Skip to content

How to Manage Privileges in Endpoints?

If you are running an organization, you should be concerned with managing endpoint privileges to ensure devices such as laptops, smartphones, and tablets do not pose a threat to the cybersecurity of your company.

In this sense, one can use a PAM solution to support privilege management and avoid risks when not implementing the principle of least privilege.

In this article, we explain how this works and how GO Endpoint Manager can help you. To facilitate your understanding, we divided our text into topics. They are:

  • What is Endpoint Privilege Management?
  • How does a PAM Solution Support Privilege Management?
  • GO Endpoint Manager as a Solution for Managing Privileges in Endpoints
  • About senhasegura

Enjoy the reading!

What is Endpoint Privilege Management?

Endpoint privilege management combines application controls and privilege management and enables a company’s employees to have enough access to perform their activities without having full entitlements to the IT system.

Through endpoint privilege management (EPM) technologies, professionals have access only to trusted applications and companies are able to remove local administrator access with little impact on end users.
In practice, we are referring to the implementation of the principle of least privilege, according to which employees receive only the necessary permissions to perform their tasks.

How does a PAM Solution Support Privilege Management?

Privileged Access Management (PAM) consists of a set of information security strategies and technologies that aim to protect accounts by controlling privileged access and permissions for users and reducing risks of external attacks as well as insider threats.

With its evolution, Gartner included two classifications that describe different PAM solution approaches. They are: Privileged Account and Session Management (PASM) and Privileged Elevation and Delegation Management (PEDM), which is nothing more than the endpoint privilege management.

The focus of PEDM is to provide more specific access controls than those provided by PASM, minimizing threats generated by excessive privileges. PASM is based on more basic methods to protect access, such as the use of passwords.

To gain access, machines and users check administrator accounts that have full or no access privileges.
With PEDM solutions, one can grant only the necessary access for the performance of certain tasks. Moreover, access can be limited to a specific time.

At the end of a session, privileges are revoked and if credentials are compromised, attackers will not be able to persist in their actions.

PASM associated with PEDM makes it possible to control the privileges of administrator accounts, consequently reducing insider and external threats.

Another important function of PEDM tools is to allow administrators to request new roles to obtain the necessary permissions to perform tasks so that privileges are assigned through a flexible approach.
In addition, they help organizations to comply with some criteria, as they often provide reports as well as monitoring capabilities.

GO Endpoint Manager as a Solution for Managing Privileges in Endpoints

GO Endpoint Manager is senhasegura’s PEDM solution. This tool is used to control the delegation of privileges to Windows and Linux-based endpoints, including Internet of Things devices and other wireless devices for corporate networks.

Through this feature, endpoints can be brought into compliance with the security standards of cybersecurity organizations and regulations, such as NIST, CIS Controls, and ISO 27001.

About senhasegura

We, from senhasegura, are part of MT4 Tecnologia, a group of companies focused on information security founded in 2001 and operating in more than 50 countries.

We propose to guarantee digital sovereignty and information security to our clients, granting control of privileged actions and data, and avoiding theft and leaks of information.

For this, we follow the lifecycle of privileged access management through machine automation, before, during, and after accesses. We also seek to:

  • Prevent companies from suffering interruptions in their operations;
  • Automatically audit the use of privileges;
  • Automatically audit privileged changes to detect privilege abuse;
  • Provide advanced PAM solutions;
  • Reduce cyber risks;
  • Bring organizations into compliance with audit criteria and standards such as HIPAA, PCI DSS, ISO 27001, and Sarbanes-Oxley.

Conclusion

By reading this article, you saw that:

  • Endpoint privilege management allows employees of a company to have enough access to perform their activities, without having full entitlements over the IT system;
  • PAM has two complementary approaches to protect accounts, namely: Privileged Account and Session Management (PASM) and Privileged Elevation and Delegation Management (PEDM);
  • GO Endpoint Manager is senhasegura’s PEDM solution. This tool is used to control the delegation of privileges to endpoints.

