63. Aja Anderson: "As long as people can make money, they're gonna keep [attacking]. As long as your systems are not secure, you're at risk."

Episode 63 of HIPAA Critical features a discussion with Aja Anderson on this month's Paubox HIPAA Breach Report.

Rather read?

Aja Anderson: Thanks for having me once again. No surprise, very often I say this, I'm going to say it again: Network servers were the vector that we saw the most folks affected. But slightly surprising this month, we did see the most incidences of data breaches happening with email.

Aja: Definitely. 

Those incidents were mainly about credential harvesting. Those are phishing attacks, where somebody writes to you and says, “Hey, your password needs to be updated.” And it looks like it's coming from Microsoft, or Amazon or something like that. It’s fake. Watch out for those. 

It's been something that we've seen a lot more of over the summer and into the fall. And there are two types that I'm seeing. 

One is the fake credential update that you're prompted to do. And then the other one looks like an invoice that you're being sent from Amazon or your security [software] saying, “Thanks for your purchase of X amount. If you think this is an error, no worries, just give us a call and give us your credit card information.”

Aja: It's too bad. 

I didn't know. I looked at a couple of different sources on this. They said they didn't access electronic records, but there was PHI in those emails, and ultimately, the total impact is unknown. 

You know, they're reporting in the hundreds of thousands, but they can't say how many people yet. There's kind of a trailing effect. They've offered credit and identity theft monitoring for the next two years. 

So they're expecting there to be some fallout from this indefinitely. And I did see that there's a class action investigation that's been opened into this.

Aja: I was trying to look up that domain. There are so many different professional dental alliances in different states. I couldn't find a master domain. 

I'd be willing to bet it was Microsoft, though because I did check for UMass Memorial Health Care. That was the biggest single email breach and the Eskenazi Health, the largest network server breach. Both of those organizations are using Microsoft. 

And as we know, Microsoft is the place that most of the attacks are happening. So I'd be willing to bet that PDA is also Microsoft.  

Aja: You know that I love the Health IT Security newsletter, and the one thing that I noticed since the last time we talked was that the same threat actor that was involved in a SolarWinds attack, Nobelium, has been exploiting the AWS account impersonations. 

That's an embedded web server, that's something that's offered through Microsoft and the exchange. It's what you can use to impersonate a user and gain access to their email accounts for completely legitimate reasons. 

Maybe you're HR, and you're setting an out of office for somebody that forgot to do it. Maybe you're a PA, doing something for your boss, completely legitimate. But Nobelium has found a way to use that in addition to going after cloud service providers who are resellers of Microsoft. In this article, I read that Microsoft is saying that 609 customers have experienced over 22,000 attempted attacks since July. So it's not new. 

The idea of using the Embedded Web Server, I think that was first reported in 2016. But basically, it’s showing you that there's a way for people to get into your system by exploiting something that you might not even think twice about using, and they are there; they’ve turned it to their own advantage there.

Aja: Well, first of all, I picked the wrong major in college because you noted completely accurately that more people are online, so there are more attacks. It is profitable to go after unsecured networks. Until collective security is improved, until there are more or, really, any risks to these threat actors, until the ROI is decreased, we're just going to keep seeing this trend up. 

I was reading people are enthusiastic and hopeful about policy at the national level, but it will take time to see those benefits. And healthcare needed a solution yesterday, so as long as people can make money, they're going to keep [attacking]. As long as your systems are not secure, you're at risk. 

We've already mentioned two-factor authentication once; we’re going to say it again. [It’s] probably the single most effective way that you can help secure your infrastructure, particularly during this time of remote work.

Aja: It's all fun and games until somebody buys a one-way ticket to Russia on your credit card.

Employees should care because they could be just as much at risk themselves as the company. Let's say that your company does experience a cyberattack. Let's say you're working for a hospital. It costs upwards of 9.23 million per incident, on average, when a data breach happens. When a ransomware attack occurs, that could put your company under.

Aja: Absolutely. 

Aja: The call is coming from inside the house. 

Aja: Yes, and it's your router. 

I like what NIST: National Institute of Standards and Technology says about this. A Zero Trust is a cybersecurity paradigm focused on resource protection. The premise is that trust is never granted implicitly and must be continually evaluated. 

Two things are important there. One, you're not trusting anything implicitly. And two, you have to re-evaluate constantly because putting a Zero Trust framework into place doesn't mean that you're not going to get attacked. Or that if somebody attacks you, they might not get through. There are so many different levels of protection that you have to add to make sure that you are safe. 

So when we talked about Zero Trust, and when we talk about multi-factor authentication, even if you know SPF checks out, DKM checks out, demark checks out, we still don't implicitly trust that email is safe. 

When you get an email that is inviting you to check out an invoice, maybe you have to download or change your password, and it's coming from a source that you'd typically think, “Oh, yeah, this is fine. I have an account with them. I don't remember requesting this, but this looks legit.” 

Zero Trust means you don't trust that.

I nearly fell for something like this the other day after I purchased something in a store. And then, within three or four minutes of making that purchase, I got a text message on my phone telling me that my bank account had been compromised. And I start going to call my bank, and then I look at it again. And I'm like, “wait; I don't have an account with that bank.” 

Aja: I mean, I did at one point, but I haven't had an account with them in ages. And I nearly fell for that.

Aja: Yep. I had just made a purchase. I don't know that they know that. But it was about the context. You know, the scenario? 

Aja: Let’s say I was on my couch. You felt pretty good about the fact that [it was fake]. 

Aja: Well, it's like the Norton invoice that I mentioned earlier. We had a customer report one of those. 

I ran through all of the normal checks that we do. We look for malicious links. We look for aberrations in the way that words are spelled. For instance, you'll notice if you've gotten one of these, or if you receive one, Norton, the “O” is actually a “0”. 

There are little tells like that where you can see that something isn't legit. 

Aja: Exactly. 

When you ask the question, “why should employees care about it,” it's not just about your personal safety. It's not even about if the company goes under because they have to pay out this fine. We all have a responsibility to help keep the internet a safe place to be.

We need this level of connectedness to do our jobs and save people's lives. To keep things running in a way where everybody is benefiting. So, it's everybody's personal responsibility to make sure that connecting to this resource that can make us money or steal it from us, is done with security in mind. 

And that's everything that we've told you all for the last five months. 

Aja: I read a survey that said 64% of hospital IT teams admit to being unprotected against some of the most common cybersecurity vulnerabilities. 

It makes my whole body get goosebumps. 

Even though in the healthcare sector, many folks are in the environments where they're providing services. There are still lots of people who are working at home. People working in billing, and HR and accounting. 

Hopefully, you have been given a device on which to do that work if you haven't asked for it because one of the simplest things you can do is separate your devices. Don't use your work device or anything personal and vice versa. 

I don't even check my cell phone bill on my work computer because I want to keep work stuff safe and protected and my personal stuff safe and protected. One of the simplest ways to do that is not to combine [it].

Aja: When I mentioned earlier that Nobelium is coming after cloud service providers, they're doing that because it was one attack. Then they can access so many other businesses and accounts as opposed to going after one business at a time. 

Aja: Exactly.

Aja: Absolutely. Stay safe.