H-ISAC Hacking Healthcare 8-18-2020 -

TLP White: This week, Hacking Healthcare begins by exploring how healthcare organizations should consider establishing an online presence on social media and communication platforms, even if there doesn’t appear to be a business case for it. Next, we briefly detail the National Security Agency (NSA) and Federal Bureau of Investigation’s (FBI) startling public identification and attribution of Drovorub malware. Finally, we wrap up by breaking down a report detailing consumer views on data privacy and security in the Asia-Pacific region.

As a reminder, this is the public version of the Hacking Healthcare blog. For additional in-depth analysis and opinion, become a member of H-ISAC and receive the TLP Amber version of this blog (available in the Member Portal.)

Welcome back to Hacking Healthcare.

H-ISAC Monthly Threat Briefing:

As a reminder the H-ISAC’s monthly Threat Briefing will take place on Tuesday, August 25^th at 12:00pm EST. Every month, the H-ISAC and our associated partners dive into issues related to insider threats, cybercrime, the Dark Web, physical security, and legal and regulatory issues that affect the healthcare sector. The Threat Briefing is a free service only available to H-ISAC members.

1. Securing Your Online Presence.

For years, one line of thought on how individuals could avoid having their accounts hacked and their sensitive data put at risk was to avoid creating unnecessary online accounts entirely. By minimizing how much personal information was put on the Internet, and generally keeping an analog existence to the fullest extent possible, some argued you could minimize the attack surface and the number of vectors through which you could be targeted.

Unfortunately, in practice, there are numerous reasons related to identity theft and fraud that explain why this doesn’t turn out to be an optimal strategy for individuals.[1] However, organizations may inadvertently be employing a similar approach when it comes to their online presence by attempting to limit the amount of accounts they maintain online.

For example, it may be easy for a pharmaceutical company who never directly interacts with patients to brush off the need to create and monitor an Instagram account, or for a hospital group to decide that it would be unprofessional to have a corporate TikTok, or even for a medical device manufacturer to determine that there just isn’t a business case to have a Twitter for all of its branches or international subsidiaries. But there is a risk in not setting up, securing, and adequately monitoring these types of accounts.

In the following Action & Analysis section we’ll explore this topic further.

Action & Analysis
** Membership required**

2. NSA and FBI Release Linux Malware Warning.

On August 13^th, the NSA and FBI released a joint statement disclosing the existence of Drovorub malware. According to a 45-page NSA and FBI advisory, the malware has the capability to provide direct communications between a compromised device and a threat actor’s command and control infrastructure, allows for file download and upload, enables execution of arbitrary commands, and facilitates port forwarding of network traffic to other hosts on the network.[2]

Both organizations attribute the Linux-based malware to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165, which is often identified as Fancy Bear, Strontium, or APT 28.[3] The NSA’s press release states that the malware is a component in Russian cyber espionage operations, but the release does not detail any specific targets or victims other than to say the malware “represents a threat to National Security Systems, Department of Defense, and Defense Industrial Base customers that use Linux systems.”[4]

Thankfully, the advisory details “detection strategies, mitigation techniques, and configuration recommendations” for network defenders and system administrators.[5]

Action & Analysis
** Membership required**

3. Study Highlights Asia-Pacific (APAC) Region Views on Data Protection.

A newly published study by F5, an application services company, sought to gauge how consumers in the APAC region view data privacy and protection issues. The results paint an interesting picture for what organizations should prioritize when looking to operate in these markets. The primary takeaway may be just how significantly consumers in the APAC region believe businesses should be responsible for protecting data privacy.

The study incorporated respondents from eight APAC economies: China, Indonesia, India, Taiwan, Singapore, Australia, Japan, and Hong Kong.[6] The primary questions they sought to answer were how do data breaches affect trust? What are the most important features for applications to possess? How willing are you to share personal data on applications? Do you prioritize security or convenience more? Finally, who should be responsible for protecting your data privacy?

The most interesting findings appear to be:[7]

Only 4% of respondents said they would stop using an application that suffered a data breach
Strong encryption and security were the most important feature of an application, beating out user friendliness by 16 percentage points
Willingness to share and store personal data on applications varied immensely by country
In 2020, convenience trumped security in most countries
In response to who should be responsible for protecting consumer data, 43% of respondents said businesses, 32% said government, and only 25% said consumers themselves

Action & Analysis
** Membership required**