Was this article helpful to you? So, share our text with someone who might be interested in the topic.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

ESET 於 Canalys 全球安全領導力矩陣 2022 （Global Security Leadership Matrix）獲評為冠軍

2022 年 12 月 20日 – 全球數碼安全領域領導者 ESET 宣布，於 Canalys 全球安全領導力矩陣 （Global Security Leadership Matrix）2022 中排名第一。Canalys 是一家領先的全球技術市場分析公司，通過既定渠道計劃，對領先的網絡安全供應商進行全面評估。ESET 持續的收入增長，包括 MSP 部分增長了 30%，加上其帳戶管理質量和整體經營便利性，在其合作夥伴中保持了高度評價。

ESET 合作夥伴計劃重視建立長期關係，這有助夥伴持續提供寶貴意見。現時 ESET 的銷售網絡由超過 10,000 個 MSP 和 24,000 個經銷商組成，MSP 仍然是戰略的核心部分。通過 MSP 提供 XDR 解決方案（包括 ESET Inspect 和 ESET Inspect Cloud）以鞏固戰略執行，這些解決方案以前僅向企業帳戶提供。

30 多年來，ESET 一直致力投資多層專有技術，以防止客戶的端點和系統受到已知和未見威脅的破壞。ESET 商務總監 Ignacio Sbampato 表示：「我們的目標是提供數碼安全，使企業的系統能夠平穩、安全地運行。 我們相信，我們為合作夥伴提供了最精密的多層技術，使他們能夠專注於業務進展這個最重要的事情上。」

作為一家專注於技術的私營公司，ESET 始終採取以科學為基礎、安全第一的方法，早已採用機器學習和雲端計算能力來開發全球威脅情報系統。ESET 商業解決方案連續備評為行業冠軍、頂級玩家和領導者。

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於ESET
ESET成立於1992年，是一家面向企業與個人用戶的全球性的電腦安全軟件提供商，其獲獎產品 — NOD32防病毒軟件系統，能夠針對各種已知或未知病毒、間諜軟件 （spyware）、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少，偵測速度最快，可以提供最有效的保護，並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”（Deloitte’s Technology Fast 500）公司，擁有廣泛的合作夥伴網絡，包括佳能、戴爾、微軟等國際知名公司，在布拉迪斯拉發（斯洛伐克）、布裏斯托爾（英國 ）、布宜諾斯艾利斯（阿根廷）、布拉格（捷克）、聖地亞哥（美國）等地均設有辦事處，代理機構覆蓋全球超過100個國家。

Backup Strategy and the 3-2-1 Principle

Data loss comes in all sizes: small (individual files), medium (SharePoint site), and large (ransomware and disaster recovery). No matter the size of the loss of data, none of them are fun, and even the smallest of data loss events could leave you lacking your most critical data. That one spreadsheet or that one hard disk drive could have what you and your business rely on most – it’s not always something someone can “just create again” on a whim as data loss is indiscriminate in its impact. All data loss events negatively impact workflow, and all are risk and data protection concerns that ultimately are a business imperative. Proactive data protection through backup and data management is at the forefront of all of our minds—or at least should be. Now why is that? Years ago, the assumption prevailed that cloud services would “take care of everything” once you signed up for a cloud service, with backup being lumped in. But now, more than ever, as the awareness of shared responsibility models for SaaS applications grows which states it is the user who is responsible, it’s clear the onus is on you to have that backup strategy in place. That’s why the 3-2-1 backup rule—a principle established for on-premises infrastructure which requires multiple copies of backup data on different devices and in separate locations—is still relevant to today’s cloud-based infrastructures by providing essential data-protection guidelines.

Why Back Up Cloud SaaS Data, and Why Now?

Your data is critical to your business operations, and in many cases, maintaining control of and access to it is required by law. (Read more about how third-party security keeps companies in control of their data here.)

SaaS Shared Responsibility Model

Software-as-a-service providers have established documentation that clarifies the areas of responsibilities they have and also those responsibilities that are retained by the customer. Microsoft, well known for its Microsoft 365 SaaS offering, delineates the boundaries of shared responsibility in the cloud. While Microsoft does provide some degree of data protection, many people are not aware of the limitations of this protection. The short of it is that Microsoft does not provide suitable backup and restore functionality to customers. Learn more about why your M365 is not backed up (and how to fix it) in our in-depth article here.
And it’s not only Microsoft that has a shared responsibility for their SaaS services. Google (and backup files to Google drive) has what they refer to, almost ominously, as “shared fate” on Google cloud shared responsibilities. Likewise, Amazon Web Services (AWS) have their own shared responsibility model. It’s vital customers know and understand the extent of their agreement.

