A Socio-technical Approach to Preventing, Mitigating, and Recovering from Ransomware Attacks

Dean F. Sittig; Hardeep Singh

doi:10.4338/ACI-2016-04-SOA-0064

Applied Clinical Informatics, Table of Contents

Appl Clin Inform 2016; 07(02): 624-632
DOI: 10.4338/ACI-2016-04-SOA-0064

State of the Art / Best Practice Paper

Schattauer GmbH

A Socio-technical Approach to Preventing, Mitigating, and Recovering from Ransomware Attacks

Dean F. Sittig

¹University of Texas Health Science Center at Houston, School of Biomedical Informatics and UT-Memorial Hermann Center for Health Care Quality and Safety, Houston, Texas

,

Hardeep Singh

²Houston Veterans Affairs Center for Innovations in Quality, Effectiveness and Safety, Michael E. DeBakey Veterans Affairs Medical Center, Houston, Texas

³Section of Health Services Research, Department of Medicine, Baylor College of Medicine, Houston, Texas

› Author Affiliations

Abstract

Full Text

PDF Download

Keywords

Health information technology - electronic health record - socio-technical - cybersecurity - ransomware

References

References
1 Kandel J, Kovacik R. Hollywood Hospital ‘Victim of Cyber Attack’. NBC4 News. February 12, 2016 Available at: http://www.nbclosangeles.com/news/local/Hollywood-Hospital-Victim-of-Cyber-At tack-368574071.html
2 Steffen S. Hackers hold German hospital data hostage. Made for Minds. 25 February 2016 Available at: http://dw.com/p/1I2Xu
3 Olenick D. The Ottawa Hospital fends off ransomware attack. SC Magazine. 14 March 2016 Available at: http://www.scmagazine.com/the-ottawa-hospital-fends-off-ransomware-attack/article/482921/
4 Krebs B. Hospital Declares ‘Internal State of Emergency’ After Ransomware Infection. Krebsonsecurity.com. March 16, 2016 Available at: http://krebsonsecurity.com/2016/03/hospital-declares-internet-state-of-emergency-after-ransomware-infection/
5 Simms B. FBI investigating computer virus at MedStar Health. WBALTV11.com. March 29, 2016 Available at: http://www.wbaltv.com/news/fbi-investigating-computer-virus-at-medstar-health/38731548
6 Gallagher S. Two more healthcare networks caught up in outbreak of hospital ransomware. Ars Technica. March 29, 2016 Available at: http://arstechnica.com/security/2016/03/two-more-healthcare-networks-caught-up-in-outbreak-of-hospital-ransomware/
7 Sullivan T. More than half of hospitals hit with ransomware in last 12 months. Health IT News. April 07, 2016 Available at: http://www.healthcareitnews.com/news/more-half-hospitals-hit-ransomware-last-12-months
8 Sittig DF, Classen DC, Singh H. Patient safety goals for the proposed Federal Health Information Technology Safety Center. J Am Med Inform Assoc 2015; 22 (02) 472-478 doi: 10.1136/amiajnl-2014–002988.
9 Fischer T. Private and Public Key Cryptography and Ransomware. Center for Internet Security (CIS). December 2014 Available at: https://msisac.cisecurity.org/whitepaper/documents/10.pdf
10 Gazet A. Comparative analysis of various ransomware virii. Journal in computer virology 2010; Feb 1; 06 (01) 77-90.
11 Mun J. Trojan.Gpcoder. Symantec. May 22, 2005 Available at: https://www.symantec.com/security_re sponse/writeup.jsp?docid=2005-052215-5723-99
12 Giri BN, Jyoti N. The Emergence of Ransomware. 9th Annual Association of anti-Virus Asia Researchers (AVAR) International Conference – Digital Security: Prevention to Prosecution. Auckland, NZ: 2006 Available at: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.169.5881&rep=rep1&type=pdf
13 Largent W. Ransomware: Past, Present, and Future. April 11, 2016 Available at: http://blog.talosintel.com/2016/04/ransomware.html
14 United States Computer Emergency Readiness Team. Alert (TA16–091A): Ransomware and Recent Variants. Original release date. March 31, 2016 Available at: https://www.us-cert.gov/ncas/alerts/TA16-091A
