Latest / Privacy Please / S5, E211 - Exposing the Ransomware Crisis: Unveiling the Threats to Healthcare Data Security

Transcript

S5, E211 - Exposing the Ransomware Crisis: Unveiling the Threats to Healthcare Data Security · Privacy Please

• 0:00
  Speaker 1: All righty, then.
• 0:01
  Speaker 1: Ladies and gentlemen, welcome back to Privacy, please.
• 0:04
  Speaker 1: I'm Cameron Ivey hanging out with Gabe Gumbs.
• 0:07
  Speaker 1: I think that's who it is.
• 0:09
  Speaker 1: It's my good friend.
• 0:12
  Speaker 1: Gabe Gumbs Sounds like him.
• 0:14
  Speaker 1: It does.
• 0:15
  Speaker 1: There's that voice.
• 0:15
  Speaker 1: There's the voice that both women and men love to hear.
• 0:20
  Speaker 2: Yes, the voice that launched zero wars.
• 0:24
  Speaker 2: Love triangles absolutely.
• 0:27
  Speaker 2: Uh.
• 0:28
  Speaker 2: No new radio stations, no late night.
• 0:30
  Speaker 2: Uh, r&b request live hot bikes no radio.
• 0:34
  Speaker 1: Who needs a radio?
• 0:35
  Speaker 1: Huh, it's radio.
• 0:37
  Speaker 1: We would be pretty good at radio huh this is not radio.
• 0:39
  Speaker 2: Well, I guess that's true it is.
• 0:41
  Speaker 2: Consider this radio.
• 0:41
  Speaker 2: This is basically like time-shifted radio.
• 0:44
  Speaker 1: Yeah, this is new age radio.
• 0:45
  Speaker 1: Just everybody can do it from their house.
• 0:47
  Speaker 1: Yeah, well, how you doing, man?
• 0:51
  Speaker 1: How's it?
• 0:51
  Speaker 2: going you good, I'm well, I'm decent, I can't complain too much.
• 0:55
  Speaker 1: Same.
• 0:56
  Speaker 2: Another day, yeah, another day.
• 0:57
  Speaker 2: Another privacy incident, another data breach.
• 1:01
  Speaker 1: Always, aren't they?
• 1:03
  Speaker 2: Another ransomware attack.
• 1:05
  Speaker 1: In healthcare Surprise.
• 1:11
  Speaker 2: In healthcare it's a day that ends in Y.
• 1:13
  Speaker 2: Last night I mean it's unfortunate, it's very unfortunate.
• 1:14
  Speaker 2: I was talking with some let's call them lay people recently in the medical field and they were fascinated by some of the data around healthcare attacks.
• 1:22
  Speaker 2: This particular person, their organization, is still being affected by one of the outages across some of the pharmaceutical networks, right, so it's really difficult for them to get patient scripts filled and stuff.
• 1:33
  Speaker 2: It's leading to some challenges with human error.
• 1:37
  Speaker 2: So folks have to like where they used to be able to just put in the information and then they'd walk over to another terminal in the building and the medication would be there and the machine would have already checked to make sure, a it was the right medication, b it was the right number of pills.
• 1:53
  Speaker 2: So that doesn't happen anymore.
• 1:55
  Speaker 2: So humans have to do a bunch of that stuff now because those systems are still out of commission post-ransomware attack, and so they were curious as to like why is healthcare getting beat around so badly?
• 2:06
  Speaker 2: And the answer, of course, is because healthcare data is super, super expensive on the dark web, largely because of healthcare fraud, but also because, healthcare being an absolutely massive industry, it is lucrative.
• 2:19
  Speaker 2: It's a ridiculously lucrative industry, and so as a target, it's decentralized, right.
• 2:25
  Speaker 2: There's no universal healthcare in this country.
• 2:29
  Speaker 2: Don't bother adding me people, right?
• 2:31
  Speaker 2: I'm not suggesting I'm for it, against it, hint, I'm for it, but nonetheless, that wasn't what I was suggesting.
• 2:36
  Speaker 2: I was suggesting that don't bother adding me on that topic.