Risks to Data Security

In the days of on-premises backup, the only credible risks were acts of mother nature and hardware failure. That is, of course, if you ignore software issues. Lots of software (from firmware on RAID adapters to drivers to operating system filesystem implementations and the user applications) problems would cause data loss and a need for restore, from system level down to file level. (That’s one thing I don’t miss about the ‘90s.) However, in the cloud-computing era, the risks have evolved as much as the ways in which we create, share, and store data, so things are much more complicated now. With both the prevalence and penetration of ransomware, cybercrime, and not to mention the increased access users have in order to streamline collaboration interactions and boost productivity, data—the lifeblood of a company—has, in many ways, never been more susceptible to data loss, regardless of whether it’s international (malicious actors, ransomware, etc.) or unintentional (human error, accidental deletion). Sometimes going back to basics can be the place to start in developing or hardening security.

3-2-1 Backup Method

The 3-2-1 principle comes from the days of on-premises data storage. It is still commonly referenced today in the modern, cloud-computing area. Even though it isn’t directly applicable, word for word, to cloud data, this well-known and widely used principle can still be used today to guide security decision makers in their process of improving their security infrastructure against today’s data risks.
Roughly speaking, the 3-2-1 backup rule requires 3 copies of data, across two types of storage media, with one off-site copy stored.

What Is the Origin of the 3-2-1 Rule?

Backup and recovery solutions have existed since long before cloud computing. However, the methodologies have shifted due to the modernization of the infrastructures, behaviors, needs, and of course a lot more variables (but we won’t get into that here), which has resulted in some discrepancies between best-practice principles and their application to modern data infrastructures. This is also the case with the 3-2-1 backup rule, with the biggest change being the shift of how data is created and stored (or rather where). Formerly, production data was created on site and stored in on-premises hardware, alongside one backup copy, and the third being stored off premises and typically on tapes. ComputerWeekly has a feature on if the cloud has made 3-2-1 obsolete. In the cloud era, data is created in numerous places by remote workers in SaaS applications, where it is often transferred around the globe, and is stored “somewhere else” from a business’s physical office. More than likely, the extent of an answer to the question of “where is your data stored” is that it’s in the cloud. But is that backup? And what is true backup in the cloud?

How Does the Rule Apply to Cloud Backup?

We often see iterations of this backup principle in fancy infographics that almost forget to translate the rules to apply to the current scenarios. However, with a few tweaks, there’s plenty of relevant guidance that can help lead to a successful, modern, data security system.
Let’s look at the rules with a modern lens:

3 Copies of Your Data

The ‘3’ in the rule refers to the number of “copies of your data,” with one being the primary dataset in the production environment while the remaining two copies are backups. This is still applicable to modern data protection best practices.

2 Administrative Domains

As mentioned, the ‘2’ can be understood as “two administrative domains” so that copies are managed independently from the other or are stored within separate logical environments. You often see this written as “two types of media,” which is a relic from the on-prem past when it was made up of disks and tapes. Now, it’s about having copies across multiple disks and across two administrative domains so that one data-loss event cannot possibly—or is extremely unlikely to—impact all copies of the data. This is known as a logical gap. Without it, should there be a cloud-wide compromise (such as a breach) or data loss event of the cloud where your primary data lives, your data would not be available to you. One of the best-known examples of this is the Danish shipping giant Maersk and the infamous NotPetya cyberattack, dubbed “the most devastating cyberattack in history” in the full Wired story here. When working “in” the cloud, the building you are in isn’t of any real consequence to the data. Rather, it’s the cloud you are working in and storing data in that matters. In many regards, this step could envelop the step below, “1 copy external,” but in respect to the principle, it serves us here to keep it a separate consideration. Should there be a cloud-wide compromise or data loss event of the cloud where your primary data lives, your data would still be available to you by following the rule. Without doing so, you’ve lost access to your data (or even lost your data permanently), with an impact that has a massive potential for business disruption and costs (as in the case of Maersk).

