Treasury Department Threatens To Prosecute Organizations that Pay Ransomware; Major Problem for Hospitals

This is a very big deal. It can give you the justification at the most senior levels of your organization to implement the CIS Critical Security Controls this year.

Alan Paller

OFAC rules and consequences around foreign transactions to sanctioned entities can be substantial. Develop a risk-based approach to support the payment decision now, as John enumerates, before it is needed, including consideration of sensitive data being released. Additionally, include reporting and cooperation with law enforcement in your response plan as this can mitigate the weight of any OFAC enforcement outcome.

Lee Neely

This is consistent with the FBI's updated guidance on dealing with ransomware, which came out in Oct 2019: "... the FBI understands that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers. Regardless of whether you or your organization have decided to pay the ransom, the FBI urges you to report ransomware incidents to law enforcement." The reminder that payments to sanctioned entities may incur fines was added here. However, the Treasury advisory still says "...OFAC encourages financial institutions and other companies to implement a risk-based compliance program to mitigate exposure to sanctions-related violations," and points to a May 2019 compliance framework requiring demonstration of (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training - essentially security hygiene: Bottom line: prevention of ransomware will always end up costing less than incurring or paying off successful attacks.

John Pescatore

Ransomware attacks must be resisted, not merely mitigated. They constitute a risk that must be reduced, not simply assigned to underwriters.

William Hugh Murray

Hospitals are faced with challenging usability/security trade-offs, which include bearing the cost of security mitigations. Doctors and care givers don't want emergency care inhibited by an inability to login to a computer and order services rapidly. They need access to hundreds of hospital systems. Proximity cards coupled with added authentication to sensitive services are becoming more common, and the retrofit, both funding and implementing, without creating service disruptions is a huge challenge. Consider UHS's cost to recover, including loss of life of redirected patients, as an example when considering the ROI of increased security measures.

Lee Neely

Critical systems, e.g., patient care systems, should be isolated from vulnerable systems running e-mail and browsers. That said, the report suggests that the hospital had plans in place to maintain critical care in the face of a breach. "A plan is a capability, the ability to do something in its presence that one cannot do in its absence. It is not a document that one takes out and reads while sitting in the ashes." -Robert H. Courtney, Jr.

William Hugh Murray

Systems must be breached before "Ransomware" can be used. Extortion is only one possible consequence of such breaches. The most efficient strategy is to resist the breach, to raise the cost of attack to the point that it removes one from the target population. "One does not need to outrun the bear."

William Hugh Murray

I remember not having time to patch, and not wanting to update a fully functioning server or service because it was working perfectly. Today, patching and monitoring security settings is a mortgage that must be borne with insourced services, and is a cost which may be overlooked when considering outsourcing ROI. It may be helpful to have policies around patch application and security setting validation, so staff know what is required and that these actions are important to management as well.

Lee Neely

Poor quality in popular products puts the entire infrastructure at risk. Tens of thousands of instances are likely to go unpatched. Enterprises large enough to be running an Exchange Server should have a planned and routine program for patching, but such programs are unlikely to ever be universal.

William Hugh Murray

The Microsoft guidance below makes the update and mitigation process easier to follow. If you are using Windows Server 2008 R2 SP1, you need an Extended Security Update (ESU) license to successfully install any update that addresses this issue. Better still, replace these with Server 2016 or higher, which will also give you access to updated security and user management options in Active Directory.

Lee Neely

Storage devices should not be visible to the public networks. Who knew that they were running "older versions of the Photo Station app," much less that they posed a vulnerability to the enterprise? Patching is necessary but not sufficient. One should consider removing or hiding potentially vulnerable, but not mission critical, applications from the public networks.

William Hugh Murray

Transparency and full disclosure is required. The question is, do you trust that the attackers really destroyed the purloined data? Rather than second guess the company's payment decision, or the destruction of the data, be proactive and keep your credit monitoring updated, including responding to any alerts sent.

Lee Neely