Blog

In the “good old days”, the only kind of viral infections that hospitals had to deal with were those involving patients. But today, hospitals themselves are under siege – except the viruses they are trying to fend off are not biological in nature; they are digital by design.

Obviously and unfortunately, we are referring to the increasing volume and scope of ransomware attacks on hospitals worldwide. Last month alone, 10 hospitals in the Washington D.C. and Maryland-based MedStar group were hit in what the FBI suspects was a ransomware attack; one that rendered staff unable to access patient data, and even forced them to turn some patients away. And a little further north two hospitals in Ontario, Canada were attacked, including one that had its website compromised to spread ransomware via an exploit kit. Even Tinseltown has not being spared, as last month attackers took down two computers at the Hollywood Presbyterian Medical Center – only relenting when hospital officials forked over roughly $17,000 in Bitcoins. These are just some of the many horror stories that are making the headlines; doubtless they are just a precursor for what lies in the months and years ahead.

Opportunity Knocks…and Knocks…and Knocks

At first, the attacks on hospitals were likely opportunistic, with cyber criminals indiscriminately trying to victimize anything and anyone they could: police stations, universities, government offices, corporations, hospitals, and so on. Yet now, we are clearly seeing a trend as cyber criminals realize that hospital computers are both essential for day-to-day operations and vulnerable to attack. The convergence of those two factors is the perfect storm for ransomware.

Protecting Operations & Endpoints

Yet, if the above sheds light on why more hospitals are being victimized, the even bigger question remains: why are hospital computers vulnerable in the first place? It is likely because over the last few years, hospitals have been investing substantial resources and effort to protect patient data; both because it is the law, and also because fines for breaches can be in the millions. This bright spotlight on protecting patient information and complying with HIPAA has, arguably, taken some of the focus off endpoint security. And as we all know, cyber criminals do not need much of an opening. They are notoriously opportunistic, and need the smallest of openings to inflict significant damage.

One Click is All it Takes

Unfortunately for hospitals, this “smallest of openings” that cyber criminals are exploiting – endpoints – are the largest area of the attack surface, which is why they are targeting employees via emails (links, attachments, etc.) and web browsers (e.g. malvertising, drive-by-downloads, etc.). Indeed, even the most vigilant and informed employee shuffling through hundreds of emails and websites a day is bound to make a mistake every now and then; to say nothing of employees who are not particularly watchful or well-trained. And since it only takes a single infection to trigger a full-scale network breach, the more apt question that hospital officials need to ask is not “will we be attacked?”, but rather “when will we be attacked?” (Followed by the even more disturbing “and how do we actually know that we are not under attack right now?”)

Protecting Endpoints — and Safeguarding Hospitals

Fortunately, hospitals can proactively fortify their endpoints – whether it is hundreds, thousands or tens of thousands of laptops and computers – with BUFFERZONE.

BUFFERZONE isolates internet applications in a secure, virtual container that prevents employees from inadvertently downloading malware and putting the hospital at risk. Any actual or suspected malware is trapped in the container and wiped by IT staff either locally or remotely. Furthermore, BUFFERZONE protects hospitals by effectively placing a firewall between the container and the corporate network, which ultimately prevents the spread of infection as well as data exfiltration.

And while all of this happening, employees get seamless access to internet applications, mail and removable storage – so they can remain productive and efficient. After all, hospitals need to focus on helping patients fend off viruses, and not get overrun by them on their endpoints and networks!