1 Copy External

Formerly the ‘1 off-site storage copy,’ this still applies for the same reasons as it did in the past: You don’t want to store all of your data in the same exact location, and whether all are aware or not, the cloud is located in physical data centers. From the on-premises days, this meant literally having a copy of disks and/or tapes in a different location from your business in case someone, something, or some event with the power to destroy the building did so. Let’s call this the “in case of fire” step. In cloud computing, this means having a backup copy outside the cloud of the production environment and outside the administrative domain of the other backup. Remember, the cloud is ‘just’ physical data centers, so by working in the cloud, the centers you are storing your data in are of real importance to the data. What if the data center of the cloud you are working in is also the same data center that your backup cloud data is stored in? Should there be a data loss event at that center, all of your data would be at risk from that event. That’s bad.

Use Case: What would this look like in real life?

If, for example, you are working on a Microsoft Word document and you save it to OneDrive that has OneDrive Backup turned on, you’re totally protected, because it says “backup,” right? This is an example where the 3-2-1 principle still helps shed light on modern data protection in the cloud. By following the 3-2-1 rule above, one can deduct that this example isn’t backup (but neither is a lot of what SaaS providers offer as ‘backup’) because true backup requires a logical infrastructure separate from the primary data. As the “in case of fire” step requires, you must have one copy outside of the administrative domain. By working in and backing up OneDrive data to Microsoft’s cloud services, the data remains in the same administrative domain. What if something were to happen to Microsoft servers? You’d lose access to your primary data and the copies “backed up” since they all relied on the same cloud. What’s even worse is that since the backup is configured by “you” (i.e., the admin), a compromise of your account can unconfigure it, too. So, a simple case of ransomware could completely and automatically disable or work around such in-service protections—even leading to immediate backup data deletion. Keepit, on the other hand – aside from being separate (and therefore unlikely to be compromised at the same time by the same mechanism), as a dedicated backup solution – will actually protect even the administrator from quickly or immediately deleting backup data. In this respect, Keepit offers some of the most desirable features of “the tape in an off-site vault” in a modern cloud service solution.

Here’s how to use the 3-2-1 backup rule to ensure you’re covered: Independent cloud

If you’re interested in further reading, check out our e-Guide on SaaS data security for a thorough look into leading SaaS data security methodologies and how companies can raise the bar for their data protection in the cloud era. Convinced you need backup, but want to know more about data protection and management for your particular SaaS application, then explore how Keepit offers cloud data backup coverage for the main SaaS applications here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

Cyber Kill Chain

Intro

This is an important concept and I want to provide you with a quick overview of what are kill chains, what is threat modelling, why we do these things, and why we need them. This understanding is crucial in creating a stable and strong security posture.

One other thing to note is that all these frameworks are generally made to complement other frameworks. For example, the UKC – Unified Kill Chain – is made to be a complement to MITRE.

Cyber Kill Chain – what is it?

This term is a military term/concept that relates to an attack, in particular its structure. Lockheed Martin (security and aerospace company) is the one that established the Cyber Kill Chain in 2011, based on the aforementioned military concept. The idea of the framework is to define the steps adversaries are taking when attacking your organization. In theory, to be successful, the adversary would pass all the phases within the Kill Chain.

Our goal here is to understand what the Kill Chain means from an attacker’s perspective, so that we can put up our defences in place and either pre-emptively mitigate that, or disrupt their attacks.

Why do we need to understand the (Cyber) Kill Chain?

Understanding of the Cyber Kill Chain can help you protect against myriad of attacks, like ransomware, for example. It can also help you understand in what ways do APTs operate. Through this understanding, as a SOC Analyst, or Incident Responder, you can potentially understand the attacker’s goals and objectives by comparing it to the Kill Chain. It can also be used to find those gaps and remediate on missing controls.

The attack phases within the Cyber Kill Chain are:

  • Reconnaissance
  • Weaponization
  • Delivery
  • Exploitation
  • Installation
  • Command & Control
  • Actions on Objectives (Exfiltration)

Reconnaissance

As we all know, this means searching for and collecting the information about system(s). In this phase, our adversaries are doing their planning. This is also where OSINT comes in, and is usually the first step an adversary will take, before going further down the chain. They will try and collect any possible piece of info on our organization, employees, emails, phones, you name it.

This can be done, for example, through email harvesting – process of collecting email addresses from online (public, paid, or free) services. These can further be used for a phishing campaign, or anything else.

