Endpoint Security , Events , Governance

Jigar Kadakia of Partners HealthCare on How to Resolve Access Issues for Medical Professionals(SecurityEditor) • July 5, 2019     Jigar Kadakia, CISO & CPO, Partners HealthCare

The traditional IAM strategy has been to tie individual users with a unique device. But that doesn't work in healthcare settings, where doctors and nurses often share multiple devices. Jigar Kadakia of Partners HealthCare talks about how he approaches this critical challenge.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

In an interview recorded at ISMG's NYC Healthcare Security Summit, Kadakia, the CISO and CPO at Partners, discusses:

The unique healthcare IAM challenge; Why privileged access is particularly thorny; How he has addressed these issues in his security and privacy roles at Partners.

Kadakia has more than 17 years of information security experience across multiple industries, with a focus on health care delivery and projects such as HIPAA/HITECH assessments, Meaningful Use assessment, ICD-10 related implementations, privacy program assessments and implementations, IT internal audit, and business associate risk management. Kadakia has spoken at many security and privacy forums/roundtables/conferences, and is a leader in the health care information security and privacy space. He has a Bachelor of Science degree in Chemical Engineering from the University of Cincinnati and a Master in Business Administration from Xavier University. He is CISSP, CIPP and HITRUST Certified. He is also certified in Risk and Information System Controls.

Cybercrime , Fraud Management & Cybercrime , Ransomware

As More Victims Pay, Experts Warn of Criminals Becoming Further Emboldened(euroinfosec) • July 5, 2019    Photo: WorldSkills UK via Flickr/CC

Britain's biggest provider of forensic services has paid a ransom to attackers who crypto-locked its systems with ransomware, the BBC reports.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Eurofins did not immediately respond to a request for comment. The private testing firm provides DNA testing, toxicology analysis, testing of firearms as well as digital computer forensics for many British police forces.

Officials warn that the ransomware outbreak has led to delays in police investigations and court cases and that the full effect remains unknown. In the wake of the outbreak, British police forces suspended or dramatically curtailed their use of Eurofins and begun routing high-priority DNA and blood sample testing to other private forensic service providers. The incident follows the U.K. government in 2012, in a widely criticized move, closing its own Forensic Science Service, which supported England and Wales, and opting instead to rely exclusively on private firms.

Security experts say the ransom payment by Eurofins appears to be part of an alarming trend involving ill-prepared organizations failing to invest in proper defenses and then paying attackers for the promise of a decryption key (see Second Florida City Pays Up Following Ransomware Attack).

Legally speaking, both Britain's National Crime Agency as well as the FBI have said that it's up to organizations and individuals in the U.K. and U.S. to decide whether to pay. But both have urged potential ransomware victims to better prepare rather than to ever have to consider paying.

"I'm amazed Eurofin have paid up," Alan Woodward, a professor of computer science at the University of Surrey, tells Information Security Media Group. "Compare and contrast with St. John Ambulance. With the payments being made in the U.S., I worry they are emboldening the criminals, it's no wonder this is still the biggest form of cybercrime."

In contrast to Eurofins, St. John Ambulance, a charity organization that teaches and provides first aid and emergency medical services, this week issued a statement saying it had been hit by ransomware. The organization did not pay a ransom.

"At 9.00 a.m. on Tuesday, July 2, St John Ambulance was subjected to a ransomware attack. This has not affected our operational systems and we resolved the issue within half an hour," the organization says in a statement.

"This means that we were temporarily blocked from accessing the system affected and the data customers gave us when booking a training course was locked," it adds. "We are confident that data has not been shared outside St John Ambulance."

St John Ambulance says it's informed police about the attack, as well as Britain's privacy watchdog, the Information Commissioner's Office - Britain's privacy regulator - as well as the Charity Commission.

Police Recommend: Prepare, Don't Pay

Warnings against paying attackers are longstanding. As Christopher Stangl, then section chief of the FBI's Cyber Division, told ISMG in 2016: "Payment of extortion monies may encourage continued criminal activity."

It's unclear when Eurofins may have paid the ransom. On Monday, June 3, it announced that the prior weekend, its systems had been hit by ransomware.

On June 24, Eurofins reported that by June 4, "we were able to resume full or partial operations for a number of impacted companies and have continued to do so every day since then." By June 17, it says, "the vast majority of affected laboratories' operations had been restored," and by last week, "the production and reporting IT systems of essentially all those that remained became operational again."

