HIPAA breaches for the week. Okay, we just have four breaches to report this week no enforcement’s at all. Stopped Stockdale radiology in California has announced that patient data has been compromised as a result of a ransomware attack on January 17. An internal investigation confirmed that the attackers gained access to patients first and last names, addresses refund logs, and personal health information including doctor’s notes. Stockdale radiology said a limited number of patient files were publicly exposed by the attackers stock delivery Algae also discovered on January 29, that for the patient information may have been accessed, but has not been publicly disclosed. So that means they’ve probably hit by maize or sold on a key be one of the groups that said they will do this system were immediately shut down to prevent any further unauthorized data access and a third party computer forensics firm was engaged to investigate the breach and determine how access was gained and who was affected. FBI was immediately notified about the attack and arrived to Stockdale radiology within 30 minutes. The FBI investigation into the breach is ongoing. I’m not really sure why that is important that they arrived within 30 minutes but in response to the attacks, Doctor radiology has conducted a review of internal data management and its security protocols and has taken steps to enhance cybersecurity to prevent further attacks in the future. According to the breach report, there is 10,700 patients were affected by Abilene, Texas based affordable care urgent care clinics has started notifying patients that some of their Protected Health and Permission may have been compromised as a result of a ransomware attack. The attack was discovered on February 4, and is believed to have started around February 1. An analysis of the breach. analysis of the breach revealed the attackers gain access to a service and deployed resumes ransomware. So amaze is one of the groups that said we will not attack healthcare providers, although this is before that, so but they said they wouldn’t attack healthcare providers during this pandemic, I don’t believe was called a pandemic till after February 1. So, prior to deploying ransomware the attackers download a patient information some of that data has been publicly exposed. The types of data the compromised servers included names addresses telephone numbers, ages dates of birth, visit dates, visit locations, reasons for visits, health insurance provider names, health insurance, policy numbers, Insurance Group numbers, treatment codes and descriptions and healthcare provider comments, no financial information, electronic health records or social security numbers were compromised. Doesn’t say the number of people that were impacted so the Georgia Department of Human Services has announced that staff in August Augusta, Georgia improperly disposed of boxes of confidential case files containing the records of individuals who receive services from the division of family and children’s services before June 12 2017, and individuals who receive services from the division of aging services before 2017 after being alerted to the incident immediate action was taken to recover the boxes and prevent them from being accessed by unauthorized individuals. The Georgia Department of Human Services does not believe the files were accessed by unauthorized individuals during the time the files were left unprotected. All affected patients are being notified about the breach, and policies and procedures are being reviewed to prevent similar incidents in the future. According to the breach summary on HHS OCR breach portal, known as the HIPAA wall shame records up to 500 individuals which is a nice round number because 500 is when you have to report it Neo genomics is alerting 911 patients that some of their PhD has been accidentally disclosed to an unauthorized individual. On January 28, an employee was communicating with the patient about completing and returning a form to nutrigenomics and accidentally attached and sent the wrong Excel spreadsheet. spreadsheet sent to the patient included data of patients who had laboratory tests performed between June 2018 and October 2019. The spreadsheet contain patient’s first and last names, dates of birth and the name of test performed by nutrigenomics. The results of the test are not included in the spreadsheet, and no other information was impermissibly disclosed there was reported to nutrigenomics by the patient who confirm the writing that their spreadsheet has been deleted. Out of the abundance of caution Neo genomics has offered affected patients affected individuals complementary credit monitoring services. nutrigenomics reports that the individual who made there has been retrained and the workforce has been instructed to check documents and spreadsheets to ensure they are correct before being sent. via email, that is it for their HIPAA breach report. And that is it for the productive it podcast. So until next week everyone, stay healthy, stay safe, stay secure.

Transcribed by https://otter.ai

The post ProactiveIT Ep 23 – Its Zoom’s World Now appeared first on Nwaj Tech - Information Tech & Cloud Support.

This is Episode 22!  

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback. What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

Google Chrome 80.0.3987.149

HHS.gov Open Redirect Used by Coronavirus Phishing to Spread Malware

COVID-19 Vaccine Test Center Hit By Cyber Attack, Stolen Data Posted Online

Tech Giant GE Discloses Data Breach After Service Provider Hack

WHO Targeted in Espionage Attempt, COVID-19 Cyberattacks Spike

Three More Ransomware Families Create Sites to Leak Stolen Data

Microsoft Fixes Windows Defender Scan Bug With New Update

Cincinnati Firm Faces $5m Data Breach Lawsuit

WordPress Malware Distributed via Pirated Coronavirus Plugins

Topic 1: The Coronavirus, This Recession and How Law Firms Need to Plan Now to Protect Their Business

Topic 2:  Working from home? Switch off Amazon’s Alexa (say lawyers)