Within the recon step, they also might collect the socials of the org’s employees, especially if some employee in particular might seem of interest or is a bit more of an easier target. All this information goes into the mix and is nothing new. First step – Recon.

Weaponization

After the initial recon phase, our adversary goes on to create their weapons! Usually, this entails some sort of malware/exploit combination bundled into a payload of sorts. Some adversaries will straight up buy the malware on the Darkweb marketplaces, but some more sophisticated attackers, as well as the APTs, will usually write their own malware. This is advantageous as it might actually evade your detection systems.

They can go on about this in numerous ways, but some examples might include them creating a malicious MS Office document with bad macros or VBA scripts, they could also use Command & Control techniques so that your affected machine calls to the Command server for more of those malicious payloads. (Yikes!) Or, they could add a backdoor, some other type of malware, or anything really.

Delivery

This step entails the attacker choosing a way to deliver the payload/malware to their victim. There are many options here, but in general, the most used one is good old phishing email.

With a phishing email that’s sent after the successfully completed reconnaissance phase, the attacker can target a specific person (spearphishing), or a group of employees at your organization. Within the email would be the embedded payload.

Other ways to distribute the payload may include the attackers planting infected USBs in public places, like parking lots, the streets, etc. Or, they could use a so-called watering hole attack which basically aims at a specific group of people by sending them to an attacker controlled website, by redirecting them to that site off a site they generally use but is now compromised by the attacker.

The attacker exploits the website, and then somehow tries to get the unsuspecting users to browse to the site where the victim basically downloads the malware/payload unintentionally.

Exploitation

Before finally getting access to our systems, the attackers need to carry out an actual exploit. Suppose the previous steps worked and the user downloaded or somehow ran the malicious payload, the attacker is ready for the next steps… or whatever’s in between! They can try to move laterally, get to your server, escalate privileges, anything goes.

This step boils down to

  • Victim opening the malicious file, thus triggering the exploitation
  • The adversary exploits our systems through a server, or some other way
  • They use a 0 day exploit

Whatever the vector, it comes down to them exploiting our systems and gaining access.

Installation

This step comes after the exploitation and it usually pertains to the adversary trying to keep a connection of sorts to our system. This can be achieved in many ways, for example, they might try to install the backdoor on the compromised machine, or they could modify our services, they could also install a web shell on the webserver, or anything else that helps them achieve persistence. This is key for the Installation phase.

The persistent backdoor is what will let the attacker interact and access our systems that were already compromised.

In this phase, they also might try to cover their tracks from your blue team by trying to make the malware look as if it was a legitimate app/program.

Command & Control

The Command & Control, also known as C2, C2 beaconing, or C&C is the penultimate part, and this is where the adversary uses the previously installed malware on the victim’s device to control the device remotely. This is usually built into the malware itself, and it has some sort of logic through which it calls back home to its Control server.

As the infected device calls back to the C2 server, the adversary now has full control over the compromised device. Remotely!

The most used C2 channels these days are:

  • HTTP protocol 80, HTTPS port 443 – HTTPS is interesting as it can help hide within the encrypted stream and it can potentially help the malicious traffic evade firewalls
  • DNS – the infected host will make constant DNS queries calling to its C2 server

An interesting fact – In the past, adversaries used IRC to send C2 traffic (beaconing), but nowadays it’s became obsolete as this type of bad traffic is much more easily detectable by the modern/current security solutions.

Actions on Objectives (Exfiltration)

This is your exfiltration (or exfil) step, where the adversary tries to gather all the goodies they just stole, so, user credentials, messing with the backups and/or shadow copies, corrupt/delete/overwrite/exfiltrate data. They can also escalate to domain admin, for the keys to the kingdom, or move laterally through the organization. They could also try to find vulnerabilities of your software internally, and much more.

This step depends on their specific goals/objectives, and is where all the action will happen, thus actions on objectives.

Conclusion

I hope I’ve managed to give a brief overview of this incredibly important concept. I will cover it a bit more in the future, but for now, I felt like this was a good (traditional) start. I do hope to cover the Unified Kill Chain soon, though. So – stay tuned!

Ps: you’ll notice there are a couple of other frameworks/variations aside from the Cyber Kill Chain, and I will try to explain the distinctions. Just remember these are models/methodologies and there’s no silver bullet. They should be used in conjunction with other security controls.

