[{"innerBlocks":[],"name":"core\/freeform","postId":2553,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The ransomware attack against Allscripts sent new shock waves through a healthcare ecosystem that is experiencing a steady increase in cyber attacks, with one of the nation\u2019s largest electronic health records system vendors still struggling to bring providers back online nearly a week after the initial incident.

As of Tuesday evening, the company was still working to clear its systems of malware. Its problems began on January 18 when a variant of the SamSam malware affected two of its data centers housing a subset of its products.

Of the roughly 1,500 clients impacted, none were hospitals or large independent physician practices, and services to many already have been restored, Allscripts said in a notice to customers issued Monday evening. On Friday, Allscripts said it was attempting to \u201crestore both the directly affected services\u2014hosted Pro EHR and hosted EPCS\u2014and the other unaffected services that we proactively shut down to protect clients and client data.\u201d

The incident \u201chighlights that we are all in a constant battle\u2014vendors, providers and payers,\u201d says Adam Greene, a senior health IT and privacy specialist at the Davis Wright Tremaine law firm in Washington, D.C.

The industry, Greene believes, should not judge Allscripts because of what went wrong. Any organization can work on defense in depth, and train users and staff in identifying cyber attack gambits, and it all can be negated if only one person falls victim to a phishing attack.

That\u2019s why Green preaches use of two-factor authentication, which requires IT users to provide at least one more proof of identity beyond a username and password to access a system. The technology is expensive but is another barrier in place that is generally effective in blunting threats.

\u201cLook at risks and reasonable ways to have redundancy,\u201d he advises. \u201cHave a good backup policy, test it and don\u2019t just keep it on the shelf. A massive ransomware attack is not the way to test your disaster recovery plan.\u201d

Also See<\/b>: Providers need to prepare for virulent ransomware in 2018<\/a>

Now also is the time for providers to set a plan for improved vendor management, according to Green. They should get an independent assessment of a vendor and the scope of its systems. \u201cYou also need cybersecurity insurance and have a contingency plan for any type of vendor being unavailable,\u201d he advises.

Cloud-based hosting of information system have become common and so far, cloud hosting has instilled confidence that an application, system or data will be readily available as long as a user can obtain an Internet connection, as cloud vendors often promise availability of 99.99 percent, says Tom Walsh, founder and managing partner at the consulting firm tw-Security.

Allscripts\u2019 attack occurred in a cloud environment, and it happens more often than realized. Walsh gives three examples of big and reliable cloud providers who had unplanned downtime in 2017. Google Docs had a widespread outage in North America in November; Nuance Communication\u2019s dictation systems went down in the Petya cyberattack in June; and Amazon Web Services had an outage in the eastern United States last February.

\u201cOrganizations relying on cloud service providers, especially for their electronic health record, need to conduct a closer examination of their business continuity and disaster recovery plans,\u201d Walsh asserts. \u201cThe plans need to address what to do if the cloud services are unavailable.\u201d

For example, there may be a snapshot or a copy of the EHR database on a local workstation or server. \u201cThe copy or snapshot is not the same as a fully functional EHR, but it\u2019s better than trying to treat patients with no information at all.\u201d

Walsh warns that the examples of three reliable cloud providers having downtime last year should be a wake-up call that more hosting vendors will become targets for cyberattacks and ransomware.

Attacks seem to have shifted from end user to a business or company, and now to large cloud service providers, Walsh believes.

Leigh-Anne Galloway, cybersecurity resilience lead at security firm Positive Technologies, noted that Allscripts was hit by the SamSam malware and likely wasn\u2019t a specific target of the ransomware, but victim of an opportunistic attack.

\u201cThe attack may have been prevented by having proper patch management, automatic updates and limiting user privileges,\u201d Galloway says. \u201cUnfortunately, many healthcare organizations have very limited security budgets, which can lead to lax security measures, making them easier targets for cyberattack.\u201d

Every healthcare organization needs to vet third-party vendors, according to Galloway. \u201cThis includes carrying out audits of their security controls. Patient information is extremely sensitive and should never be exposed to risks like this. But the reality is that in a lot of companies security is driven by compliance first, which is not a best practice and will almost always result in subpar security.\u201d","saveContent":"The ransomware attack against Allscripts sent new shock waves through a healthcare ecosystem that is experiencing a steady increase in cyber attacks, with one of the nation\u2019s largest electronic health records system vendors still struggling to bring providers back online nearly a week after the initial incident.