Topic 3:  COVID-19 Cyberattacks Roundup From the Past Week

 February 2020 Healthcare Data Breach Report

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the proactive IT podcast this week the latest 19 cybersecurity news plus the new normal February HIPAA, roundup and law firms Get ready. This is Episode 22. Hi everyone and welcome to the productive it podcast. Each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by new wash tech a client focused and security minded IT consultant located in Central Connecticut You can find us at and watch tech comm that’s NWA j tech.com. Right? If you could leave us a review, share this podcast. Like it, give it five stars, whatever you want to do on your podcast platform of choice, we would greatly appreciate it we really just trying to reach people with important information so they can protect themselves out there in the wonderful world of technology. Also, if you’re in a HIPAA compliant business, whether it’s a business associate or a covered entity, go to Facebook in the search type in get HIPAA compliance and join that group because you will learn stuff and stuff is important and HIPAA isn’t it. It helps you protect your your healthcare, practice business, whatever it is you do better going forward in a healthcare world, one that is very litigious, and one that is very cool, to be honest with you. So join the group and learn. I don’t have A Question of the week this week. So I’m gonna take this opportunity to reiterate something. The relaxation of the HIPAA rules around telehealth doesn’t apply to all the HIPAA rules because I’m seeing it a lot on social media. And even questions being asked of me and I shared this information last week in an Instagram TV post, so I’m going to share it again. The rules the relaxation of the rules only apply to telehealth and it only applied to being able to provide telehealth services to patients via applications like FaceTime or Facebook Messenger. They do not apply to any other area of HIPAA. And they also just stipulate that if you’re going to do this, you need to let the patient know that it is a less secure method of communication and you cannot use things like Facebook Live When we go live out to the public, so Facebook Live tik tok, things like that. You can use FaceTime, you can use facebook, facebook Messenger, you can use duo, you can use apps like that, that are one to one and don’t have an audience. And this is temporary. So eventually they will pull this back and eventually you will have to use a an application that is approved by the IRS and even now you still have to get approval by the insurance company. So if the insurance company says no, then you cannot do it. Eventually they will pull it back and you will have to use an application that will assign a business associate agreement or has the appropriate levels of encryption and so forth. And so there are a few applications out there. The one that I usually recommend is is zoom for telehealth. But as of right now, as of the moment of this recording, you can you Use and will probably last for a few months anyway. You can use Facebook lie on, sorry. Freudian slip, I guess I don’t know Facebook Messenger, FaceTime duo, Whatsapp applications that are one to one communication apps for a video. You can use zoom, but you don’t have to get the telehealth version. You know, there are other applications like that out there. So just want to make that clear. Because that, you know, I guess that could be the question of the week. I have been asked on several occasions already in the last since I shared that last week. So just in just over a week, but nine days now. I’ve seen it all over Facebook and LinkedIn. You can it doesn’t they’re not relaxing all of the HIPAA rules. They’re only only relaxing the rules around telehealth. So I hope that clarifies that for some people. For Patch Tuesday updates, we have the The only update I saw this week was Apple released some security updates. So let me tell you about that. And I don’t think that’s actually true. I think Adobe released an update to but Apple released security updates for iCloud for Windows 7.18 iCloud for Windows 10.9. iTunes 12 point 10.5 for Windows, which I’m not sure why anybody’s using iTunes still iOS 13.4 and iPad os 13.4. Safari 13.1 watch os 6.2 TV os 13.4 Mac OS Catalina 10 point 15.4 security update 2020 dot 00 to Mojave and security update 2020 dot 00 to High Sierra and Xcode 11.4. So if you have any of those products, which if you’re using Apple, you probably have all of them. You should apply the updates right away and I just want to verify for you that there’s no other yes there was. That’s right. Now remember, there was, um, actually there’s a couple of other updates, there’s Adobe did release a security update for the Creative Cloud desktop application. So if you’re using Creative Cloud, you’ll want to address that because it is an update with a vulnerability. And windows did Microsoft did release an update for Windows Defender because of an issue where it was not scanning everything. And I’ll talk about that in a few moments. So that’s going to do it for your Patch Tuesday update. And that’s going to do it for this portion of the show. All right, it was a busy news week for cybersecurity. A lot of it centers around Kovac 19. And I had a conversation earlier yesterday. Talking About the extreme increase in fishing activity around cobit 19 there is a proliferation of cobit 19 phishing attacks ransomware attacks, espionage, hacking just all over the place right now. So it’s really important that business owners educate their employees or have your it educated employees and remain vigilant around anything around cobit 19. So I’m gonna say it one more time here. If you didn’t ask for the email, if it is unsolicited, around kovat 19. Do not click and do not download anything. Think before you click. If you are told about a website that has a vaccine or a cure, do not go to it. There are no vaccines or cures yet. And if you want more information about it, then go to the CDC website which is cdc.gov go to HHS website which is hhs.gov Or go to, to whose website a World Health Organization website, you need to, we need to realize that people are playing on our fears. And that’s how phishing works. It always plays on an emotion and going to take advantage of people going forward. And right now kovat 19 is the way to do that. So, let’s jump into the news. First up, speaking of HHS, HHS gov.gov open redirect used by coronavirus phishing to spread malware. And hhs. gov open redirect is currently being used by attackers to push malware payloads onto unsuspecting victims. systems with the help of coronavirus themed phishing emails. Open redirects are web addresses that automatically redirect users between a source website and a target site and a regular use by malicious actors to send their targets to efficient landing pages, or to deliver malware payloads under the guise of a legitimate service. So I’m hoping They fix this by now but as of last check, no they did not. hhs. gov is the website of the US Department of Health and Human Services which makes this specific open redirect the perfect tool to learn in potential victims. The open redirect is HTTP HTTPS. slash slash DC is hhs.gov slash cis slash login. Question mark service equals malicious URL and gateway equals true is present on the sub domain of HHS departmental contracts information system and it was discovered and shared on Twitter by infosec analyst Sexton the Anthea attack and that’s sec so me the attackers use it to link to malicious attachment containing coronavirus doc dot link Li ng lnk file, which will unpack an obfuscated VBS script that will download and execute a raccoon information stealer malware payload 18562 dot 188204 slash home slash post slash corona.xc and there’s a link. This is articles on bleeping computer there’s a link to the virus total analysis. And after saving it to temp slash uppercase H, lowercase H, uppercase K, uppercase f uppercase W. raccoon aka Legion mojado and Ricky Miller, is an information stealing malware initially spotted almost a year ago on criminal cyber criminal forums, and capable of stealing data such as email credentials, credit card info, cryptocurrency wallets, browser data and system information. So it gets on your system and it reads all those sensitive files. And this is why we tell people don’t save your passwords in Chrome or Firefox. Report from cyber Ark says that raccoon is capable of digging its way into about 60 different applications from browsers, cryptocurrency wallets, email and FTP clients to steal and deliver sensitive information to it. operators, so be careful of being redirected from hhs.gov site to any other website that doesn’t look legitimate. To defend against similar tax you should always be suspicious of coronavirus related attachments, which, you know I just said so, we’re going to leave it at that. Read on Forbes Cova 19 vaccine test center hit by cyber attack stolen data posted online and medical facility on standby to help test any Corona virus vaccine has been hit by a ransomware group that promised not to target medical organizations. So I think we talked about the two groups that said they wouldn’t one of those being mazed criminals behind these ransomware attacks have struck against stealing data from a victim and then publishing it online to get them to pay the ransom demand. That in and of itself would not be particularly newsworthy. Sadly, however, the Mays threat actors were amongst the leading cybercrime gangs which just days ago, pledged not to attack healthcare and medical targets. These threat actors didn’t go as far as those behind the doppelganger threat by offering free decrypted codes to those hit by accident, nor it would appear did they mean what they said the latest victim is Hammersmith medicines research, a British company that previously tested Ebola vaccine and is on standby to perform the medical trials on any Cova 19 vaccine. Malcolm Boies clinical director of Hammersmith medicines research told computer weekly that the cyber attack which took place on March 14 was spotted in progress stopped and systems are support restored without paying any ransom. We repelled the attack and quickly restored all our functions. He said. There was no downtime. This was admittedly before mais announced on March 18, that it would no longer target medical organizations However, this pledge has not stopped it from continuing and attempts to extort them. So they attack before March 18. But they’re trying to extort them after they made the announcement. The Maze attackers apparently managed exfiltrate data in this case patient records and has published some of them online. Boys told computer weekly that the hackers had sent Hammersmith medicines research sample files containing details of people who participated in testing trials between in 20 years previously, maze operators then published samples of data on the dark web. I’ve seen the posting from Ms group that had the ads Hammersmith medicines research as a new client, which is how it describes victims of his attack. tech giant GE discloses data breach after service provider hack this is on bleeping computer fortune 500 tech giant General Electric disclosed that personally identifiable information of current and former employees as well as beneficiaries was exposed in a security incident experienced by one of GE service providers. She is a multinational operating in a wide range of tech segments including aviation, power, healthcare and renewable energy and is currently ranked by Fortune 500 as its First largest company in the US by revenue. GE currently has customers of more than 180 countries and in excess of 280,000 employees according to the company’s 2018 annual report. GE says in a notice of data breach filed with the Office of Cal California Attorney General, that canon business process services canon, a GE service provider and had one of their employees email accounts breached by an unauthorized party in February. So this happened in California, which means it could fall into the ccpa they meet the guidelines. So they probably will be held under the ccpa the California Consumer Protection Act, or Privacy Act, I think it’s Privacy Act. We were notified on February 28 2020, that Canada had determined that between approximately February 3 and February 14, and unauthorized party gain access to an email account that contain documents of certain employees, former employees and beneficiaries entitled to benefits that were maintained on canons systems g Also status sensitive personal information exposed during the incident was uploaded by or for current and former employees as well as beneficiary is entitled to benefits in connection with the canons workflow routing service. So here’s some of the information that got direct deposit forms driver’s licenses, passports, birth certificates, marriage certificates, death certificates, medical Child Support orders, tax withholding forms, beneficiary designation forms and applications for benefits such as retirement, severance and death benefits with related forms, and documents may have included names addresses, social security numbers, driver’s license numbers, bank account numbers, passport numbers, dates of birth and other information contained in the relevant forms. GE systems were not breached. This was canon that was breached and being that they had the information. It’s a G’s information that was breached, but GE self was not breached on threat post. The World Health Organization targeted in espionage attempt to Cova 19 cyber Text spike, dark Hotel Group could have been looking for information on test vaccines or trial cures. The World Health Organization has attracted the notice of cyber criminals as the world wide covert. 