Download to read offline
Uploaded byBarry Caplin
It’s not If but When 20160503
The document discusses the increasing threat of ransomware attacks in healthcare, emphasizing that it is a matter of 'when' rather than 'if' such breaches will occur. It highlights the financial impact of these attacks, noting that recovery costs often exceed the ransom demands, and outlines the critical role of Chief Information Security Officers (CISOs) in managing incident responses, communication, and preparedness. Additionally, it emphasizes the importance of proactive measures, such as understanding risks and developing robust response plans.
More Related Content
Similar to It’s not If but When 20160503
It’s not If but When 20160503
- 1. IT’S NOT IF…BUT WHEN CISO Assembly, Dallas, TX bcaplin1@fairview.org bc@bjb.org @bcaplin http://about.me/barrycaplin http://securityandcoffee.blogspot.com Barry Caplin Chief Information Security Official Fairview Health Services
- 2.
- 3. o Not-for-profit establishedin 1906 o Academic Health System since 1997 partnership with University of Minnesota o >22K employees o >3,300 aligned physicians o Employed, faculty, independent o 7 hospitals/medical centers (>2,500 staffed beds) o 40-plus primary care clinics o 55-plus specialty clinics o 47 senior housing locations o 30-plus retail pharmacies 2014 volumes o 6.39M outpatient encounters o 1.4M clinic visits o 71,049 inpatient admissions o 76,595 surgeries o 9,298 births o 282 blood and marrow transplants o 340 organ transplants o >$4 billion total revenue
- 4.
- 5. 2015 – Yearof the Breach 2014 – Year of the Breach 2013 – Year of the Breach 2016 – Availability? Integrity?
- 6. BOARD REPORTING EXAMPLE •Ransomware first appeared in 1989; large growth since 2013 • 2016 Hollywood Presbyterian – first publicized healthcare org to pay • $17K ransom paid • Systems down for over 1 week – ER, OR, imaging, lab, pharmacy • MedStar, MD – 10 hospital network • $3+ days of outages – 4 ERs, all inpatient shut down • 4/7/16, all systems back up • Most attacks are through email attachment or link based • Systems must be taken down to stop spread
- 7. BOARD REPORTING EXAMPLE •Estimated >$325M paid in ransoms in 2015 • Some variants charge $100-$500 per workstation • Some are “flat fee” • Often the cost of downtime and recovery is more than the ransom • It’s not “if”, but “when” an attack will happen • There is no “prevention” – Each attack is new and unique • There are “proactive/prevent” responses, and “detect/remediate” approaches • We do pursue both
- 8. •Can we prevent? •It’snot If, but When •Is Incident Management the key part of our job? •How we respond makes a difference
- 9. •How to start: •Figureout where your “stuff” is •Figure out the risks to your “stuff” •Figure out how you will react if that risk manifests •Write it down – Playbooks •Practice •Know what’s normal - Monitor Incident Response
- 10. CISO’s Role •Leadership •Communication –Internal/External • Staff/Exec/Board • Law Enforcement • External Counsel • Media • Regulatory
- 11. CISO’s Role •Incident Response/Forensics •Outsource? • Pre-pay? • Retainer? •Cyber Insurance – What is covered? How does it pay? •Tabletop – Exec Breach exercise
- 12. Discussion Questions •Can you“defend” you architecture/tech choices? •Can you detect problems, attacks and IoC’s against your enterprise? •Do you have response plans? Have you exercised them? •Do you have communication plans? Have you exercised them? •Does your C-suite have your back? Why?
Editor's Notes
- #3 Check out my about.me, with links to twitter feed and Security and Coffee blog.