Image source – https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

Cover image by Linus Sandvide

#kill-chain #cyber #C2 #threat-modelling

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

Data Loss in Healthcare

As one of the most sensitive pieces of personal information, patient health data needs to be protected from data incidents or breaches. When the majority of the data is spread among multiple applications and devices though, then keeping the data safe from threats can be quite challenging. 

There are a few best practices that companies from the healthcare sector can use to boost their data security (and patient trust) straight away, though – you’ll learn about those in this article. 

How technology has changed the healthcare sector

The healthcare industry has benefited from technology in many ways. Thanks to digitized medical records stored on the cloud, doctors don’t have to spend as much time creating, updating, and managing paper records. Wearable devices and digital health apps help doctors monitor patients with long-term illnesses. There are even AI-powered applications that can record patient-doctor conversations and turn them into complete notes, saving doctors plenty of time. 

All those applications also generate enormous amounts of data every day – and this is both a blessing and a curse for the healthcare sector. A blessing because the data coming from the applications can give healthcare professionalists much more information about a patient than an interview would. That way, they can make better decisions about how to treat them and provide better patient care overall.

The amount of data being generated every single day makes it increasingly difficult to keep track of which sensitive healthcare information is stored where and who can access it though. Add to these hectic work days, a well-known dislike for paperwork among medical staff, and (unfortunately far too often) a lack of cybersecurity training, and you can see why healthcare is among the industries that experience the most data incidents. Unfortunately, Healthcare attacks are also becoming more common. This is due both to the value medical records have to criminals and that many healthcare facilities still use outdated equipment – making obtaining the records much easier for criminals.

What is the average cost of data loss/breach in Healthcare?

Healthcare has the highest average cost of data breaches at $10.10M per incident.

What’s even more worrying is that the cost of healthcare data breaches is rapidly growing. According to an IBM Security breach report, the average cost of such incident in the healthcare sector has gone up 42% since 2020 – and keeps on growing. 

The cost is so high for several reasons. The first is related to the type, and amount of data healthcare providers collect and store in their systems. In every patient’s file, there usually is: 

  • Patient’s full name and address
  • Email addresses
  • ID number
  • Billing information
  • Social security numbers
  • Medical history, together with drug prescriptions, etc.

For criminals, one such medical record is worth even 50 times more than a credit card number as they can build an entirely fake persona from the information available in the healthcare records. Then they use the new persona to purchase medical equipment on the victim’s health insurance, take loans under the patient’s name, abuse the victim’s health plan or fill insurance claims. Plus, as health records (compared to, for example, credit cards) can’t be canceled, blocked, or changed after a data compromise is noticed, healthcare companies have a much harder time containing it and minimizing the damage.

As a result, it’s estimated that now 95% of identity theft comes from stolen healthcare records – which means any data incident might pose a serious risk to the patient’s safety.

Another thing that makes healthcare data incidents so costly is how much time they take to solve them. In their 2022 report, IBM security found that the average healthcare data breach lifecycle is 329 days. 

Considering how little time healthcare professionals have during the day and how easily files (including sensitive healthcare ones) can be copied or shared without anyone noticing, it can take a long time for a clinic or hospital to discover a data incident. 

Unfortunately, when they find out about it, it’s often far too late. Their patients’ data (from social security numbers and credit card numbers to health history) has already been leaked to the darknet, and the company has now to deal with reputational damage, financial losses – and also legal consequences. 

Healthcare data breaches and legal consequences

Healthcare data breaches are so costly also because of the number of laws and regulations the industry has to adhere to these days – and the penalties for violating those are pretty hefty as well. 

The largest HIPAA violation penalty up to date, $16 million, was paid by Anthem Inc. in 2018 after a 2014 cyber attack caused a healthcare data breach spanning 78.8 million records. In addition, Anthem also had to pay $115 million to settle the lawsuits filed on behalf of the incident victims and $48 million as penalty fines. 

The second largest breach with the highest penalty was imposed on health insurance company Premera Blue Cross in 2020. The company was fined for neglecting several HIPAA requirements and causing a data incident in which hackers obtained the protected health information of 10,466,692 individuals. The company then agreed to pay a financial penalty of $6,850,000 to resolve the case and adopted a corrective action plan to address all areas of non-compliance. 