19 pandemic continues to play out with a doubling of attacks recently, according to officials they’re problematically evidence has also shown as also now apparently surface that the dark hotel, a PT group has tried to infiltrate his networks to steal information. Alexander rebellious cyber security researcher attorney at Blackstone Law Group told Reuters that he personally observed a malicious state being set up on March 13 that mimic to whose internal email system Its purpose was to steal passwords from multiple agencies, staffers, and rebellious noted that he realized quite quickly that this was a live attack on the World Health Organization in the midst of a pandemic. The attack appeared to be aimed at achieving a foothold at the agency rather than being an end unto itself. That’s that’s basic hacking you start by getting finding your way in. You start by reconnaissance and then you find your way on. The targeting infrastructure seems to focus on certain types of healthcare and humanitarian work, isn’t it organizations that are in common for cyber criminals causton role research at Kaspersky told threat posts this could suggest the actor behind the attacks are more interested in gathering intelligence rather than being financially motivated, which is very possible arm. As for the why of the attack, which was started by booster that information about remediation for coronavirus, such as cures test or vaccines would be invaluable to any nation states intelligence officials. So there sounds like they’re saying it’s a nation state. So far, we don’t know the motivation behind these attacks. However, at times like this, any information about cures or tests or vaccines, relating to coronavirus would be priceless and the priority of any intelligence organization of an affected country. He told threat posts and I think I saw today Let me see what the count is right now. It was 175 countries yes 175 countries currently have at least one person with the corona virus Cova 19 that is infection. Um, so, this you know, this is an example of what I mean this is a group trying to find their way into the World Health Organization and unknown why but they are trying to find a way in and they are trying to skirt around the system by using potentially contractors and so forth to get in. And this is why we need to remain vigilant when it comes to cybersecurity because as we’re running around, you know, things people take shortcuts. There’s so much going on, that some things might fall by the wayside because we need to get something else accomplished. bleeping computer reports three more ransomware families create sites to leak stolen data. So this methodology of getting your ransoms paid. We talked about a few months ago when they started doing this. And we told you that this would be a continued, this would continue to grow. And so here we are three more chrome three more ransomware families have created sites that are being used to leak the stolen data of non paying victims and further illustrates why all ransomware attacks must be considered data breaches. Ever since May is created their new site to publish stolen data of their victims who choose not to pay other ransomware actors such as Sona, KB, or rebel, the same name, same group, an empty and double payment have been swift to follow. Over the past two days bleeping computer has learned learned of another three ransomware families who have now launched their data leak sites, which are listed, so they are the net flume. ransomware. NET fill in ransomware has launched a site called corporate leaks that is being used to dump the data of victims who did not pay ransom net film is fair. New isn’t believed to be a new version of the new empty ransomware clop ransomware has also released a leak site called clop. Dash leaks has a couple extra special characters that they’re using to publish stolen data for non paying victims. The clock noise from were made news recently after it attacked them Maastricht University and was paid 30 bitcoins to recover the data. And then second met ransomware. And that’s spelled sck h m et. Finally, a relatively new ransomware called segment has also released data leak site called leaks, leaks and leaks, not much. Not much is known about this ransomware other than their ransom note is named recover files dot txt. So it’s going to be a continuing trend and we really, really have said it for months now. The only way you’re going to stop ransomware is to make it not profitable. if if if the ransomware operators are not making money, they’re not going to continue doing what they’re doing. Because it’s it is risk it is risk for them as well. bleeping computer reports Microsoft fixes Windows Defender scan bug with new update. So real quick there was a bug in Windows Defender where it would skip some files during scan. You would receive an error message that says the Windows Defender antivirus can scan skipped an item due to exclusion of network scanning settings. There was a workaround that said that was to enable network scanning and not fix the issue. But Windows Defender has released an update it is kB 405 to six to three and that will resolve the issue. info security group which is info security dash magazine com reports that is Cincinnati firm faces a $5 million data breach lawsuit is Cincinnati freight brokerage company is facing a $5 million lawsuit over a data breach that occurred last month. computer systems that total quality logistics which is t q l for sure were comparable In a cyber attack that took place in February 23, customer and carrier information was exposed to threat actors breached the company’s online web portal. Carrier data compromised in the attack include a tax ID numbers, bank account numbers, and in some cases social security numbers breached customer data included email addresses, phone numbers first and last name and t QL. Customer ID numbers. Now t QL is being sued by an unnamed trucking company owned by Charles Newman of Milwaukee County, Wisconsin. a complaint filed in the US District Court for the Southern District of Ohio alleges that t q l fail to implement and maintain reasonable security measures over personally identifiable information. The plain of accuses TKO negligence and claims that the consequences of the data breach were dire and far reaching had tkl taken the well known risk of cyber intrusion security seriously and adequately tested audited and invested in its IT systems and adequately trained staff to lawsuit states the data breach would never have occurred. I think I saw somewhere in this article that they believe it was fish began with fishing. So, you know, there there is that for whatever it is, um, why am I showing us right now because this Cincinnati is does not have that I’m aware of does not have a data breach. They don’t have the, you know, the GDPR or the ccpa, or the New York shield law. They don’t have those laws in Cincinnati yet. But here it is a $5 million lawsuit that that the originator of the lawsuit is trying to make a class action suit which would could could potentially put this company in in financial dire straits. So I’m sharing this because we really need we need to understand that data is worth more than gold. Right now on the on the site dark web, which is the black market of the internet. data, especially personally identifiable information and pH I even more so is worth more than gold. And people are going to continue to sue. And it’s going it’s going to get to be extremely expensive and people are going businesses are going to go bankrupt and people are going to lose their shirts over this and it just we we need to step up and protect PII pH I better than we’re doing now. So let me step off my soapbox and I got one more article to share with you for the news. WordPress malware distributed via pirated Corona virus plugins. So real quick, there is a group when you there is a way to get WordPress plug, you know, paid WordPress plugins and WordPress themes for free to distributed as Nolde or pirated, the key word there being pirated. So there’s a WP dash VCD family of WordPress infections. they distribute these plugins and themes as Nolde or pirated, and they usually have some code change in the plugin or theme that allows them to spread malware takeover websites, crypto jacking all these things that that can be done over the web. And now they’re doing this for through Chrome, through plugins, to Corona virus plugins, I’m sorry, through Corona virus plugins that will inject a backdoor into your website. And you know the purpose of that not sure. But what will happen is they can either take over your website, they can use your website to crypto mine, they can use you know, there’s just so much they could do with it. So the point is, don’t use pirate Did WordPress plugins or WordPress themes because, you know even if it wasn’t for coronavirus right now, it’s dangerous because you’re putting yourself in anybody who visits your site at risk. That’s going to wrap up the news. We’re gonna move on to our hot topics for the week. All right. Wash tech works with compliance businesses. We work with all businesses, but we specialize in compliance. And I talk a lot about HIPAA and I don’t talk nearly enough about law firms or financial firms but so I found this article posted on March 13. So it was kind of early in the coronavirus spread in the US. That was you know, before they closed the schools and everything else in my area. Know the West Coast was a little bit earlier than then we were on the east coast. But it was early in that stage. This is on law calm. The coronavirus, this recession and how law firms need to plan now to protect their business. Houston has offers practical tips on what law firms can do now to prepare for the impacts of a recession and the corona virus on their businesses, including potential associate referrals, hiring slowdowns, and marketing investments. It’s helpful in times like these for leadership teams to have a common understanding of what’s going on in a broader economy. its implications for law firm demand and a roadmap for how to tackle the difficult decisions I had. The following offers such a framing. Let’s start with the economy. We’ve entered a recession we can think of it as ultimately having one of three shapes. So we do we have entered a recession regardless of whether or not the corona virus created it. I don’t believe it did. I believe it accelerated it, but I don’t believe that it created it. I believe this. We were heading for this All along. So the three shapes V shaped worker stayed home causing a dip in economic output to dip as falls relatively quickly quickly by a recovery in which workers put in overtime to make up for loss of productivity to economy regains its pre departure directory in a matter of weeks. And so you may you may look at the stock market and believe that’s what’s happening. However, I don’t believe it is. U shaped the above initial dip in economic output is accompanied by a decline in consumer demand reflecting among other issues at contract a contraction and household wealth, home values, retirement assets, etc. The policymakers take responsible responsive fiscal and monetary measures and economic activity returns to predict growth rate in a matter of months. And an L shaped recession starts out as a U shape but the policy interventions proven effective in a dip is prolonged into quarters in years. Know I’m not a financial expert and but I do believe that They’re trying to prop things up. I don’t think it’s going to work for the long haul. So that’s something to think about. We experienced a V shape dip in recovery with SARS in 2002. And three however SARS and Cova 19. A very different when SARS had run its course there had been a total of 668 cases in 89 deaths outside of China and Cova 19. to comprehend, comparable numbers are already over 45,015 hundred. So as of right now, those numbers have dramatically increased. We are now over 500,000 confirmed cases in over 23,000 deaths. So and, you know, so that’s not the focus of the show. I don’t want to dwell on that, but definitely not the same case. The U shaped recession should be similar to that following the 2008 global financial crisis. US government increases debt from 65 to 80% of GDP and the Fed funds rate was cut from 5% to effectively zero. The recession officially lasted 18 months to December 2007 to June 2009. An L shaped recession is worse than the global financial crisis may seem a needlessly bleak scenario to consider it belongs on the set of possibilities because of the difference between 2008 and today, and the starting points for any policy actions US government debt is currently at 105% of GDP, according to 2018, quarter three, as compared with 65% in 2008, making increasing government borrowing more problematic. Similarly, on March 15, the Fed cut its headline note rate 2.25%, leaving no room for further cuts. And actually they did cut it again. But whatever the shape of the broader economic recession, the effect on law firm demand will be exaggerated response to it. This was the case in 2008. But it will be even more so. This time. This is because of the change since then, and how aggregate demand for legal services met between in House counsel and outside firms. Going into the last recession was roughly equal number of lawyers in the United States who worked in house At am law 100 law firms since then number of in house lawyers has grown 40% while that of an am law 100 is essentially at 2008 level. As the economic recession reduces aggregate demand for legal services we can expect in house lawyers to focus first and keeping themselves busy passing to outside counsel only that work, which they truly cannot handle in house. parenthetically, we can also expect that for the work they do send outside they’ll look for considerable price relief. Law Firm leaders don’t need to take a stance on the ultimate shape of this recession they can let it reveal itself over time however, they need to do three things now. Firstly, support clients in their immediate difficulties eg form a task force to ensure all major clients are being contacted by senior firm representatives and offered help in any way possible, both professional and personal to navigate to short term a exigencies. Secondly, they need to be ready with targeted initiatives to stoke demand once example one example set aside a virtual budget for key client investment initiatives and half time charged to this budget carry the same internal standing as full price client work another example we set the parameters deemed acceptable by pricing committee in order to win major matters matters. Thirdly, there’s there are set of capacity. There are a set of capacity and cost issues to address now, so as to be able to act quickly and decisively as events unfold. Examples of these include equity partner transitions, income partner transitions, overhead cost management, terminate, flailing growth initiatives deferral of income, incoming associate class and curtail the length of summer program again, I’m sorry curtail the link to the summer program? To all my law firm friends and clients out there. I hope you can weather the storm. You know if you need support today, we’re here to help. So let’s talk about Something a lot of us are facing at the moment, working from home. This is an article on Zd net. The title is working from home switch off Amazon’s Alexa say lawyers. One of the bright byproducts of doing all your work from home is that you might be discussing confidential matters and who might overhear them while there’s your smart speakers. Those who are not used to working from home must be going through several stages of spiritual discomfort. Yes, CD nuts more experienced hands can help you acclimate acclimatize, it says to the new working style now that the Cova 19 pandemic has disrupted modern working life. Yes, some professionals may not be able to, may not be able to deal with life science, their office perks lawyers, for example, many are used to sitting in their enclosed chambers closing their doors and holding vital conversations about lawyerly matters. There they feel secure working in their homes, they worry who may be spying on them. Alexa, for example, In her band of vastly intelligent speaker, Speaker persons. Bloomberg reports that famed UK law firm by Shan de Raya motto it’s business but it’s personal seriously is telling its fine employees to mute or even totally disable domestic smart speakers for confidential business calls. JOHN Hancock the machine under a partner who leads the cybersecurity discipline, offered these words perhaps we’re being slightly paranoid, but we need to have a lot of trust in these organizations. And these devices, we’d rather not take those risks. paranoia is one of the three essential skills every lawyer should have. The other two are of course I’m aggressive billing department and cataclysmic ability to outline even a politician. When Hancock refers to devices he means every gadget you’ve bought, to fully express your inability to make an effort around the house and your comfort with the surveillance state. Yes, even the devastatingly effective ineffective Amazon ring doorbell the law firm conceded that there may be less chance of being spied on by, say an Amazon Echo or Google Home then some tawdry facsimile, but paranoia is paranoid. It really can’t be slight. I warned to my Shawn’s misgivings. Can anyone really have total confidence in what these machines over here and where those recordings might appear? Sometimes switch speakers have deliberately live recorded your conversations to help create a better product for you, of course. Then there’s the recent research that revealed Alexa and her squad have accidentally activate and record conversations up to 19 times a day. Imagine you’re a lawyer dealing with a very important case involving dirty money local politicians power utility three former contestants on The Bachelor. At some point you utter the word Congresswoman unbeknownst to you, that may be the moment Alexa starts record. You see the research I mentioned above found that Congresswoman was one of the words that made Alexa think she was being summit. Yes, talk about ideas below her station, but Imagine the possible result when Alexa records the details of this call. And it mysteriously becomes a new york post level scandal, Bachelor contestants and local pause. Con medicine out of $50 million. Of course, there’s something else you could try. Once you’ve turned off Alexa Siri or Ms. Google? What if you don’t turn them back on? You might feel curiously free. So we do have