• 2:40
  Speaker 2: And so it's a lucrative, decentralized business to go after, and operationally, it's a business that, if you cripple them operationally, there's a huge financial impact, and then there's also the human impact, and so a lot of healthcare companies are perversely incentivized to just pay the ransom.
• 2:59
  Speaker 2: This company paid their ransom, by the way, I'm not naming names for all the obvious reasons, and so, if you think of it to yourself.
• 3:07
  Speaker 2: But, gabe, you just also said that their system still weren't back online.
• 3:11
  Speaker 2: That's right.
• 3:11
  Speaker 2: That's right.
• 3:12
  Speaker 2: They paid the ransom and they got back some of their data.
• 3:17
  Speaker 2: Honestly, I think they were lucky to get back anything, but they got back a very small amount of their data, very small amount.
• 3:24
  Speaker 1: So let's go back to the financial impact of it all.
• 3:27
  Speaker 1: Obviously, there's substantial financial losses for Change, healthcare and when it comes to any ransom attack.
• 3:37
  Speaker 2: Which is not who I was talking about in that story, by the way.
• 3:39
  Speaker 2: I just want to be clear.
• 3:40
  Speaker 1: Change.
• 3:40
  Speaker 2: Healthcare was also hit.
• 3:42
  Speaker 1: Yes, okay, so you're talking about somebody else.
• 3:46
  Speaker 2: Yeah, I was.
• 3:46
  Speaker 2: I very much was intentionally was.
• 3:48
  Speaker 2: I was this.
• 3:48
  Speaker 2: This was a real story from a conversation I literally had last week.
• 3:51
  Speaker 2: This person was not part of the change health care um ransomware attack.
• 3:55
  Speaker 2: Change health care was in a similar scenario.
• 3:58
  Speaker 2: I do not know how they were affected or not affected, but they finally just admitted.
• 4:03
  Speaker 2: I think that's what you were going to bring up, right, right?
• 4:06
  Speaker 1: But this ties into exactly what you were probably talking about.
• 4:09
  Speaker 1: Anyways, it's the same.
• 4:10
  Speaker 1: They're going to deal with the same thing, yeah, so Change Healthcare.
• 4:13
  Speaker 2: You know.
• 4:13
  Speaker 2: They finally acknowledge paying the ransom and they still haven't gotten back most of their data, at least you know, based on their own words.
• 4:24
  Speaker 2: That's a problem.
• 4:25
  Speaker 1: It certainly is a problem.
• 4:26
  Speaker 1: I mean, we're talking about crippling operations, but also affecting customer trust, and I mean there's a couple of different challenges that they're going to be facing Same example that you were going over when it comes to data security, the financial impact of it all, customer trust, regulatory compliance with HIPAA with this ransomware attack.
• 4:45
  Speaker 1: Yeah, yeah, it's huge.
• 4:49
  Speaker 2: Allow me to share another real story.
• 4:52
  Speaker 1: I love stories Gabe.
• 4:54
  Speaker 2: Yeah, the thing is, to see it and witness it happen up close is always fascinating.
• 4:59
  Speaker 2: It's one thing to read about it in the news, but allow me to share with our guests another real life story.
• 5:04
  Speaker 2: I'm having a conversation with a different organization or a different person that works for I won't even give away the vertical this business is.
• 5:14
  Speaker 2: It handles a lot of PII, so you know there's a lot of, there's a lot of you know, regular people's information that they have, and they were hit with a ransomware.
• 5:23
  Speaker 2: They paid the ransom.
• 5:24
  Speaker 2: They also did not get back all of their data and then they got hit with a ransomware attack again a few weeks later by the same people, by the same people, and they were like what the hell?
• 5:35
  Speaker 2: And I was like what?
• 5:36
  Speaker 2: I don't understand.
• 5:37
  Speaker 2: What exactly do you not understand?
• 5:39
  Speaker 2: Oh, you're talking about the part where you trusted criminals to make good on their work.
• 5:43
  Speaker 2: I understand, yeah, yeah, yeah, I understand the problem.
• 5:48
  Speaker 2: You made a miscalculation and so you know, look in their defense just trying to get back up and running.
• 5:54
  Speaker 2: Sure, I don't know if that's really a good defense, because I'm not certain what the current best advice is.