15 National Institute of Standards and Technology. Framework for Improving Critical Infrastructure Cybersecurity. Version 1.0 February 12, 2014 Available at: http://www.nist.gov/cyberframework/upload/cy bersecurity-framework-021214.pdf
16 Sittig DF, Singh H. Electronic health records and national patient-safety goals. N Engl J Med 2012; 367 (19) 1854-1860 doi: 10.1056/NEJMsb1205420.
17 Singh H, Sittig DF. Measuring and improving patient safety through health information technology: The Health IT Safety Framework. BMJ Qual Saf 2016; 25 (04) 226-232 doi: 10.1136/bmjqs-2015–004486.
18 Gallagher S. Maryland hospital: Ransomware success wasn’t IT department’s fault: MedStar denies ransom payment, denies earlier JBoss bugs played role. Ars Technica. Apr 7, 2016 Available at: http://arstechnica.com/security/2016/04/maryland-hospital-group-denies-ignored-warnings-allowed-ransomware-attack/
19 Gallagher S. Maryland hospital group hit by ransomware launched from within [Updated] Samsam malware injected into network from exploited web app server at MedStar. Ars Technica. March 31, 2016 Available at: http://arstechnica.com/security/2016/03/maryland-hospital-group-hit-by-ransomware/
20 DHHS Office for Civil Rights. HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework. Available at: http://www.hhs.gov/sites/default/files/NIST%20CSF%20to%20HIPAA%20Security%20Rule%20Crosswalk%2002–22–2016%20Final.pdf
21 Wright A, Sittig DF. Security threat posed by USB-based personal health records. Ann Intern Med 2007; Feb 20; 146 (04) 314-5.
22 Hoffman C. How To Spot A Dangerous Email Attachment. 20 Jan 2014 Available at: http://www.make useof.com/tag/spot-dangerous-email-attachment/)
23 DNS-BH – Malware Domain Blocklist. Available at: http://www.malwaredomains.com/
24 Protection of Information Assets: CISA Tutorial. Available at: http://www.simplilearn.com/protection-of-information-assets-cisa-tutorial-video
25 Scarfone K, Souppaya M, Cody A, Orebaugh A. Technical Guide to Information Security Testing and Assessment: Recommendations of the National Institute of Standards and Technology. NIST Special Publication 800–115. September 2008 Available at: http://csrc.nist.gov/publications/nistpubs/800-115/SP800-115.pdf
26 Youngstrom N. Hospital Uses Fake Phishing Emails in Security Training; Will Move to Gamification. Report on Medicare Compliance. 25. 17; May 9, 2016
27 Van Vlasselaer V, Bravo C, Caelen O, Eliassi-Rad T, Akoglu L, Snoeck M, Baesens B. APATE: A novel approach for automated credit card transaction fraud detection using network-based extensions. Decision Support Systems 2015; 75: 38-48.
28 Bilge L, Dumitras T. Before we knew it: an empirical study of zero-day attacks in the real world. In Proceedings of the 2012 ACM conference on Computer and communications security 2012; Oct 16 833-844.
29 Singh H, Classen DC, Sittig DF. Creating an oversight infrastructure for electronic health record-related patient safety hazards. J Patient Saf 2011; 07 (04) 169-174 doi: 10.1097/PTS.0b013e31823d8df0.
30 Sittig DF, Gonzalez D, Singh H. Contingency planning for electronic health record-based care continuity: a survey of recommended practices. Int J Med Inform 2014; 83 (11) 797-804 doi: 10.1016/j.ijmedinf.2014.07.007.
31 Siwicki B. Tips for protecting hospitals from ransomware as cyberattacks surge. HealthIT News. April 6, 2016 Available at: http://www.healthcareitnews.com/news/tips-protecting-hospitals-ransomware-cyber-attacks-surge
32 Sittig DF, Singh H. A new sociotechnical model for studying health information technology in complex adaptive healthcare systems. Quality and Safety in Health Care 2010; 19 (Suppl. 03) i68-i74.