Alexa’s in the house. And I do have one right next to me that is listening at the moment because I just said the magic word. When I’m having a sensitive conversation, I do turn it off. Because just like lawyers, go there you go. Alexa, stop. Just like lawyers. I have to have a sense of paranoia in security. And I never know what’s listening, what’s not listening and so forth. So there’s that take that for what it’s worth. Hopefully work for home is is a little easier to deal with now that it’s for most of us. It’s been a few weeks. And then finally, we’re going to talk about a covert 19 cyber attack roundup from the past week. So a group of researchers disclosed that cyber criminals are creating thousands of websites to exploit coven 19 bR no are Brno University Hospital in Czech Republic and US government’s department of health and human services were targeted last week. So this is for March 24. So it’s a couple days old. But cybersecurity concerns are running high this week as large organizations local governments and hospitals continue to be to be the prime targets of hacking attempts due to Cova 19. Over that’s not all. According to a CNBC flash survey, more than one third of executives that’s 36% say that cyber threats have leaked after a majority of their employees work from home at this point of the global public health crisis and we’ve expressed this concern for weeks So, how Koba 19 laid the bed for attackers Corona virus related scam started around mid January, the spread of the virus helped attackers prey on fear and confusion of people. Many sophisticated nation state hackers use pandemic related traps to distribute malicious payloads. Further and more and more people now working from home often with fewer security defenses on the home networks have given additional attack surfaces for an unauthorized user to attempt data extraction from their computing environment. What attempts did hackers make? Below are some of the ways in which hackers were observed trying to cash in in a covert 19 outbreak conditions in the last week. security experts expose an ongoing phishing campaign actively spreading malware payloads through emails impersonating the director of General of the World Health Organization, researchers discovered a phishing campaign that impersonates The World Health Organization and promises to provide the latest guidance on cobit 19 Viet fakie book titled My health ebook, and I’ve actually haven’t seen that one in my mailbox, but I have seen screenshots from other people. A group of researchers also disclosed a cyber criminals are creating thousands of websites to exploit the covert 19 pandemic fears as a bait to spread malware through fake product offers. And cyber criminals targeted the world of meters website that checks updates on the kovat 19 pandemic. The site showed incorrect data about the current situation due to the attack and was a couple of serious attacks one cyber attackers targeted br no or Bruno University Hospital in Czech Republic, a major kovat 19 testing hub and disrupted its operations by halting systems. And as we talked about a few times now, hackers also hacked US government’s Department of Health and Human Services improperly circulated a false claim that the American government plan to introduce a nationwide lockdown. They were also hit with a well they haven’t confirmed but there was rumors they were hit with a DD Attack. Some ransomware operators had stated they will not attack healthcare facilities during the kovat 19 pandemic. However, it means ransomware actors who said will also stop all activity versus all kinds of medical organizations. Until the stabilization of the situation with virus did not seem to follow their own pledge as we talked about earlier. The ransomware remediation firm Cove wares in the malware defense from MC soft announced to offer free ransomware response services to healthcare facilities facing encryption threats during the pandemic. The firm’s revealed that their offer would include technical analysis to the ransomware development of a decryption tool whenever possible. ransom negotiation help and transaction handling if needed and more. Across the world major steps are being taken to control the spread of the pandemic. Meanwhile, rapid changes in daily life because of Cova 19 have also affected the way people interact with internet connected technologies. employees should All these tips and tricks to stay safe while working from home and we must all be vigilant of bad actors trying to use the situation to their advantage. Those tips and tricks are on and that was on site where, by the way, so those tips and tricks are on cyber.com slash news and in cybersecurity tips and best practices for remote workers. So I’m not going to go through it, I’ll skim it real quick. So you have use Password Manager. Make two factor authentication the standard implement Endpoint Protection software educate your staff on the physical safety of their devices. Avoid public or unsecured Wi Fi networks, use virtual private network VPN. Educate employees on security etiquettes and know how to detect and report phishing attempts. That being said, I just discovered today that a local municipality is having their employees use remote desktop to remote into their workstations in the office. And not over VPN, just over internet, very unsecure, and a very common attack vector. So even our government, local governments are not using best practices when it comes to cybersecurity. And this is going to be a big problem, you’re going to see more compromises. Because people, you know, you send an employee a home and say, This is how you connect, they’re not really trained on how to recognize threats and deal with potential threats. You’re not giving them you’re not giving them any tools to deal with those threats. And it becomes a big problem. And it’s going to be a big problem, you will you will see an increase in those types of attacks. Alright, it’s time for a little HIPAA education and we’re going to do that. By reviewing the February 2020 healthcare data breach report as reported on HIPAA journal comm there were 39 reported healthcare data breaches of 500 or more records in February and 1,531,855 records were breached, which represents a 21.9% month over month increase in data breaches and a 231% increase in breached records. More records were breached in February than in the past three months combined. In February, the average breach side was 39,278 Records and the mean breach size was 3335 Records. So this was the most breaches of wills about it looks about average so December was 41. January is 33. February it was 39 500 or more, but most records since September of 2019, when it was a little over 2 million. The largest healthcare data breaches have 2020 so the top 10 Health share of Oregon, which is a health plan had 654,362 Records affected by because of the theft of a laptop, which meant, which means that that laptop was not encrypted. And so which means we’re still not encrypting things which just, you know, almost as much as email blows my mind. BST and company CPAs LLP. You may remember we talked about this one a little bit, a few weeks ago. business associate, hundred 70,000. So this is a CPA by the way 170,000 Records, hacking it incident a network server. I believe that was a ransomware attack. AB on a healthcare healthcare provider 166,077 hacking it incident was email over like Medical Center and clinics 109,000 email Tennessee orthopedic Alliance at 1146 email Now, once in healthcare, 75,502, email, and ch healthcare systems health care provider email that was 63,581 solo labs, Inc, which was a business associate that was also a network server. So I don’t recall that one I’m guessing ransomware JDC, Healthcare Management 45,748 email, Ozark orthopedics, pa 15,240 email. So of the top 10 breaches, seven of them were email 70% of them, meaning phishing. And which means lack of training, lack of mitigation and lack of multi factor authentication on those email accounts to them or network server likely to be ransomware. And one was a stolen laptop that did not have any encryption because if it was encrypted, you wouldn’t have to report it. Causes of February healthcare data breaches so of the 39 Two of them were improper disposal. I vaguely recall talking about those. One, two of them were also last three were theft. I think one of them was theft of a server. If I recall correctly, maybe two of them. Six unauthorized access or disclosure, and 26 of them hacking it incident and then the location of that data of the pH. I, one was a desktop computer. One was portable electronic device. Two were laptops, five were network servers. Eight were paper, paper films and drumroll please, 22 of them. email. Email continues to be a big problem. Five of the breaches in February were business associates, eight were health plans and 26 were healthcare providers. Now, business associates have already been put on notice that they will be subject to more enforcement this year. And now currently, we’re dealing with With covert 19 an HHS has, of course is heavily involved in. So I don’t know how much enforcement we’re going to see in the next, I guess two to three months, probably, at least. But there’s going to be Enforcement Against business associates. We’ve only had one enforcement so far this year, and we talked about that last week. Email continues to be an issue and still for the life of me don’t understand why we’re not encrypting. Especially portable devices, but all devices in reality, why are we not encrypting things? Because if that laptop was encrypted, you don’t have to report it. If you emails have multi factor authentication and your employees are educated on what to look for in phishing, and you’re doing you’re taking mitigation steps, then guess what, you have a lot less than 22 email breaches. This is going to climb because of the covert 19 phishing attacks that are occurring. You’re going See, I can promise you march will be more email, email breaches for healthcare, I could just about guarantee it. That is our HIPAA education piece. Again, we shouldn’t be keeping pH I in email. I’ll get to that. Occasionally there might be a need to do that, but we shouldn’t be doing that. But we need multi factor authentication. We need to have phishing mitigation measures in place, and we need to educate our employees on what to look for. Oh, and we need to encrypt things. Alright, it’s time for the HIPAA breach roundup for the week. Not a lot. Again, I’m sure the HHS is is busy. But we have a few so Hawaii Pacific health has discovered an employee of Straub Medical Center in Honolulu has been stunning. looping on medical records of patients over a period of more than five years. Why Pacific health discovered the unauthorized access on January 17 2020, and launched an investigation and analysis of the access logs revealed. The employee first started viewing patient records in November of 2014 and continued to do so undetected until January 2020, some more than five years. During that time the employee viewed the medical records of 3772 patients. after concluding the investigation the employee was terminated. Effective patients had received treatment a stroke Medical Center Kapiolani Medical Center for Women and children Pali Momi Medical Center or Wilcox Medical Center. The types of information that the employee could have viewed included patient’s first and last names telephone numbers addresses email addresses dates of birth, race, ethnicity, religion, medical record numbers, primary care provider information, dates of service, appointment types and related notes hospital account numbers, department name provider names guaranteed names, account numbers, health plan names and social security numbers. The reason for access and records was not determined but Hawaii Pacific health believes it was out of curiosity rather than to obtain sensitive information for malicious purposes. However, data theft could not be rolled out. All patients whose record were accessed by the employee were notified by mail, March 17 2020. We’re offered one year of free credit monitoring and identity restoration services. The Minnesota based Senior Care Provider life Spark, which is spelled SP rk is notifying 9000 of its clients. That’s some of their protected health information was potentially compromised as a result of a November 2019 phishing attack. January 17 2020. Live spark no discover unauthorized individual had gained access to email account of one of its employees. The account was immediately secured and third party cybersecurity firm wasn’t gauged to investigate to breach the cybersecurity firm determined that a limited number of employee email accounts were compromised from November 5 through November 7. For the majority of affected individuals information in a compromised accounts was limited to names, medical record numbers, health insurance information and some health information. certain patients also had financial information and or their social security number exposed the investigation into the breaches ongoing. To date no evidence of data theft or misuse of protected health information has been found. Effective patients started to be notified on March 17 2020. The delay in sending notifications was due to unprecedented actions taken in response to kovat 19 individuals whose social security number was exposed have been offered complimentary credit monitoring and identity theft protection services. I have a couple of problems with this particular breach one is it says that one email account was compromised but then later on it says the compromised accounts So I don’t know if that was more than one. This, again is a case of no multi factor authentication, no phishing mitigation steps. The other problem I have is they did report in 60 days. So I’m not sure why they’re saying that the the delay was due to the unprecedented actions taken in response to cobit 19. But that’s just an excuse that should not be happening. And we really didn’t start feeling the effects of kovat 19 till early March. So I don’t know that that’s really relevant. University of Utah health announced on Friday that unauthorized individuals gain access to the email accounts of a limited number of employees between January 7 and February 21, and potentially access patients protected health information. University of Utah health discovered on February 3 2020, that malware had been installed on an employee’s workstation, which potentially gave unauthorized individuals access to patients protected health information, information stored in email accounts. On effect a computer was limited to names, birth dates, medical record numbers and some clinical information related to care provided by the University of Utah health. It is currently unclear how many patients have been affected by the breach and then the Oregon Department of Human Services has discovered an unauthorized individual gain access to the email account of one of its employees as a result of response to spear phishing email. Information Technology security processes had been put in place to detect email account compromises rapidly, which has limited to potential for data theft. The email account security breach was detected on March 6, and the account was immediately secured the Oregon DHS will be seeking assistance from third party entity to review the incident and determine what information has been exposed and how many individuals have been affected. Those individuals will be notified in due course, at this stage there’s no indication to any pH I has been accessed copied or misused. Out of the abundance of caution identity theft protection services will be offered to all affected clients. So it’s interesting to me that they have measures in place to catch it immediately. So it sounds like they noticed the the anomaly quickly and acted on it. But they don’t have doesn’t sound like they have multi factor authentication setup either. And it was spearfishing, so that makes me wonder Was it a high level executive that was potentially compromised. Alright, that is going to do it for this episode of the proactive it podcasts. So until next week, stay safe, stay secure and stay healthy everyone

