30 Jun Former FBI Agent Says Healthcare is a Security Minefield
Cybersecurity expert Scott Augenbaum on ransomware and patient records
– Sausalito, Calif. – Jun. 30, 2020
When most people think of cybercrime, they’re worried about money. Did my bank account get hacked? Did someone spoof my identity in order to access my credit cards? What those people don’t realize is that personal information is way more valuable than your ATM pin.
Former FBI agent Scott Augenbaum knows the score. After joining the FBI in 1998, he became a special agent in 1994 and subsequently worked domestic terrorism, white collar and hate crimes, and computer intrusions in New York; Washington, D.C.; and Nashville, working in the Cyber Crime Fraud Unit and managing the Computer Intrusion/Counterintelligence Squad in Memphis.
Cybercrime Radio: Former FBI Agent & Cybersecurity Expert Scott Augenbaum
Healthcare suffers 2-3X more cyberattacks than financial services
In this age when everyone is worried about the current healthcare crisis, one of Augenbaum’s many specialties is identifying and nullifying those who want to take advantage of the highly valuable data that can be collected from a healthcare system intrusion. He notes that not only are there two to three more cyberattacks on healthcare IT systems than financial systems, but a single record — including name, address, phone number, Social Security number, insurance information, and more — is up to fifty percent more valuable on the black market than traditional financial information.
So where are the cracks in healthcare information systems that we trust?
One of the problems, Augenbaum explains, is that healthcare companies are preoccupied with meeting HIPAA (Health Insurance Portability and Accountability Act), and OSHA (Occupational Health and Safety) audits. These issues are important but while they do address concerns like patient privacy, they aren’t focused on the primary threat involved, which is the integrity of a healthcare system’s information technology platform.
While not getting into the nitty-gritty of IT protection, Augenbaum does cover the many fallacies he’s run across. The most obvious fault, he says, is a lack of two-factor authentication to access these vital systems. In some organizations, he’s found that everyone with a login had administrative rights. The current healthcare crisis means many employees are working from home, which just creates another opportunity for a bad actor to take advantage of a facility’s weaknesses when it comes to IT security.
Another important question he answers is the contemporary threat of ransomware. Even a temporary barrier that prevents healthcare facilities accessing patient records and data can cost lives. Should facilities pay the ransom in order to get their operations back up and running?
It’s an interesting answer but more importantly, Augenbaum covers the steps that all healthcare facilities, whether they’re multi-location global operations or small community providers, should take to protect themselves from threats like ransomware, phishing expeditions, and other factors that give these types of organizations a false sense of security.
“It’s dangerous out there,” Augenbaum says. “Bad guys steal your stuff; you’re probably not getting it back. It’s not that I’m telling organizations that they have to completely change the way they do things. They just need some individuals who know how to prevent this problem so they don’t need to be the next victims of identity theft or cybercrime.”
For anyone involved in the healthcare industry or just those simply curious about how to protect a complex system from multifarious threats, this podcast is a must listen.
– Clayton Moore is a Cybercrime Magazine freelance writer.
