Firm Notifies Patients of 55 Health Practices of MOVEit Hack
Anesthesiology, Pain Management, Gastro Practices Affected Across Several States
… While other sectors, including government, banking and education also have been affected, MOVEit hacks appear to be hitting the healthcare sector particularly hard, perhaps due to high numbers of patients collectively treated or serviced by victim organizations, said Wendell Bobst, senior security consultant at tw-Security.
… Those two exploited file transfer software incidents provide important security considerations for healthcare sector entities, Bobst said.
“Organizations should begin migration to more sophisticated solutions and place file transfer services behind VPNs and/or add multifactor authentication into the equation,” he said. “It’s a higher cost of management but has proven effective. The current generation of file transfer services is always accessible – attackable – on the internet, which presents attackers with endless opportunities to capitalize on weaknesses.”
Also, entities should carefully consider what data may also be included or excluded in the audit logs, he said.
“Some transactional logs may contain confidential information. The retention of transaction logs may assist if there was a compromise and the forensic experts want to ‘look back in time’ to try to determine what may have caused the breach,” he said. “Short-term log retention – a day, a week, a month, etc. – may not provide sufficient data for forensic experts.”
Stronger monitoring and audit capabilities translate into faster detection of an incident and identification of data that was compromised, he said.
“Weaker monitoring makes the identification of the number of affected individuals significantly more complicated,” he said. “The longer it takes to report the issue, the less tolerant consumers and regulators will be.”
For more information or to schedule a FREE initial consultation – contact tw-Security.
Read More
