Find news and information for the executive corporate security director, CSO, facility manager and assets protection manager on issues of policy, products, incidents, risk management, threat assessments and preparedness.
Issue link: http://sdi.epubxp.com/i/703941
30 Security Dealer & Integrator / www.SecurityInfoWatch.com July 2016 they probably aren't asking for pure soware to protect virtual networks against malware and antivirus and firewalls — they are asking for phys- ical security," Warren says. "e inte- grator's challenge at that point is to not only look at the building, but to also look at the threats that the cus- tomer perceives need to be mitigated by working with the integrator." us, while recommending cybersecurity soware or a managed service provider is a major aspect of data protection — and a key one as the security integrator endeavors to be a trusted security resource for the customer (be sure to direct them to the American Hospital Association's cybersecurity resource area at www. aha.org/advocacy-issues/cybersecurity. shtml) — a major part of protecting against a data breach is protecting the areas that house the data from a physical standpoint. Warren says it is incumbent on the integrator to educate the end- user about the potential risks — from either hanging a new camera on a network, or a physical threat. "What I found personally is if they can take real-world examples, it is very effec- tive," he says, "like recommending restricted access in a particular area because three years ago in a similar facility, an employee used a particular type of entryway door to gain access and it caused a major security breach. e customer sees you as someone who knows what they are talking about, and it gives the integrator cred- ibility that they understand what the end-user is trying to protect." To take that a step further, War- ren warns that integrators themselves must stay vigilant when inside the healthcare facility doing the actual work, as that is among a facility's most vulnerable moments. "Not only do the integrators need to have the end-game in mind, but when they are actually on site doing the work they need to edu- cate themselves and their subcontrac- tors that some basic security will have to be taken down in order to install the new technologies — and that's an opportunity for the bad guys. A lot of subcontractors may not realize that." Finally, the security of the devices that integrators hang on the network themselves is paramount. "Physical security devices can be used by attackers to pivot into a network, so it is important that security integrators have a good grasp on their own security — as they are potential targets for attackers trying to gain access to their larger clients," Maude says. "Alternatively, they could be integrating systems into networks that are already infected with malware, so it is crucial that they are confident in their own security to avoid being held to ransom themselves for a client's mistake." The Ransomware Threat While malware and related cyber attacks have not traditionally been the purview of physical security integra- tors, the convergence of physical and IT security means the lines are being blurred. us, to gain a complete per- spective on the security posture and problems of healthcare facilities — and to be their trusted security advi- sor — security integrators must be cognizant of the ransomware threat. "One of the most devastating trends is ransomware — hackers infiltrate systems, oen via phishing attacks, and use malware to appropriate cre- dentials that allow them to go wher- ever they need to find unprotected sensitive and PHI data, which they hold hostage using encryption before demanding money in exchange for restoration of access," explains Suni Munshani, CEO of Protegrity, an enterprise data security provider. e FBI says ransomware attacks have increased so much that compa- nies have already paid more than eight times the ransom payments so far in 2016 than they did in all of 2015. Ransom demands vary, but an example is Hollywood Presbyterian Medical Center, which was attacked this Februrary and was reported to have paid $17,000 in Bitcoin aer negotiations — during which nearly 1,000 patients had to be relocated to other hospitals. Cover Story Hackers infiltrate systems, often via phishing attacks, and use malware to appropriate credentials that allow them to find unprotected sensitive and PHI data, which they hold hostage using encryption before demanding money in exchange for restoration of access." — Suni Manshani, CEO, Protegrity