• 5:59
  Speaker 2: The FBI had issued some advice years ago.
• 6:02
  Speaker 2: You know that I knew was like do not pay the ransom and I know that's been updated because in some cases the FBI will even.
• 6:08
  Speaker 2: I do not know how frequently this happens, but they will even help negotiate with the ransom attacks.
• 6:14
  Speaker 2: My assumption is that probably happens whenever it's a vertical or a business that might be deemed too important to allow this to be any more problematic than it already is.
• 6:25
  Speaker 2: But paying the ransom is a problem.
• 6:28
  Speaker 2: Last story with Gabe, a different organization who is purely in the business of ransomware recovery.
• 6:32
  Speaker 2: So we happen to partner with them, we partner with them and they offer services to help folks recover.
• 6:40
  Speaker 1: And we.
• 6:40
  Speaker 2: by we you mean Myoda.
• 6:41
  Speaker 2: Oh, we be Myoda.
• 6:43
  Speaker 2: Yes, yeah, we be Myoda.
• 6:44
  Speaker 2: Myoda is we don't talk about them frequently on the show but for those of you paying attention, it is the data security organization that I represent.
• 6:53
  Speaker 2: I do a lot more than represent.
• 6:54
  Speaker 2: Go check this out, myotaio, check it out.
• 6:56
  Speaker 2: Shameless plug, shameless plug.
• 6:57
  Speaker 2: Go check it out, check it out.
• 6:58
  Speaker 2: So, anyway, we partnered with this organization and they help organizations recover from ransomware attacks.
• 7:05
  Speaker 2: Some of the things that they were sharing with me, I was actually surprised by and shocked by the things that they were sharing with me.
• 7:11
  Speaker 2: I was actually surprised by and shocked by they were saying that on the high side, 60% of someone's data is all that they ever see recovered.
• 7:17
  Speaker 2: On the high side, it's usually somewhere between like 20 and 40%.
• 7:19
  Speaker 2: I hadn't actually known that.
• 7:21
  Speaker 2: I hadn't actually known that, largely because I hadn't spent a lot of time discussing in detail with someone who has paid the ransom what the recovery impact was.
• 7:32
  Speaker 2: Right, like I hadn't had that conversation.
• 7:35
  Speaker 2: And so, as I'm having these conversations with you know these folks that have literally been hit and paid the ransom and not got back their data, and I'm having this conversation with these folks that come in to help clean things up and they're like, actually some of those numbers aren't bad, because we rarely see 60%.
• 7:51
  Speaker 2: Most people don't get back that much of their data.
• 7:52
  Speaker 2: I'm like, so I should go back and tell this guy he's actually lucky.
• 7:55
  Speaker 2: I should go back and tell this guy who got hit twice like, by the way turns out, you're actually lucky.
• 8:00
  Speaker 2: You could have lost both legs and arm and your head.
• 8:04
  Speaker 2: You only lost a couple arms, right, yeah, and so you know, if that is the pattern, why are folks paying these ransoms?
• 8:17
  Speaker 2: Still, it encourages future attacks.
• 8:18
  Speaker 2: There's no guarantee that your data is going to be recovered.
• 8:20
  Speaker 2: You will potentially be extorted.
• 8:24
  Speaker 2: Again.
• 8:24
  Speaker 2: You already mentioned the legal and compliance risk.
• 8:26
  Speaker 2: Right, like, depending on your jurisdiction, paying a especially if it's to a sanctioned entity, could lead to legal consequences, right, including violating compliance regulations.
• 8:36
  Speaker 2: So like, let's say, you pay a ransom to like Al-Qaeda and you just didn't know it was Al-Qaeda.
• 8:41
  Speaker 2: I'm just making things up because sanctioned entities, right, like, maybe their name was posted right on their ransomware bill but you just, you know, didn't pay attention, didn't care, didn't think it was real.
• 8:49
  Speaker 2: But even just doing that is a problem.
• 8:51
  Speaker 2: On top of the, you're also taking resources out of your own business and just basically setting them on fire.
• 8:58
  Speaker 2: I say that because, if you're still not getting your data back, you've just set a big pile of company cash on fire.