Transcribed by https://otter.ai

The post ProactiveIT Ep 22 – The New Normal appeared first on Nwaj Tech - Information Tech & Cloud Support.

 Hi Everyone and welcome to the Proactive IT Podcast.  Each week we talk about the latest in tech and cyber news, compliance and more.  We also bring you real-world examples to learn from so that you can better protect your business and identity. 

This podcast is brought to you by Nwaj Tech – a client-focused & security-minded IT Consultant located in Central Connecticut.  You can find us at nwajtech.com.

 Thanks for listening to this podcast.  Show us some love on Apple or Google Podcasts.  Subscribe and leave us some positive feedback. What are you waiting for?

Also, go join the Get HIPAA Compliance Facebook Group.  Search for Get HIPAA Compliance

QOTW: Is there an app or software that can be used to send and sign PDF documents that is HIPAA compliant?

Google Chrome 80.0.3987.149 (Update)

Cyberattack on HHS meant to slow coronavirus response, sources say

FBI Warns of Human Traffickers Luring Victims on Social Networks

Researchers expose vulnerabilities of password managers

Cloud Database Leak Exposes 425GB of Small Biz Financial Data

Healthcare devices at higher cybersecurity risk now due to coronavirus

Topic 1: The EARN IT Bill Is the Government’s Plan to Scan Every Message Online

Topic 2:  Free tools and services for businesses during the COVID-19 crisis

Topic 3:  Netflix Party Lets You Watch Shows With Friends to Fight Isolation

OCR will ease restrictions on telehealth tech during COVID-19

https://www.hipaajournal.com/category/hipaa-breach-news/

Transcription (Unedited)