Besides that, Premera Blue Cross settled a multi-state action for $10 million and a class action lawsuit filed on behalf of victims for $74 million.

Health, genetic and biometric data are also considered special categories of data under the General Data Protection Regulation (GDPR). That’s why healthcare companies are expected to follow stricter guidelines when collecting, processing, and storing health information – otherwise, fines can be pretty steep as well.

On 23rd February 2021, the health data of nearly 500,000 people was released on the internet following a massive data breach at the DEDALUS BIOLOGIE company. The exposed data included names, Social Security numbers, the name of the patient’s primary doctor, examination dates, as well as confidential health information related to HIV, cancers, genetic diseases, pregnancies, and drug therapy. The company was then fined 1.5 million euro by the French data protection authority (CNIL) for violating GDPR articles 28, 29, and 32 requirements and causing the breach to happen. However, the investigation is still ongoing, so the final amount the company will have to pay for the violations could be much higher.

It is also becoming more common for people to file lawsuits after a breach of their data. For example, Baker Hostetler law firm analyzed more than 1,200 data security incidents from 2021 that their company helped clients manage and found that 23% of those incidents involved healthcare breaches.

That means that in case of a serious data breach, healthcare facilities may find themselves not only facing data privacy law enforcement but also private lawsuits from individuals affected by the incident. Then, companies could end up having to pay lawsuit settlements, compensation and also reimburse the breach victims out-of-pocket costs connected to the incident – which will significantly increase the costs of the breach.

How to protect patient records from loss or breach?

While enhancing the data security at the health center facility will likely take some time and effort, it will help you in the long run as it will make it easier for you to avoid data incidents or compliance violations. This way, you can both assure your patients and business partners that their data is safe with you, as well as prevent very expensive financial repercussions from healthcare data breaches.

Where should you start, though? 

Here are some things you can do to tighten up your health systems:

  • Run a security risk assessment

Both GDPR and HIPAA require healthcare providers to run an annual security risk assessment to identify potential security vulnerabilities and data threats in their networks. While those usually take some time, they are incredibly important for healthcare companies as they can give them enough information about where the patient’s data might be compromised and how you should address the vulnerabilities. 

In this way, you’ll be able to fix any vulnerabilities or issues in your network that could lead to breach or loss incidents in the future, saving you time (and money).

  • Educate your staff on best cybersecurity practices

Without cybersecurity training, your employees might not be aware of your company’s security policies or cyber risks, leading them to take risky actions – such as sending a patient’s file through social media messenger. And yet nearly a third of healthcare employees (32%) said they had never received cybersecurity training from their workplace! Lack of awareness of the breach consequences might also cause the employees to skip security procedures just to get a task done faster. This can quickly lead to healthcare data breaches though – in fact, human error accounted for 33% of healthcare breaches in 2020 alone.

To lower the number of incidents, make sure your employees know how they should work with sensitive data and what are the consequences of neglecting the procedures. Handing them an incident response plan with guidelines on how to respond when they notice a healthcare data breach would also be very helpful when it comes to preventing and dealing with data threats.

  • Limit access to health records

With hundreds of people and devices within a healthcare organization, it’s vital that you keep a close eye on who can open, edit and share patients’ health records to prevent data theft. The access permissions for the most sensitive healthcare files should be set up so that only healthcare specialists who need the specific medical records can access and edit them. 

The fewer people that have access to the health records, the less likely it is that the data might be compromised – or leaked outside.

  • Limit the use of personal devices

Healthcare professionals may find it convenient to use their personal devices for work, but these devices are usually not as secure as those they have at the clinic or hospital. Having clear policies that outline how employees can access your network/applications when using personal devices and how they should handle incidents are essential if you want to allow employees to bring and use their own devices for work. It is also a good idea to keep a close eye on what devices are added to your network and to restrict or block access to sensitive files for those you don’t recognize.

  • Keep a data audit log

Keeping data logs is an essential part of HIPAA compliance, as through those, you can quickly detect any policy violations and respond to those straight away. In addition, when an incident occurs, an audit trail will also help forensic specialists pinpoint the place where the incident started, determine the cause and suggest the best way to prevent similar issues from happening. 

Manually tracking and saving the audit log would be time-consuming and complicated though. Fortunately, here you can rely on applications such as Safetica that will create and update the audit logs for you. Then, when you’ll be dealing with a data incident, you will only have to check the data logs, and you will know where and how it started – rather than having to search the entire network.