• 9:04
  Speaker 1: That's true.
• 9:05
  Speaker 1: Now, for fun, I actually asked ChatGPT to give me an easy analogy of this situation when it comes to cyber attacks, and this is this is what it came up for change health care.
• 9:18
  Speaker 1: So change health care is like a fortress protecting valuable treasures.
• 9:21
  Speaker 1: Patient data hackers, akin to cunning thieves, breached his defenses and demanded ransom, holding the treasure hostage.
• 9:29
  Speaker 1: Despite paying, the threat remains, as other thieves claim to have copies, leaving the fortress vulnerable.
• 9:35
  Speaker 1: Does that sound right in these situations?
• 9:38
  Speaker 1: It sounds about right.
• 9:41
  Speaker 2: And here's what sticks out about this scenario, because that is exactly one of the things that Change Healthcare was worried about was this data leaking out?
• 9:48
  Speaker 2: Right?
• 9:48
  Speaker 2: The second the data is in the ransomware attacker's hands.
• 9:52
  Speaker 2: It's too late, it's already leaked.
• 9:54
  Speaker 2: They are also, they being the bad guys.
• 9:57
  Speaker 2: On top of not returning all your data, are still selling your data on the dark web.
• 10:01
  Speaker 2: So people will pay the ransom and that data will show up on the dark web still, because, again, you can't trust them.
• 10:07
  Speaker 2: So, again, why are you paying for?
• 10:09
  Speaker 2: You didn't get your data back.
• 10:10
  Speaker 2: It still got sold on the dark web.
• 10:13
  Speaker 2: What did you actually pay for?
• 10:15
  Speaker 2: What are you paying for?
• 10:17
  Speaker 2: And so, yeah, in this case, others claiming to have copies of it was true.
• 10:21
  Speaker 2: Others did have copies of it and will continue to have copies of it.
• 10:24
  Speaker 2: The 2023, last year's Verizon Data Breach Investigation Report, which 24 hasn't been released yet.
• 10:29
  Speaker 2: But if you look at there's a trend in there that it highlights, and the trend is that availability has become the number one impact of ransomware, not data loss, right Like.
• 10:41
  Speaker 2: So.
• 10:41
  Speaker 2: Not getting your data back has become the biggest impact of ransomware.
• 10:44
  Speaker 2: Them keeping it hostage has become the biggest impact your data simply ending up on the dark web hasn't become the biggest impact, and part of the reason for that is because, well, it just happens anyway, right?
• 10:54
  Speaker 2: Because that's part of the reason why the impact, the impact to your business isn't it's still there, but it's way outsized by your inability to run your business Right, like that lady who now has to I didn't say it was a lady, maybe I did, but that lady I was mentioning before who now has to.
• 11:10
  Speaker 2: I didn't say it was lady, maybe I did, but that lady I was mentioning before who now has to, like go manually, go check the prescriptions and, by the way, they found errors.
• 11:16
  Speaker 2: There's been multiple errors because humans make errors, and before their error rate was like super low and now the error rate's like 8%.
• 11:23
  Speaker 2: That's a lot.
• 11:23
  Speaker 2: So now this lady has to keep doing this manual effort.
• 11:28
  Speaker 2: That is far surpassed.
• 11:30
  Speaker 2: The fact that that patient's healthcare data is leaked, yes, that's a problem, but that patient's healthcare data was probably leaked in a different breach any freaking way, and so now that that patient can't even get care or count on the care being accurate, that's a bigger freaking problem.
• 11:45
  Speaker 2: It's a massive problem.
• 11:47
  Speaker 1: A lot of things are going on in my brain right now.
• 11:49
  Speaker 1: There's too much when it comes to this topic.
• 11:51
  Speaker 1: Did we even mention the amount of this ransom?
• 11:55
  Speaker 1: It was uh, I think it was like 22 million yeah, this one in particular was 22 million.
• 12:01
  Speaker 1: 22 million dollars to not get your data back now my question and you might have highlighted this, but this is change plug number two for less than 22 million dollars.
• 12:10
  Speaker 1: I'll make sure you always get your data back, like my, yoda will make sure you always get your data back For less than $22 million, a lot less.