This is the proactive IT podcast this week the latest in it in cybersecurity news. Plus, it’s a strange new world. Lots of updates and patches. And should the government be allowed to scan our messages? This is Episode 21 Hi everyone and welcome to the productive it podcast each week we talk about the latest in tech and cyber news compliance and more. We also bring your real world examples to learn from so that you can better protect your business and your identity. This podcast is brought to you by wash tech a client focused and security minded consultant located in Central Connecticut, you can find us at and wash tech comm that’s NW Aj tech.com. Alright, let’s get into it. Times are changing and that is for sure. Right now things are upside down, inside out left, right up down, who knows. Things are definitely challenging right now. But we’re gonna, we’re gonna stick with the program. We’re gonna stick with the the outline here and continue to move forward. If you are listening to this, greatly appreciate it. We know you have other things you could be doing right now. But probably a lot less than normal at this point. If you could review or like or share or comment on on the podcast platform that you’re listening to this on, would really appreciate that share it out to social media so that other people can listen to it as well and learn from it. Because this is a teaching podcast as well. Also, if you are in a HIPAA compliant business, whether that’s a covered entity or business associate Go to Facebook in a search type in get HIPAA compliance and join that group because we share HIPAA information there all the time. And it’ll prove to be beneficial to your business as it grows in the HIPAA world. Things are very fluid in the world. And we’re going to talk about that in a little bit right now or in a little bit on this podcast. But first up the question of the week, is there an app or software that can be used to send in signed PDF documents? That is also HIPAA compliant? So the answer is there’s probably more than one, but I will tell you, the one that I would go with is DocuSign does have does have a HIPAA compliant function, and they will sign a business associate agreement. I don’t know the cost of that software for for HIPAA compliance purposes. I know most software’s charge more money when HIPAA is involved. So it probably costs more than our normal package. But DocuSign, which is a very reputable pieces of software I’ve used it for normal business purposes. Definitely worth a look as far as as far as sending and signing PDF documents that require HIPAA compliance. Along those lines. I also want to mention since I’ve been dealing with a lot of smaller practices, one man shops and so forth that have gone in doing, they’re doing the telehealth work now, zoom offers a package that is telehealth and HIPAA compliant. It says tell if that’s actually what they call it. So, so you can go to zoom.us and take a look at the features of that and believe there was a tab that said telehealth click on that and I’ve set up a couple of practices smaller practices today to be able to do or this week I should say to be able to provide telehealth services to their clients. That being said I’m going to talk about it a little more later. The Trump did relax Are the OCR did relax the the rules around telehealth. So, essentially, you could use pretty much anything at this point to provide telehealth services that I believe will be dangerous going forward. But for now, it is what it is. Patch Tuesday updates. So we had the Patch Tuesday updates that came last week are Yeah, last week, I think it was last week. It just feels like it’s been so long with everything that’s happened in the last week and a half. It feels like it’s been an eternity. I’ll be honest with you. It’s only been a week really since my kids have been out of school and it feels like it’s been an eternity. But so last week, Patch Tuesday rolled out. There was patches for of course for Microsoft Windows. It was an out of band patch for SMB v3, an RC remote code execution vulnerability, that Tom is causing a lot of issues on its own. There was a So that didn’t come out on Tuesday but it came out a few days later. Google had an update. And but not much else the world on fire. I think Firefox had an update to I’m not sure why I don’t have it on my show notes. But there wasn’t much else last week. Well, this week that’s changed. So this week, we have software updates from Drupal, Cisco. Cisco released security updates for SD win solution. Google, again, released updates to Google Chrome, so you should be on at point 149, Adobe released updates for Adobe Reader in Adobe Acrobat. VMware released updates, as well for multiple products. So a lot of updates this week. So get those patches applied. In addition to your Microsoft patches, I might hold out I mean, SMB v3 vulnerabilities is critical, considered critical. So I might be careful about holding out on that, but at the same time, I will be honest, I am I’m holding out on it because it is causing a lot of issues for for people right now. And that is going to do it for the Patch Tuesday update of the show. Deep portion of the show. Hold on for your news. All right, some of the week’s hottest news, we got abc news, reporting that suspicious cyber activity targeting HHS tied to Corona virus response. Sources say so the Department of Health and Human Services experienced confusion, suspicious cyber activity Sunday night related to its coronavirus response administration sources confirmed to ABC News Monday to suspicious activity. hhs was not a hack, but it may have been a distributed denial of service attack. DDoS according to multiple sources, the distinction is important because there was no apparent breach of the HHS system, which could interfere with critical functions of the lead agency responding to the coronavirus contagion a DDoS effort in this cost automated users called bots to overwhelm a public facing system in order to slow it down or even paralyze it. Officials believe any coordinated effort against HHS, if there was one was not particularly successful and are satisfied that the system was not significantly affected. Nevertheless, the concern is that foreign actors might attempt to explain to cope in 19 creases to achieve some of their anti American goals. So that is true. And you’re going to see an increased amount of activity against not just, you know, government, HHS, CDC and things like that. You’re going to see it against everybody to work from home, the massive amount of people that are working from home, we’re going to see an increase in activity targeted at those users as well. Because now they don’t have the support system. They have the support system but it’s not readily available at you know, right there. It’s not the same network it’s there’s there’s it becomes a little more relaxed at that point and I think you’re going to see an increased, you’re going to see increased activity in that in that area too. bleeping computer reported FBI warns of human traffickers luring victims on social networks FBI internet crime complaint center, I see three today issued a public service announcement on human traffickers continued usage of online platforms like dating, dating sites and social networks to lure victims. The FBI warns the public to remain vigilant of the threat posed by criminals who seek to traffic individuals to force fraud or coercion through popular social media and dating platforms that PSA says offenders often exploit dating apps and websites to recruit and later advertised sex trafficking victims in addition offenders are increasingly recruiting labor trafficking victims through what appears to be legitimate job offers. According to FBI investigations victims from various different backgrounds from rural areas to large cities are being lured by human traffickers also forced labor into forced labor or sex work. Using online platforms, many cases the criminals who will pose as legitimate job recruiters or agents of employment agencies and will bait the potential victims with the promise of fake employment and a better life. Individuals who share personal information on online platforms are the ones most likely to be targeted by such criminals, especially after posting about financial hardships, their struggles with low self esteem or their family problems. So why am I sharing this now? I think it’s important to note that we’re going to see some of that increased too. You’re going to see people share that, you know, financial hardships because they’re not working now. And potentially from family issues and low self esteem issues. We’re going to see more of that. So you may see an increase in, especially with, you know, with a lot of companies laying off at this point. job offers that aren’t real job offers, so be careful Be careful what you’re sharing Be careful what you accept. And what you do with with the information that you get. Tech explored in is te ch x PLR e.com, researchers expose vulnerabilities of passwords managers. Now this article doesn’t point out any specific Password Manager but I’ll still go through it. security experts recommend using a complex some commercial password managers sorry some commercial password managers may be vulnerable to cyber attack by fake apps new research suggests security experts recommend using a complex random and unique password for every online account, but remembering them all would be a challenging task. That’s where password managers come in handy. encrypted vaults access by a single master password or PIN is store and autofill credentials for their user and come highly recommended by the UK National Cybersecurity center. However, researchers at the University of New York have shown that some commercial password managers may not be watertight way to ensure cybersecurity. After creating a malicious app to impersonate a legitimate Google app, they were able to fool two out of five of the password managers that tested into giving away a password. The research team found some of the password managers use weak critical criteria for identifying an app, and which username and password to suggest for autofill. The weakness allowed the researchers to impersonate a legitimate app simply by creating a rogue app with an identical name. Senior author of the study Dr. Samak Shonda shahana just I can’t say that sorry, sh a na SHHNDSTA sH h A and D a ‘s HDI from the Department of Computer Science in the University of Oxford you vulnerabilities in password managers provide opportunities for hackers to extract credentials, compromise a commercial information or violating employee information, because there are gatekeepers to a lot of sensitive information, rigorous security analysis of password managers is crucial. And it goes on to talk about the study. So here’s what I’ll tell you. I don’t know which two they’re referring to or which five they tested, I could guess, but I don’t know. If you’re using a password manager, you should be using multi factor authentication as well. And biometrics whenever possible. If you’re if, if your password manager doesn’t have those options, then you should be moving to a different Password Manager anyway. recorded on the geek app by alien skills. So this is the alien skills comm cloud database leak exposes 425 gigs of small business financial data. And I think I saw another breach. Another similar. I wouldn’t call it a breach but I guess a leak. over half a million highly sensitive legal and financial documents have been leaked online by us loans company after another cloud configuration error. security researchers that VPN mentor led by Noam wrote them found the database in an unsecured Amazon Web Services. That’s AWS for sure. So s3 bucket at the end of December. It appears to be linked to a smartphone app known as MCA wizard developed by New York based fintechs. Advantage capital funding in August capital funding which VPN mentor claimed were likely owned by the same company. They are said to provide merchant cash advances Cassatt yeah merchant cash advances wow I cannot talk today Sorry, sorry people. merchant cash advances controversial, high interest loans for small businesses startups, which you should probably stay away from anyway. But however, although the database URL contains the words MC wizard the app is no longer available in almost files bore no relation to the project. Even as the researchers discovered and tried to contact the firms without success, new files were apparently being uploaded to the database. 