U.S. Businesses Warned About Ransomware Cyber Attacks

In light of the ransomware cyber-attack on a United Kingdom hospital and across Europe last week, Joseph R. Riccie, CPA, a partner with the nationally ranked top-30 CPA firm WithumSmith+Brown, PC (Withum), offers the following commentary regarding the need to appropriately identify risks and vulnerabilities in healthcare settings nationwide. The latest strike comes about a year after similar attacks on Kentucky and California hospitals.

Riccie, who is the practice leader of the firm’s Cyber & Information Security Services, notes healthcare cybercrime is big business. According to Dell, hackers can sell health insurance credentials, bank accounts, social security numbers and counterfeit documents for upwards of $1,000 per dossier (July 15, 2013, EMC).

How Deep Does Risk Go?

“As more organizations within the industry turn away from paper-based processes, the threat for cyber-attacks grows. Organizations need to coordinate their efforts throughout the whole information system, protecting all information, not just what is considered the most important or the first layer.

“About 55% of cybersecurity attacks go unnoticed by commercial antivirus software, putting many organizations at more of a risk than they realize. The data is being sold on the ‘dark web’ – part of the World Wide Web that is purposely hidden and not accessible through normal web browsers. This allows users to remain anonymous.”

Protecting Against Cyber Risk: Keeping Data off the Dark Web

“Ask yourself, what organizational policies are in place for social media, bringing your own device (BYOD) and employee access to your network? Healthcare organizations today can take precautionary measures against attacks with periodic assessments of their networks.

“By assessing an organization’s current state of readiness regarding its ability to identify, detect, protect, respond and recover from security incidents, they put themselves in a position to achieve a targeted level of readiness moving forward. This puts the organization in a position of strength.”

How do Organizations Ensure Cybersecurity?

“The number of successful cyberattacks in the U.S. has grown by 144 percent in the past four years, and the rest of the world is very close behind. During this same timeframe, the cost to the average company has almost doubled since advanced attacks now persist in the network about seven months before they are detected. Impairing this situation further is that once detected, resolution of the attack takes about 45 days, an increase of 221 percent.

“Determining an organization’s cyberattack preparedness is more critical now than ever. Every business, regardless of size and industry, must evaluate several critical areas. Are periodic cybersecurity-focused risk assessments performed? Is there an enterprise security plan? Is the right team with the right expertise in place? What functions and technologies have been deployed to protect the organization? What initiatives are in place to keep employees informed and updated regarding cybersecurity?

“This is just the tip of the iceberg. Cyber attackers are becoming even more sophisticated in their tactics as our society becomes even more entrenched in digital record keeping. Cybersecurity is an area that needs to be addressed sooner rather than later.”

As the market leader for Withum’s Cloud Solutions & Management Consulting as well as the Cyber & Information Security Services practice, Riccie possesses extensive financial and operational management experience, with specialization in managing global programs and leading all aspects of change management and enterprise transformation.

Small Business