April 2015 – RISC Management and Consulting

The White House has been in the news over the past two weeks in reports from USA Today, CNN, NBC News, and many more sources. Officials informed NBC News (Mitchell, 2015 April) that it is believed the Russians accessed the system through State Department computers which contained private unpublished schedule of President Obama. While attribution usually takes weeks or months for the FBI’s Cyber Division to determine and publish, the sources of the attacks are less important than the objective. The objective is similar across all of these attacks; to retrieve classified information. According to former FBI official Shawn Henry and the president and CSO of CrowdStrike Services cyber-attacks occur because countries such as China and Russia have the need to look at U.S. polices, how policies are created, new initiatives that are under consideration, basically anything that these foreign countries can get that will provide them with some advantage at the next level of trade talks and collect intelligence against the US for personal gains.

Healthcare organizations need to understand the criticality, reasoning, and determination for these attacks as well. When VIPs such as political or military leaders are seen or treated by their facility, or by a facility they are affiliated or networked with, their systems, networks, and data become a high priority target for foreign threat actors. Healthcare organizations often fail to realize how important their health information data repositories are for reasons entirely Unrelated to identity theft or medical billing fraud. Basic healthcare information about a head of state, a state department official involved in a negotiations process, senior leadership in the military or a congressional committee is incredibly important to both Nation-State actors and Terrorist organizations. Healthcare providers have no idea that cyber-bullets are flying by their ears in this electronic war!

On April 1^st, 2015, President Barack Obama sent out an Executive Order titled “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled activities”. Here’s a short excerpt from the Executive Order:

Only a few months ago on January 13th, President Obama announced a legislative National Data Breach Notification standard and miscellaneous cybersecurity legislative proposals and efforts. The Executive Order should provide the U.S. government the tools needed to combat the expanding malicious cyber activities. The Executive Order enables the Treasury Department along with the Attorney General and the Secretary of State to impose sanctions on the unlawful actions created by hackers. The goal would be to freeze targets’ assets when operating in the U.S. financial system and prohibiting them from having transaction with American companies.

Both Public and Government sectors must pay immediate and substantial attention to this existing and evolving threat!

References

Henry.S. (2014, November 17). Cyber attacks hit State department email, web. Retrieved from http://www.cnn.com/videos/bestoftv/2014/11/17/lead-intv-henry-state-department-hacking.cnn

Hollywood Reporter. (2015, April 1). Obama creates federal sanctions to deal with cyber attacks. Retrieved from https://www.youtube.com/watch?v=dNFdUphnU18

Mitchell, A.(2015, April). Russia hacked White House last year, U.S. officials says. Retrieved from http://www.nbcnews.com/news/us-news/russia-hacked-white-house-last-year-u-s-officials-say-n337521

Whitehouse.gov. (2015, April 1). The White House: Executive order. Retrieved from https://www.whitehouse.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m

Phishing is a form of social engineering and works like a con game. A phishing attack is performed using email, a malicious website, or even a direct phone call to the victim. The many purposes of phishing include collecting personal information, gaining access to corporate information, gaining access to corporate information systems, installing malware, or even holding data hostage by changing local encryption keys! The information that is accessed or copied by the attacker is used for gaining access to your accounts such as your financial accounts, committing identity theft, gaining access to corporate networks and systems, changing credentials, or even holding your data hostage.

Social Engineering can be a positive or negative attack using human interactions to obtain information about your organization. The person attacking could potentially be someone hired by the company to locate gaps in their security or, more likely, maliciously by those wanting to hurt you or your organization. During the attack, the person will seem unassuming, or even helpful, and be able to blend in with the employees. Through this process, he/she/they are able to ask questions, retrieve data, take photos for evidence if hired by the company or infiltrate the office or department.

The attacker might send a false e-mail often that look surprisingly legitimate, and may seem valid. However, it is important to view the URL in the address field which can tell you if the page you have been directed to is not valid. The email might come from a credit card company requesting you to respond and might often come from other types of organizations such as charities during a natural disaster, holidays, etc. Some phishing attacks involve a phone call directly to the target, where the attacker often claims to be another employee, perhaps calling from the I.T. Helpdesk.

According to the U.S. CERT and IRS remaining alert and knowing the tricks can assist you in avoiding or repelling these malicious attacks. Here are their explanation (2015, January 30):

Spot common elements of the phishing lifecycle

A Lure: enticing email content.
- Example 1 of actual phishing email – see below
- Example 2 of actual phishing email – see below
A Hook: an email-based exploit.
- Email with embedded malicious content that is executed as a side effect of opening the email
- Email with malicious attachments that are activated as a side effect of opening an attachment
- Email with “clickable” URLs: the body of the email includes a link, which displays as a recognized, legitimate website, though the actual URL redirects the user to malicious content
A Catch: a transaction conducted by an actor following a successful attempt.
- Unexplainable charges
- Unexplainable password changes

Again, don’t be a victim and watch for any unexplainable changes to your financial accounts. If you think there’s a slight chance that your sensitive information was breached, change your passwords immediately. If you use the same passwords in multiple areas, it is important to change each one of those accounts as well. Remember not to use that particular password again in the future.

If you receive a phone call that you suspect of being a phishing attack, tell the caller that you need to call them back at the number you know to be the person or department they represent. For example, if the caller claims to be from the I.T. Helpdesk, tell them you are calling them back at the officially listed number (Never at the number the caller gives you), and hang up. Using a corporate directory, a known number, or a number in your contact list on your corporate-owned phone, call that department back and verify the communication to you, and their request. Never connect to a remote access service such as GoToMyPC, or setup a remote service request through Microsoft Windows when receiving a phone call that you did not initiate.

References

Mitnick. K.(2000, March 2). Frontline: The testimony of an ex-hacker. Retrieved from http://www.pbs.org/wgbh/pages/frontline/shows/hackers/whoare/testimony.html

Phishing. (2015). TechTerms.com. Retrieved from http://techterms.com/definition/phishing

U.S. Computer Emergency Readiness Team. (2013). Security tip (ST04-014): Avoiding social engineering and phishing attacks. Retrieved from https://www.us-cert.gov/ncas/tips/ST04-014

U.S. Computer Emergency Readiness Team. (2015, January 30). Security Tip(ST15-001): IRS and US-CERT Caution users. Retrieved from https://www.us-cert.gov/ncas/tips/ST15-001