425 gig Trove contain highly sensitive customer information Including credit reports, bank statements, driver’s licenses, Social Security info, tax returns, scan checks, purchase orders and much more. With this information, attackers could launch highly convincing phishing attacks attempt check and financial fraud target victim companies and malware, or even sell the data on the dark web born VPN mentor which is becoming more and more popular by the way. The leak could even be investigated under the new California consumer Privacy Act ccpa if it claimed, which means now they’d be subject to potential lawsuits from that this leak raises serious credibility and trust issues for advantage in August. By not sufficiently securing this database and revealing so much information they have compromised the safety, privacy and security of their clients, partners and customers. The firm said those affected may take action against advantage it argues for doing so either from ceasing to do business with either company or possibly pursuing legal actions. Both would result in considerable loss of clients contracts, business relationships and Ultimately revenue. After receiving no reply from the database owners, the researchers went directly to AWS, which promptly corrected the privacy snafu on January 9, so another misconfigured AWS s3 bucket and you see the results, not not not a good thing. I mean, you need to have qualified people managing your AWS, three buckets, s3 buckets. And then finally, techrepublic, much of the US healthcare system is running on outdated, outdated software unsupported operating systems such as Windows seven, leaving devices vulnerable to hackers actively exploiting the kernel virus. So we know there’s going to be we’ve talked about this for weeks now there’s going to be an increase in cyber attacks. Because of Corona virus. Corona virus right now has everybody’s attention. And so there’s going to be a huge increase already has been a huge increase in in attacks. And you have these vulnerable machines. And so the numbers are here in this article here. Even as Coronado continues it’s unrelenting spread across the country and no, it’s more than half country and hospitals are gearing up for what is expected to be a massive influx of sick patients. They are on the backfoot when it comes to cybersecurity according to research from Atlas VPN 83% of healthcare systems are running on outdated software. Atlas based part of the findings on Palo Alto Networks survey of 12 or I’m sorry, 1.2 million Internet of Things devices used in thousands of healthcare organizations across the US. palo survey found that 56% of devices are still running on Windows seven operating system systems which Microsoft stopped supporting in January. Due to the Cova 19 outbreak hospitals are using patient monitoring devices more than ever said Rachel Welch Atlas VPN CEO. Research shows that one in four such devices have security issues based on these numbers. Atlas VPN estimates that cyber criminals will be focusing on the healthcare sector in 2020. Today, 16% of imaging systems are at a 51% risk of getting hacked. There is 26% Chances are that 40% of patient monitoring tools will get attacked. The research also found that 27% of medical devices are still running Windows XP or decommissioned versions of Linux OS. I mean, that’s 27% of medical devices are still weren’t running Windows XP. Atlas also reports that in 2019, the number of stolen medical records increased by 65%, impacting 40 million Americans. Even if you do not upgrade to Windows 10. Your device will continue to operate normally, set outlets but you will no longer receive essential security updates or bug fixes, meaning your device becomes vulnerable to various security threats. Given the severity of the corona virus threat and the act of targeting of healthcare organizations by hackers looking to cash in using ransomware more than 40% of healthcare executives were planning to improve their cyber security measures in 2020. Now, that was probably a quote before all this stuff happened. But still, this leaves many digital medical devices vulnerable today as engineers responsible for maintaining or maintaining these devices often do not receive proper training or resources to ensure best safety practices are being filed. cyber criminals have been using the situation to their advantage since the beginning of coronavirus spread Atlas said, for instance by creating fake coronavirus maps, they were able to trick people into downloading malware into their devices. It was only a matter of time before hackers began to take a step further by exploiting the vulnerabilities lying in the US healthcare system. Those maps By the way, if you go to coronavirus Jay chou.edu slash map dot html that is a legitimate map. They’re using that map to cover up malware. Not john hopkins but malicious attackers are using dat map to cover malware on other websites. So if you’re going to use look at this map, then the best one is the address I just gave this coronavirus Jay Chou. edu slash map dot html All right, our first hot topic of this podcast this week, they earned it bill is the government’s plan to scan every message online. So kind of important for you to listen to this because, you know, either whatever side of the of this you fall on, it’s important that you Your voice is heard. So imagine an internet where the law required every message sent to be read by government approved scanning software companies that handle such messages wouldn’t be allowed to securely encrypt them, or they lose legal protections that allow them to operate. So what does that mean? So you might you might remember the the, or the Patriot Act, I think it was called that was some that allowed the government to scan, text messages and so forth. You phone calls. And they basically they listen to they listen for certain, certain buzzwords, I guess you could say. I don’t think the debt Patriot Act is in effect anymore. I’m not sure. Not a lawyer and I don’t really follow those things too carefully. But this bill is sort of similar in that it would scan online messages and those messages through Whatsapp, Facebook Messenger, Telegraph, or todos a telegraph or telegram. Things like that. And so they’ll be allowed to scan those messages. And they’re telling those vendors so we all WhatsApp if you don’t know WhatsApp is supposed to be secure. It’s encrypted, end to end encryption. And so nobody is supposed to be able to eavesdrop on those conversations, although it has happened. The US government is saying we don’t want WhatsApp to have that capability. So that’s what the Senate Judiciary Committee has proposed and hopes to pass into law the so called earn it and it’s er n and then it bill sponsored by Senators Lindsey Graham, Republican of South Carolina and Richard Blumenthal democrat of Connecticut. So I’m in Connecticut obviously. Richard Blumenthal is is the center here in Connecticut. This will strip section 232 30 protections away from any website that does not follow a list of best practices, meaning those sites can be sued into bankruptcy. The best practices lists will be created by a government commission headed by Attorney General Barr, who has made it very clear he would like to be an encryption and guarantee law enforcement legal access to any any digital message. earn it bill has had its first hearing today. And so this was written on the 12th. So it had its first hearing today and his supporters tried to support support a strategy is clear because they didn’t put the word encryption in the bill. They’re going to insist it doesn’t affect encryption. This bill says nothing about encryption co sponsor senator Blumenthal said it at today’s hearing. Have you found a word in this bill about encryption? Yes, one witness. It’s true that the bills authors avoided using that word but they did propose legislation that enables an all out and saw a saw on encryption. It would create a 19% commission that’s completely controlled by the Attorney General and law enforcement agencies in at the hearing a vice president at the National Center for Missing and Exploited Children. And CNBC made it clear what he wants the best practices to be. And CNBC believes online services should be made to screen their message from material that CMHC considers abusive. Use screening technology approved by NCM mec and law enforcement report what they find in messages to NC mec and be held legally responsible for the content and messages sent by others. That’s kind of dangerous. You can’t have an internet we’re missing. are screened in mass and also have end to end encryption and more than more than you can create backdoors that can only be used by good guys. The two are mutually exclusive concepts like client side scanning aren’t a clever route around as such scanning is just another way to break end to end encryption. Either the message remains private to everyone but its recipients or it’s available to others. The 19% draft commission isn’t any better than the 15% Commission and vision and an early draft of the bill. It’s completely dominated by law enforcement and allied groups like NC mec. Not only will those groups have a majority of the votes in the commission, but the bill gives the Attorney General Barr the power to veto or approve the list of best practices. Even if other commission members do disagree with the law enforcement bars veto power will put him in a position to strong arm them. The Commission won’t be a body that seriously considers policy will be a vehicle for creating a law enforcement wish list. bar has made clear over and over again that breaking encryption is at the top of that list. Once it’s broken authoritarian regimes around the world will rejoice as they have the ability to add their own types of mandatory scanning not just for child sexual abuse material but for self expression that those governments want to suppress. The privacy and security of our all users will suffer if US law enforcement is able to achieve a stream of breaking encryption. Senators should reject to earn it bill. So I read this on e ff.org. That’s the electronic I forget what e FF stands for Electronic Frontier Foundation, and they’re the ones that led to the fight against other other things on the internet front. In the past. If you would prefer to take action you can do that from that website ff.org and it is the earn it bill. also given our current state of affairs in this country, I have a post that on health IQ healthcare IT news, OCR will ease restrictions on telehealth tech during At 19 the privacy watchdog won’t impose penalties on providers who use non HIPAA compliant remote communications technology during the public health emergency. I personally think this is risky move on, I get why they’re doing it. I don’t think it’s a good idea. The HHS Office of Civil Rights, announced on Tuesday that during the coronavirus pandemic it will use discretion when enforcing HIPAA compliance for telehealth communication tools. Even though some of those technologies may not fully comply with HIPAA requirements, OCR says it will not impose penalties for non compliance with the regulatory requirements under the HIPAA rules against covered healthcare providers in connection with the good faith provision of tele health during the Cova 19. Nationwide public health emergency covered entities seeking to use audio or video communication tech to reach patients where they live can use any non public facing remote communication product that is available to communicate with patients to the agency this exercise have discretion applies to tell the provider for any reason, regardless of whether the telehealth service is related to the diagnosis and treatment of the health conditions related to kovat 19. To help broaden use of remote consult consults during the outbreak, OCR says providers will temporarily be allowed to use applications such as Apple FaceTime, Facebook Messenger video chat, Google Hangouts, video or Skype. OCR does does know, however, that healthcare providers should notify patients that such third party apps may pose privacy risks. In addition, providers should enable all available encryption and privacy modes when using each application or such applications. The agency also specifies that Facebook Live twitch Tick Tock other paper public facing video communications should not be used in provision of telehealth so should not go live and share your telehealth session with other people. If that’s not abundantly, obvious already, whenever, wherever possible, providers should use telehealth tools from vendors that are HIPAA compliant. Enter into business associate agreements set OCR so that means it is obviously temporary. And if you can, you should still be using those. And as I mentioned earlier in this episode zoom is a great tool for that. While specifying that is not that it is well specifying that it is it has not reviewed the bcaas offered by these vendors and this list does not constitute an endorsement, certification or recommendation agency lists companies that claim HIPAA compliance and willingness to sign vas including Skype for Business, which is which is another tool I’ve suggested to healthcare providers and that’s through office 365. Up Doc’s vs CS zoom for healthcare doc see me and Google G Suite hangouts meet how telehealth is in the spotlight as the coronavirus crisis unfolds offering an essential link between patients and physicians while removing the need to travel to overburden hospitals on Tuesday Centers for Medicare and Medicaid Services. expanded its Medicare telehealth coverage during the Cova 19 pandemic to enable more patients to get virtual care services from their providers. physicians, nurse practitioners, clinical psychologist and licensed clinical social workers can now offer telehealth to Medicare beneficiaries in any healthcare facility, including a physician’s office hospital, nursing home or rural health clinic as well as from their homes according to CMS. We are empowering medical providers to serve patients wherever they are during this national public health emergency said OCR director register every no in a statement. We are especially concerned about reaching those most at risk including older persons and persons with disabilities. So we’ve always said to hip is about patient care. And if you’re in the business of health care, then you’re supposed to care about your patient. So there is this there relaxing the rules around telehealth for now. Don’t expect it to last it will not last and when it does, be prepared to switch back to normal HIPAA compliant methods of conducting business in in healthcare we have a little good news I guess in this saw time of pandemic in isolation and so forth. bleeping computer reports Netflix party lets you watch shows with friends to fight isolation. Feeling lonely during the period of social social isolation or self quarantine, a Chrome browser extension lets you binge watch your favorite Netflix shows with friends and family while text chatting with them with social interaction at a minimum during the Cova 19 outbreak. People rightfully feel cooped up and lonely dirt due to not being able to do anything with difference, if free Chrome browser extension called Netflix party may help bring a little social interaction back into your life. Netflix party allows friends and family to watch the same show together while providing a text chat room experience. To use this browser extension. Each user must be logged into Netflix and have the Netflix party extension installed. A user can Then started Netflix video posit, and click on the MP button in the chrome omnibar to create a link that will that can be shared with others. When creating this group as I suggest you make it too, so only the group creator can control the video playback so that other people do not pause the video whenever they want. When another user with Netflix party clicks on the shared link, they will automatically be brought to the Select a video in a chat room will be shown on the right side of the screen. This chat allows you to set your name, use one of the few available avatars and chat with other while you are watching the show or moving. The group creator can then start the show and pause it as needed, and a show will start and pause on the other party members computers. In bleeping computers test the process works very well but there will be a slight delay between the person controlling the video and others who are part of the