  • Restrict what actions can be taken when working with sensitive data

In addition to monitoring which employees have access to sensitive files, it is recommended to restrict what can be done with those files to prevent unauthorized disclosures. For example, limiting or blocking sensitive file web uploads, screenshotting, copying to external drives, adding the files as mail attachments, or printing can go a long way in lowering the risk of incidents happening.  Data endpoints monitored and secured will also greatly reduce the chances of data thieves stealing confidential data as they will have far fewer options to copy or share the data without getting caught.

  • Encrypt data

Encryption is one of the most effective methods of protecting sensitive information. Even if someone unauthorized gains access to sensitive files such as patients’ medical records, the information inside the files would be unreadable to them and so they won’t be able to use the files in any way. For additional security, you can also add more encryption layers so that more than one encryption key is required to enter a system or combine the encryption with multi-factor authentication.

  • Destroy sensitive information properly

HIPAA also has stringent regulations regarding how you should destroy files and devices with patients’ data or other sensitive information to make sure no unauthorized person can use it. Failing to properly destroy the data you no longer need can cause the data to be exposed, and then you might be fined for non-compliance. 

In fact, some of the largest fines for HIPAA violations have been for failing to comply with the medical records destruction rules. For example, New England Dermatology and Laser Center had to pay $300,640 to settle an investigation into the improper destruction of medical records. 

It is recommended to hire HIPAA-compliant data destruction services for disposing of the sensitive data and the devices the data was on to ensure that they were destroyed properly and that the information can’t be recovered.

  • Backup data regularly and store it in a secure location

Whether your healthcare system crashed or your employee accidentally overwrote patient records, losing access to sensitive data can force you to spend more time restoring the files rather than taking care of your patients. Additionally, if you have to reschedule patients’ appointments or procedures because of a data incident, you risk losing their trust that their data is safe with you.

That’s why HIPAA’s final rule requires that electronically protected health information (ePHI) be backed up regularly and stored securely offsite. Ideally, you should have three backups of the data stored in different locations, as that way, you significantly reduce the chances of losing all of your data.

It’s also recommended that the backups be done daily or at least once weekly. If you don’t have time to do it yourself though, it will be a good idea to schedule automatic backups at set intervals – for example, every day at midnight. Additionally, you should make sure that only people who will need the copies for their work have access to the copies – and also that all copies are encrypted.

How can Safetica help you protect the data?

Meeting compliance and data security requirements while also giving patients the best care possible is definitely not an easy task – especially if most of the tasks related to securing the data are done manually. Safetica can take over the data security and compliance tasks to give your healthcare professionals more time to take care of your patients.  

After you set your own data privacy policies and requirements inside the platform, Safetica will monitor your entire healthcare data within and (most importantly these days) outside of the work environment, 24/7. 

What else can Safetica do for you:

  • Automatically discover, classify and secure sensitive files.
  • Analyze your environment to find out places where there’s a risk of data breach or non-compliance.
  • Ensure that all employees are following internal security policies and are meeting HIPAA/GDPR compliance requirements.
  • Respond to any suspicious activity in the manner you specified earlier (for example, it can show a warning to an employee when they are working with sensitive data).
  • Monitor all external or remote devices for potential data incidents or breaches and report all new devices added to the network. 
  • Automatically create data activity logs for audits. 

You can learn more about how Safetica can protect the data in your healthcare facility by reading our dedicated whitepaper

Conclusion

Hospitals, clinics, and healthcare providers are responsible for safeguarding patient data and critical healthcare information, as the consequences of those falling into the wrong hands can be disastrous. The average cost of a data breach is also growing – so that makes preventing various types of breaches and incidents more critical than ever.

By educating the hospital staff members and healthcare personnel, restricting access to patient data, and encrypting the data though, the number of incidents and the damage they can cause can be visibly reduced though. 

Safetica can also make keeping patient data secure easier by monitoring healthcare data and protecting it from threats. Once you combine best security practices with Safetica, you can rest assured that every piece of data within your organization’s system is safe and secure.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Safetica
Safetica is to provide small and mid-sized companies with the same quality data protection that corporations have – affordably, and without any additional IT administration or disruptions in operation.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×