As of Tuesday evening, the company was still working to clear its systems of malware. Its problems began on January 18 when a variant of the SamSam malware affected two of its data centers housing a subset of its products.

Of the roughly 1,500 clients impacted, none were hospitals or large independent physician practices, and services to many already have been restored, Allscripts said in a notice to customers issued Monday evening. On Friday, Allscripts said it was attempting to \u201crestore both the directly affected services\u2014hosted Pro EHR and hosted EPCS\u2014and the other unaffected services that we proactively shut down to protect clients and client data.\u201d

The incident \u201chighlights that we are all in a constant battle\u2014vendors, providers and payers,\u201d says Adam Greene, a senior health IT and privacy specialist at the Davis Wright Tremaine law firm in Washington, D.C.

The industry, Greene believes, should not judge Allscripts because of what went wrong. Any organization can work on defense in depth, and train users and staff in identifying cyber attack gambits, and it all can be negated if only one person falls victim to a phishing attack.

That\u2019s why Green preaches use of two-factor authentication, which requires IT users to provide at least one more proof of identity beyond a username and password to access a system. The technology is expensive but is another barrier in place that is generally effective in blunting threats.

\u201cLook at risks and reasonable ways to have redundancy,\u201d he advises. \u201cHave a good backup policy, test it and don\u2019t just keep it on the shelf. A massive ransomware attack is not the way to test your disaster recovery plan.\u201d

Also See<\/b>: Providers need to prepare for virulent ransomware in 2018<\/a>

Now also is the time for providers to set a plan for improved vendor management, according to Green. They should get an independent assessment of a vendor and the scope of its systems. \u201cYou also need cybersecurity insurance and have a contingency plan for any type of vendor being unavailable,\u201d he advises.

Cloud-based hosting of information system have become common and so far, cloud hosting has instilled confidence that an application, system or data will be readily available as long as a user can obtain an Internet connection, as cloud vendors often promise availability of 99.99 percent, says Tom Walsh, founder and managing partner at the consulting firm tw-Security.

Allscripts\u2019 attack occurred in a cloud environment, and it happens more often than realized. Walsh gives three examples of big and reliable cloud providers who had unplanned downtime in 2017. Google Docs had a widespread outage in North America in November; Nuance Communication\u2019s dictation systems went down in the Petya cyberattack in June; and Amazon Web Services had an outage in the eastern United States last February.

\u201cOrganizations relying on cloud service providers, especially for their electronic health record, need to conduct a closer examination of their business continuity and disaster recovery plans,\u201d Walsh asserts. \u201cThe plans need to address what to do if the cloud services are unavailable.\u201d

For example, there may be a snapshot or a copy of the EHR database on a local workstation or server. \u201cThe copy or snapshot is not the same as a fully functional EHR, but it\u2019s better than trying to treat patients with no information at all.\u201d

Walsh warns that the examples of three reliable cloud providers having downtime last year should be a wake-up call that more hosting vendors will become targets for cyberattacks and ransomware.

Attacks seem to have shifted from end user to a business or company, and now to large cloud service providers, Walsh believes.

Leigh-Anne Galloway, cybersecurity resilience lead at security firm Positive Technologies, noted that Allscripts was hit by the SamSam malware and likely wasn\u2019t a specific target of the ransomware, but victim of an opportunistic attack.

\u201cThe attack may have been prevented by having proper patch management, automatic updates and limiting user privileges,\u201d Galloway says. \u201cUnfortunately, many healthcare organizations have very limited security budgets, which can lead to lax security measures, making them easier targets for cyberattack.\u201d

Every healthcare organization needs to vet third-party vendors, according to Galloway. \u201cThis includes carrying out audits of their security controls. Patient information is extremely sensitive and should never be exposed to risks like this. But the reality is that in a lot of companies security is driven by compliance first, which is not a best practice and will almost always result in subpar security.\u201d","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Fallout from Allscripts attack shows necessity of provider vigilance

More for you