• 12:17
  Speaker 2: My Yoda will 100% guarantee you could always get your data back.
• 12:21
  Speaker 1: That's what I was going to say, Like how do these organizations put themselves in a situation when someone does this to like a cyber attack?
• 12:29
  Speaker 1: How do you not have your data and a way that you can actually still access it?
• 12:38
  Speaker 2: You want some more wild statistics?
• 12:40
  Speaker 2: So that same company that kind of comes in post-breach was also telling me that somewhere north of like 50% to 60% of all the companies they work with just don't have backups at all, which is why they just don't even have any like zero.
• 12:55
  Speaker 1: What do you think the reason is Money?
• 12:57
  Speaker 2: I don't have it.
• 12:57
  Speaker 2: I think do nothing is the reason.
• 13:00
  Speaker 2: I think because a lot of people, just you know.
• 13:02
  Speaker 2: So here's a couple of reasons.
• 13:04
  Speaker 2: One is a lot of people think that because they use sas platforms, they're fine, like well, I use salesforce.
• 13:08
  Speaker 2: So, like, salesforce protects my data it's not untrue they do but like if I breach your salesforce instance, take your account, lock you out of it, delete, delete everything and do so over time such that you can't get any of that data back.
• 13:24
  Speaker 2: The only thing Salesforce guarantees is that the platform will be available for you to use and the data that you put in there will be.
• 13:31
  Speaker 2: But if you look at all cloud shared security models all of them the data is your responsibility and so part of it is a lot of people have this misinformed idea that whatever SaaS product they use, that is good enough and they don't have to worry about whether or not their data is backed up.
• 13:44
  Speaker 2: The second problem is, because of that first problem and others, they just don't do anything about it.
• 13:49
  Speaker 2: They just don't do anything about it.
• 13:51
  Speaker 2: The other problem because I'm certain Change Healthcare had backups.
• 13:55
  Speaker 2: I'm certain they did.
• 13:56
  Speaker 2: The other problem is the backups are the first thing that gets attacked, because how else am I going to get you to give me $22 million?
• 14:03
  Speaker 2: The backups are the first thing I attack and there's lots of ways to attack the backups.
• 14:07
  Speaker 2: Right, they are vulnerable themselves.
• 14:10
  Speaker 2: It doesn't matter the backup platform.
• 14:11
  Speaker 2: There's lots of different attack factors specifically targeting just those platforms.
• 14:16
  Speaker 2: So even if you have the backups, you have to protect those backups.
• 14:20
  Speaker 2: I think I posted this is I posted a meme on linkedin moons ago.
• 14:24
  Speaker 2: I'll have to do it again, but you know it's the one with the black guy pointing at his head like this you know waking and oh yeah, that I wrote yeah, yeah, I didn't know he was british I don't think I ever knew the origin.
• 14:35
  Speaker 1: I saw I saw a meme of the actual video and everybody's like after all, this time I actually see.
• 14:40
  Speaker 1: This is the first time seeing the video and him talk that's funny.
• 14:42
  Speaker 2: Yeah, that's funny.
• 14:43
  Speaker 2: I may have to check it out, but the caption I put on it was you don't have to worry about securing your backups if you don't have backups.
• 14:49
  Speaker 2: That's.
• 14:49
  Speaker 2: That's the genius to it you don't have to worry about you, you do not have to worry about protecting those things.
• 14:54
  Speaker 2: If you just don't take any backups and when someone asks you, do you have backup security, you'd be like I'm good, I'm solid over here okay, so that to that point.
• 15:02
  Speaker 1: Uh, you've mentioned myota and and we're not trying to promote myota here, but I think a good question is for those.
• 15:08
  Speaker 1: I mean, I'm not no but yeah yeah, but I guess a good question is is how?
• 15:12
  Speaker 1: What are some steps that you can take to prevent something like this happening?
• 15:16
  Speaker 2: so that's so, yes, let let's put this into, you know less biased context.
• 15:21
  Speaker 2: You have to A actually take the backups right, like back to my meme pointing at the head right.
• 15:25
  Speaker 2: Like duh like yeah, it's true.
• 15:27
  Speaker 2: You don't have to secure backups if you didn't take them, so you have to actually have them, and the fact that, like 50% of folks are running around without any, it's just wild.