party. And our test is only caused about one to two second delay. It should be also noted that this extension does track your activity and what Netflix shows you watch but we’ll talk This data to your anonymous Netflix party ID, if this does, if this does not bother you, the Netflix party may be great way to watch a show or movie with some friends to ease the social isolation. So there’s an attempt to kind of deal with the social isolation of social distancing or calling it whatever you want to call it, there’s a there’s an attempt to deal with that. So that’s good news. I would also recommend using something like Facebook Messenger or zoom to maybe have group meetings, we’re doing it for for our business networking groups as well. But this way, you’re not completely cut off in the world. And you have some social interaction with the outside world during this time. So that’s another thought. I’ve shared some of the tips of things you could do. I mean, it’s a great time to do spring cleaning and yard work and whatever because if you’re not going anywhere else, you may as well get it done right, because eventually this will stop and then you’ll wish you had done it. All right, our HIPAA education for the week, we’re going to talk about it’s timely. So, OCR will ease restrictions on telehealth tech during cobit 19. The Privacy watchdog won’t impose penalties on providers who use non HIPAA compliant remote communications technology during the public health emergency. And I did it an Instagram TV about this a few days ago. So if you follow the watch tech on Instagram and wha tech, you’ll see that it’s Apple’s latest, the most recent post on there as well. So watch Instagram TV for us. And you’ll see you can see what I talked about but I’ll talk about it here to the HHS Office for Civil Rights announced on Tuesday that during the coronavirus pandemic it will use discretion when enforcing HIPAA compliance for telehealth communications tools. So telehealth just means you’re providing the healthcare service. as you would normally provide in person, you’re providing an over a platform like zoom or, in this case you can use Facebook Messenger or FaceTime. But zoom and Skype for Business are usually the two most common platforms to do that with. Even though some of these technologies may not fully comply with HIPAA requirements, OCR says it will not impose penalties for non compliance with the regulatory requirements under the HIPAA rules against covered health care providers in connection with the good faith provision of telehealth during the Cova 19 nationwide public health emergency. So that is an actual statement. It is important to understand that it is only during the nationwide public health emergency. So once that subsides then you will be required to go back to doing things the way you’re supposed to do it under HIPAA covered entities seeking to use audio or video communication tech to eat to reach patients where they live can use any non public facing remote communication product that is available to communicate with patients. So the agency of this success exercise of discretion applies to telehealth provide for any reason regardless of whether the telehealth services related to the diagnosis and treatment of health conditions related to Cova 19. So, the health treatment doesn’t need to be related to cobit 19. It could be anything. You know, if you’re a therapist and you want to apply, you want to you want to be able to practice remotely, you can use telehealth. To help broaden the use of remote consults. During the outbreak. OCR says providers will temporarily be allowed to use applications such as Apple FaceTime, Facebook Messenger, video chat, Google Hangouts, video, or Skype. OCR does Note however, that healthcare providers should notify patients that such third party apps may pose privacy risks or they’re not as secure as as the ones that have been approved. In addition, providers should enable all available encryption and privacy modes when using such applications. The agency also specifies that Facebook Live twitch Tick Tock and other people public facing video communications should not be used in provision of healthcare. So in other words, you can’t go on Facebook Live because people are going to see it that’s broadcast out to the public and the same for Twitch and tik tok and so forth. And I forget what I forget what Twitter’s version is, but Twitter and Instagram Live. Those things are public facing people are going to see wherever possible providers should use telehealth tools from vendors that are HIPAA compliant and will enter into a business associate agreements at the OCR and so they have a list here but I will tell you zoom is probably the best one and then Skype for Business being the next so while specifying what is not, has not reviewed to be as offered by those vendors, and this list does not constitute an endorsement, certification or recommendation to agency list companies that claim a HIPAA compliance and willingness to sign vas including Skype for Business up Doc’s vs. e. Soon for healthcare. Doxey me and Google G Suite hangouts meet telehealth is in the state. Life as the coronavirus crisis unfolds offering an essential link between patients and physicians while removing the need to travel to overburdened hospitals. On Tuesday, Centers for Medicare and Medicaid Services expanded its Medicare telehealth coverage during the cobit 19 pandemic to allow to enable more patients to get virtual care services of their from their providers. physicians, nurse practitioners, clinical psychologists and licensed clinical social workers can now offer healthcare to Medicare beneficiaries in any healthcare facility including a physician’s office hospital, nursing home rule Health Care Clinic, or the actual home. According to CMS. We are empowering medical providers to serve patients wherever they are during this national public health emergency said OCR director Roger Severino, his statement. We are especially concerned about reaching those most at risk including older persons and persons with disabilities. You’re going to see an increase in mental health issues with isolation, I can promise you that. So you’re going to want to if you’re in therapy, psychiatry, psychology, whatever, you’re going to want to be able to offer telehealth services so that you can reach those that need the the guidance set at that time as well. That being said, it concerns me a little bit that we’re doing this because I did set up some some of my clients to be able to do this through the proper channels. So they’re all set up on zoom for healthcare zoom is called telehealth on the zoom site. And yes, it cost a few dollars, but they’re doing it the right way. Because what’s going to happen is when they when they when the pandemic ends, they’re going to have to go back to normal routine. And when that happens, you’re going to have patients that have gotten used to you facetiming them or Facebook messaging them. And that’s going to going to be a problem for you and your practice because then only takes one complaint It only takes one complaint, and then you’re going to be looking at a problem. Most likely the OCR would come in and say, give me some technical advice, tell you what to do. But then if you continue, then you’re looking at trouble. The other concern I have is that I’ve heard people say that, you know, there’s no HIPAA now, the HIPAA has gone out the window. No, that is not true. All of the rest of HIPAA is still in place. We cannot divulge pH I, for any reason. If you get hit with a phishing attack or ransomware, attack, whatever, you’re still obligated to report it. The other HIPAA rules have not been relaxed. It’s only the rules around telehealth. Right, it’s time for our HIPAA breach report. And as I’m recording this, I’m going to check one last time but there have been no HIPAA breach reported. HIPAA breaches reported in probably close to two weeks now primarily because the HHS is busy with the corona virus outbreak so and as I say that there is a post here of roundup of recent healthcare data breaches so let’s go through it. Texas network of walking clinics attacks with maze ransomware afford to care, Urgent Care Clinic and network of walking clinics in Texas has been attacked by the maze ransomware gang. According to a recent report on data breaches net. The hackers stole 40 gigs of data prior to encrypting files. Some of the stolen data was published online when afford to care refuse to pay the ransom. published data included patient contact details, medical medical histories, diagnosis billing information, health insurance information and employee payroll data. It is currently unclear how many patients have been affected as the breach has not yet appeared on HHS OCR breach portal. So doesn’t it Doesn’t list the date as to when it happened. tandem diabetes care Inc and San Diego California has been targeted by cyber criminals who gain access to the email accounts of a limited number of of its employees between January 17 2020 January 23 of 2020. The attack was discovered in January 17 and cyber security firm was engaged to assist with investigation and analysis of the compromised accounts revealed it contain patients names, contact information, clinical information related to diabetes care, and information about customers use of tandems products and services in limited number of social security numbers may also have been compromised. Of course, to enemas, enhancing email security controls, but a little too little too late. When multiple accounts are compromised. That just means there is no phishing mitigation in place, and there is no multi factor authentication in place. The Cambridge Massachusetts based provider for genomic profiling services foundational medicine has discovered the email account of employee has been compromised as a result as a result of response to phishing email The incident was discovered on January 14, a third party forensics firm was engaged to conduct an investigation and determined the email account was accessible between December 17 and January 14, so almost a month. During that time an authorized individual unauthorized individual potentially access patient information in the email account, which included patient names dates of birth, ages test names, ordering physicians names, FM, FM AI ID numbers. foundational medicine has notified all affected patients and additional security awareness training has been provided in the workforce. So no indication of how many people there either random and I center in North Carolina has experienced a ransomware attack that affected a server containing patients protected health information. The attack was detected on January 13 2020, and a third party computer forensics firm was retained to assist with the investigation. The investigation is ongoing but the investigators have determined patient information was acquired. cryptid in the attack and could potentially have been accessed by the attackers, the server contains names dates of birth genders and digital retinal images. Towards Memorial Medical Center in California has discovered a server used by third party, radiology, vendor and security protections removed. That allowed certain patient information to be accessed by unauthorized individuals so Oh, okay, so I read that wrong so let me read it again towards medical health center in California has discovered a server used by a third party radiology vendor had security protections move that allowed certain patient information to be accessed by unauthorized individuals. tsmc was notified about the potential data breach by its radiology vendor on January 6. The investigation revealed protections were accidentally removed on June 20. So six months worth and server could be accessed by unauthorized individuals up to December 13 2020. The risk to each patient is believed to be low as radiology images are only stored on a server For a short period of time, every 24 hours images on the server are automatically deleted. However, over the course of six months, the server temporarily stored the medical images of 3448 patients. Those radiology images including names, dates of birth, gender, a session, number of medical record number and referring physician names. And then on January 16 2020, genuine dead took care in Saratoga, California discovered thieves had broken into its offices in installing a server that contained the protected health information of 2190. Day 90 patients data on the server required multiple passwords to be entered in order for patient information to be accessed over it is possible that these access to patient data well, so this means it wasn’t encrypted. If they’re reporting it, it means it wasn’t encrypted. And if it’s not encrypted, it doesn’t matter if you have passwords or not. patient information stored on the server including names, addresses, telephone numbers, social security numbers, driver’s license numbers, health insurance information, dental records, and some financial information including credit card numbers. Genuine dental care Also reports that medical images of certain patients that received dental treatment between June 2018 and January 2020 have been permanently lost. The incident was reported to the San Jose police department which is conducting an investigation. Genuine dental care has taken steps to improve physical security. And additional technical controls have been implemented to further protect patient data. I feel like we’ve talked about this before, because first of all, it’s a dentist. And so, again, just just reiterate that what I’ve been saying for months now that dentists are supposed to be covered under HIPAA. But more importantly, you didn’t encrypt your server. And you can say you have passwords all you want. It’s not hard to grab information off of a server, even if you don’t have the password. If the data is not encrypted, it’s very easy to do. So you’re left your patients data exposed on a server, probably thinking nobody’s gonna walk out here with a server but somebody did. Alright, that is going to do it for the HIPAA breach report. Surprised breach report because they hadn’t reported anything since the ninth so it’s been 11 days. So but that is going to do it for the HIPAA breach report and that is going to do it for the productivity podcast. So until next week, stay safe, stay secure and stay healthy.

Transcribed by https://otter.ai

The post ProactiveIT Ep 21 – It’s a Strange New World appeared first on Nwaj Tech - Information Tech & Cloud Support.