The organization says it expects to complete full systems restoration by the end of next week.

Essential Ransomware Defenses

Woodward says organizations need to be better prepared to block and respond to ransomware attacks.

"There's so much good advice out there on how to mitigate and respond to these incidents, why are so many still ill prepared? And why are the insurers still paying up? There must be a point very soon where the insurers will say: 'No more.'"

For guidance, Woodward says all organizations should implement best practices for protecting organizations against ransomware, as well as for protecting systems against malicious Microsoft Office macros, issued by Britain's National Cyber Security Center. The NCSC is the public-facing arm of intelligence agency GCHQ, and is the lead government agency for incident response (see Police and NCSC to Breach Victims: We Won't Tell Regulators).

Examples of good security practice that the NCSC recommends to defend against ransomware include:

Defending against phishing attacks Vulnerability management and patching Controlling code execution Filtering web browsing traffic Controlling removable media access

"It's all about mitigation as a first line and then having an incident response plan and capability," Woodward says (see Wipe Away the Threat of Wiper Attacks).

Many organizations already have easy access to these types of capabilities, if they would only configure their systems correctly, including when it comes to managing Microsoft Office macros, Woodward says.

"The sad thing is that there are solutions already in place they just need to be configured. Things like preventing lateral movement with networks, preventing macros in emails," he says. "Imagine you're running a Microsoft Active Directory-based IT estate. It has what you need, you just have to put the correct policies in place, and segment your network appropriately."

Similarly, he says locking down organizations against macros is a simple process.

"There is a lot of misunderstanding about policies and macros," he says. "Some believe it will affect all those using macros - such as the finance department. Some think it will take a long time to configure. But that is not so."

Events , Infosecurity Europe Conference

• July 5, 2019    

Welcome to ISMG's compendium devoted to the hottest topics and most compelling speakers from Europe's premier cybersecurity event. Spanning insider threats and nonstop data breaches, to the latest business-efforts to arrest fraud, malicious insiders and advanced hack attacks, and much more, we have you covered.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

As a media sponsor of Infosecurity Europe 2019, ISMG was at the center of the dialogue both at and around the event.

Once again, we returned to the Infosecurity Europe show floor with an open studio amidst the exhibitors and myriad attendees. Sitting down with dozens of the industry's leading vendors, practitioners and influencers, we gathered expert insight into the cybersecurity topics and strategies that matter most today.

All told, we conducted more than 40 exclusive video interviews with a selection of the industry's top thought leaders, including CEOs, CISOs, analysts, researchers and educators.

Conference keynote speaker Troy Hunt, founder of the Have I Been Pwned? service, analyzed for us the nonstop rise of data breaches. Distinguished security researchers - including Raj Samani, Chester Wisniewski and Tod Beardsley - detailed the latest threats and how business must respond. Other leading technology thinkers shared the latest on business adoption of machine learning and artificial intelligence, the quest to block privileged account takeovers and phishing attacks, techniques for securing supply chains, and among many other topics, digital transformation, automation, DevSecOps as well as the growing use of red teams and bug bounties.

As the preeminent cybersecurity conference in the region, Infosecurity Europe again cemented its reputation as being the place where those in Europe and the United Kingdom come to talk cybersecurity. Dive into the pages that follow for highlights from the discussion.

Download Compendium

Endpoint Security , Events , Governance

Jennings Aske of NY Presbyterian is Encouraged by Manufacturers' Steps(SecurityEditor) • July 5, 2019     Jennings Aske, CISO, New York-Presbyterian

Encouraged by the moves of medical device manufacturers, Jennings Aske, CISO of NY Presbyterian Hospital, says the "state of the union" of medical device security has improved dramatically. But what more is needed to mitigate risks?

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

In an interview recorded at ISMG's NYC Healthcare Security Summit, Aske discusses:

How medical device security has improved in the past year; How his organization has addressed the issue; Whether patients should play a future role in device security.

Aske is the CISO for New York-Presbyterian. Prior to this he was VP Information Security & Chief Security Officer of Nuance Communications as well as Chief Information Security and Privacy Officer of Partners HealthCare. Prior to Partners, Aske was the Chief Information Security Officer for UMass Memorial Hospital. Aske was also the Chief Information Security Officer for the Commonwealth of Massachusetts's Executive Office of Health and Human Services, responsible for coordinating information security across the 16 state agencies. Aske is a licensed attorney in the Commonwealth of Massachusetts.