The Ransomware Crisis, Part III: Best Practices

EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series on the need for healthcare facilities in the U.S. to protect themselves from cybercriminals demanding ransom for patient records. This is the third installment in a series of reports on the ransomware crisis facing America’s hospitals.

The world is now witnessing one of the most significant ransomware waves in history, and hospitals are under attack.

Hospitals risk having all of their electronic medical records (EMRs) encrypted. In order to get the electronic “key” to unlock the data, a ransom must be paid.

In the previous segment of this series, we covered three areas of concern for hospitals: a) technology; b) operations; and c) legal/regulatory.

The technology side concerns operations of the ICT department. The operations side involves setting up internal processes such as “fire drills” and other exercises to make sure that everyone knows what to do after a ransomware attack occurs. The legal and regulatory side concerns how each hospital must adhere to state and local law. This usually involves substantial notification requirements for both governments and to individual patients whose records have been compromised. It also concerns how well the hospital knows how to support law enforcement, including preservation of evidence needed for a prosecution.

Best Practices

Here are a few best practices that hospitals might use to prepare for a ransomware attack.

First, cut off email access to the outside Internet. Evidence indicates that almost all ransomware is introduced into an information system by users who unknowingly download malware from the web.

Create a “crisis playbook” that defines roles and activities of all key parties in the case of a ransomware incident. Rehearse this playbook in a live simulation or tabletop exercise every two months.

Make sure that all hospital employees know how to operate in manual mode, if needed. Build the capability to work in manual mode for at least seven days. Have computer-readable forms ready and make sure each person has been trained for this contingency.

Compel your ICT professionals and others to keep an “evidence log” so that all information regarding the ransomware crime is logged. Make sure that ICT knows how to avoid erasing cyber evidence when they restore the information system.

If necessary, change the architecture of your ICT systems so they may not “infect” each other. For example, separate electronic medical records (EMRs) from personnel or other administrative systems. This involves building internal firewalls and other security measures to make it impossible for the infection to spread.

Have in place a pre-programmed notification procedure in case patient records are compromised. This includes having a legal team on standby. For example, you should have an off-site system in place, already prepared to send notification letters if the need arises. Have the notification letters drafted, reviewed, and approved. Note that you probably will not be able to depend on your own internal system to get mailing addresses, because it might be locked up with the ransomware.

Operate a parallel ICT infrastructure that mirrors your current system. Have “hot switching” procedures in place to use this alternative system in case the primary system is compromised. Rehearse this handover at least once every two months. A CIO from a large bank that followed this advice explained it this way:

“Every three months we shut down our mainframe production system and move the entire operation over to an exact copy of our infrastructure that has been custom-built for this purpose. Each time something goes wrong. There is a snag. People ask us why we do this when we know something might go wrong. The answer is simple: We do it exactly because we know that something will go wrong. And that is precisely what we are trying to identify ahead of time so that if a real problem occurs, we will know how to deal with it.”

Make sure you have in place pre-arranged contacts with law enforcement, both state and federal. Establish a single point of contact between your institution and the law enforcement community. Have a joint lunch meeting at least twice a year. If you are on a first-name basis, things will go much better if a real ransomware attack arises.

Implement tougher ICT security training standards for your employees. Make internal certification of proper ICT procedures a prerequisite for continued employment. Use online training. Build successful IT training into annual performance reviews to ensure that everyone is on board. This alone will greatly reduce the chances of contamination with malware.

Finally, hospitals should think about hiring specialists to perform a ransomware audit covering all three aforementioned areas: a) the technologies in the ICT infrastructure; b) contingency operational procedures in place in case of an attack; and c) skills in coordinating an effective legal and regulatory response.