• 15:33
  Speaker 2: So step one, you have to.
• 15:35
  Speaker 2: Step two, you have to really understand where your data is and how it's actually protected.
• 15:40
  Speaker 2: That ties back to the SaaS platform conversation.
• 15:44
  Speaker 2: Your data in a SaaS platform isn't guaranteed to be backed up in any meaningful way that will protect you from ransomware.
• 15:51
  Speaker 2: That is, they're guaranteeing service availability full stop.
• 15:54
  Speaker 2: That shared cloud security model does not account for that period.
• 15:58
  Speaker 2: If you read your Ts's and C's, you will see that Hopefully, you don't have to read them post-attack to get to that.
• 16:08
  Speaker 2: Number three you have to secure the backups.
• 16:11
  Speaker 2: You take the backups, now you have to secure them.
• 16:12
  Speaker 2: That requires a whole effort onto itself.
• 16:16
  Speaker 2: Traditionally, backups have been the purview of just the IT teams, which is to say not the security teams or not the IT security teams.
• 16:21
  Speaker 2: And so a lot of times I'll talk to security people and they will say things like oh well, that belongs to the infrastructure engineers or the IT infrastructure engineers or the IT guys, and it's like, yeah, but that's the last stop saloon, though.
• 16:35
  Speaker 2: If that thing gets breached, you're paying 22 million for a bonfire.
• 16:39
  Speaker 2: And so there's still this gap between the security professionals understanding their role in protecting that last mile, the backups.
• 16:51
  Speaker 2: And so, again, the non-biased answer is you have to protect those backups.
• 16:55
  Speaker 2: The thing is that's becoming so much harder because it's literal target number one, because it's leverage.
• 17:01
  Speaker 2: It's the first thing they target Before they lock up all the operational data, before they lock up all the daily operational data, they go find the backups, because once I put a lock on that, you can't just tell me to pound sand and go away, because I know I have a backup.
• 17:17
  Speaker 1: Once that happens happens, you're gonna pay me 22 million easy, easy 22 million okay okay, it's maddening, it's confusing, and everybody that has their patient data in some kind of where form we all do it is crazy that that isn't the most protected data.
• 17:38
  Speaker 1: Like you know what I mean.
• 17:39
  Speaker 1: Like how is the health care industry not the most protected data?
• 17:42
  Speaker 1: Like you know what I mean, like how is the healthcare industry not the most secured?
• 17:43
  Speaker 1: It's probably one of the worst.
• 17:44
  Speaker 1: I would say Probably One of Allegedly, I agree.
• 17:48
  Speaker 2: I agree, like I'm just thinking through some real world, you know, not calling any names or even giving any hints towards, but I will agree.
• 17:56
  Speaker 2: I've seen some things in healthcare that are astonishing.
• 17:58
  Speaker 2: I've seen some things that have made me literally avoid some of the larger providers, like that provider.
• 18:04
  Speaker 2: I won't go with them for any services whatsoever because I know they don't even have a basic vulnerability testing program.
• 18:12
  Speaker 2: I've seen some of those things up close.
• 18:13
  Speaker 2: Some of our audience members have probably witnessed and been privy to similar.
• 18:18
  Speaker 2: So, but for those of you that haven't, you know that this the sky isn't falling.
• 18:22
  Speaker 2: I want to be clear about that.
• 18:23
  Speaker 2: The sky isn't falling, but yeah there's a lot of work.
• 18:26
  Speaker 1: There's a lot of work to be done I don't know, man, we're coming up on time, though I don't know.
• 18:29
  Speaker 1: My mom always said that we're living in hell in a handbasket.
• 18:32
  Speaker 1: I'll tell you what the world kind of looks like, but I mean we know it's not falling it's not falling, but uh, yeah, yeah, we'll see.
• 18:41
  Speaker 1: It'll be fun to monitor this as it continues.
• 18:43
  Speaker 1: But, gabe, thanks man, great episode this week.
• 18:47
  Speaker 1: Uh, anyone has anything, shoot it our way, we'll see you guys next week.
• 18:50
  Speaker 1: Next week, see y'all.