While healthcare sector organizations around the country are racing to respond to the COVID-19 crisis, cybercriminals are using the chaos to launch new scams, schemes, and attacks. I'm Marianne Kolbysak-McGee, Executive Editor at Information Security Media Group. Today I'm speaking with Attorney Jason G. Weiss of the law firm Fagre, Drinker, Biddle & Reef.
Jason, a former FBI special agent and forensics expert, will discuss some of the latest cybercrime trends amid the COVID-19 crisis. So Jason, based on what we're seeing in terms of cyberattack trends during COVID-19, it does not appear that the cyber criminals have much empathy for what the health care sector is going through. What sorts of new or evolving attacks are we seeing on the health care sector that are most disturbing to you? Well, you're definitely seeing a huge increase in ransomware attacks.
And that, I think, is directly related to the fact that the hospitals are dealing with so much life and death that I think the cyber criminals are trying to play off that by ransoming important hospital activities and data, knowing that the hospitals have very little choice but to try and pay in order to keep people alive. So there's been recent FBI press releases. There was just a press release by the Department of Homeland Security in conjunction with the United Kingdom's National Cybersecurity Center, kind of highlighting this growth in ransomware and other types of cyber attacks. There has been a huge increase in cyber activity and cyber attacks since COVID-19 has become a problem.
So Jason, with that said, what's your advice to entities in terms of preventing or responding to these ransomware attacks right now, especially while IT and security teams at healthcare sector entities are already dealing with so much? Is there that temptation to pay just to get things going again? There's always that temptation to pay. Putting on my 22-year FBI law enforcement hat, we were always opposed to the payment of any ransom, but obviously hospitals have to decide for themselves how they want to handle this and what they want to do, but that's why there are resources out there to help them.
Obviously, law enforcement, obviously law firms like ours, we're all there working together to try and help the hospitals through this incredibly difficult time. The best thing they can do right now is to make sure that their IT folks have done everything in their power to lock down as much of the network as possible, remind employees constantly not to click on links from emails they're unaware of to prevent phishing attacks and similar type of schemes that cause these type of malware incidents to take place. It really got to be all about training and it really complicated because so many people are telecommuting and teleworking right now That really led to I think a big problem because I don know if companies were completely prepared to move to a telecommuting environment so quickly and have the proper security channels in place So this is definitely a dangerous time in our battle against COVID-19 when it comes to cybersecurity. What other attacks are you most worried about these days?
Basically, we've seen the growth in 2020 of a new phenomenon called disruptionware. And disruptionware is kind of ransomware on steroids. Although ransomware is a tool in the disruptionware toolkit, disruptionware is also primarily aimed at health care providers as a means to garner money and income and such. But what disruptionware does is it doesn't focus on just encrypting data for a ransom.
It literally attacks or threatens to attack the infrastructure of the victim. So going into a hospital, if you can launch a successful disruptionware attack, you can literally shut down operating rooms, breathing machines, respirators, ventilators, and then you can see how that could be a powerful tool for ransom demands and such. And I think hospitals need to really start looking at disruptionware as being the great threat of 2020 and beyond. And, you know, I believe that disruptionware is really going to become the true threat of the next couple of years because it's so much more destructive than ransomware.
It includes a lot more than ransomware. Ransomware is just one component of a disruptionware attack. So that's something I think that I see people from around the country when they're setting up their incident response plans or their disaster recovery plans. I think they really need to look into disruptionware and start planning on how to defend themselves against a disruptionware attack.
Now, Jason, you mentioned the surge in telecommuting. What about the so-called Zoom bombing attacks that we're seeing on the popular teleconference platform Zoom as well as other remote work types of platforms? What are you seeing, and what is your advice to prevent falling victim to these attacks? Zoom bombing is the term, but it really does apply to all the software applications that deal with telecommuting.
So it's not just limited to Zoom only. But the biggest problem is that people are not securing their Zoom sessions. For example, every Zoom session or any telecommuting session you set up should be password protected. You should have waiting rooms so you can control who you allow into the room and out of the room.
Believe it or not, you should be very careful to make sure you patch your telecommuting software because most of the companies have come up with recent updates to try and prevent some of the auto-dialing attacks and other types of cyber attacks that people have used to infiltrate the Zoom because there is a lot of software out there that is designed to help people break into these type of telecommuting environments And most of these attacks can be stopped with proper security precautions in place starting with making sure that you don put your information on social media If you going to have a Zoom or a telecommuting session direct connect with people tell them when and where, send them the room address, but don't put it on social media. Make sure that you have a password to the room. Make sure that that password is protected. These are the kind of things you can do in a simple context that would probably keep out about 90% of the script kiddies that are trying to jump in and post stupid articles or pornography or do what they can.
And this is not just a problem for the work. It's been a problem for the government. It's definitely been a problem for the school. It got so bad that certain nation states, like the country of Taiwan, has just shut down all Zoom sessions for official government communications.
I mean, it is a legitimate problem out there. And the only way for people to deal with that is to do everything you can to put in the proper security precautions to prevent these types of attacks from happening. So Jason, what about potential healthcare fraud related to COVID-19? What sorts of schemes should entities be ready to address when it comes to COVID-19 and medical billing fraud and other sorts of fraud, for instance?
Basically, the first and foremost, we have to shut down and stop the phishing attacks. And phishing attacks are almost exclusively caused by employees who are either untrained or unprepared or, in this case, overworked, who are clicking on these links from emails that they don't recognize or they don't know who the person is, and they're allowing this type of malware into the network, and that's causing havoc. And part of that is just because the healthcare industry is so severely overworked right now that people get tired and tired people make mistakes. So it really comes down to due diligence and vigilance and doing everything you can to ensure that you don't let the bad guys into the front door.
And we're seeing quite a lot of that in our practice. Quite frankly, the health care industry is under siege because the cyber criminals know that almost all health care resources are going directly toward dealing with the COVID-19 crisis. So, Jason, in addition to the fraudsters that are out there, you know, the cyber criminals, there's also the insiders that health care entities also need to be keeping their eye on, especially as health care entities have expanded telecommuting and telehealth services. And is there a possibility that that quick expansion could fuel more cyber crime or malicious incidents involving insiders?
and what sorts of steps should entities be thinking about in terms of preventative steps against these sorts of threats and also detection? People don realize that probably somewhere in the neighborhood of 75 to 80 of cyber attacks happen from within you know basically internal actors So there always that risk that you have to worry about a bad apple helping somebody from the outside break in or committing their cybercrime from behind the firewall The problem with the immediate rush to telecommuting and teleconferencing is that employees have been properly trained on the precautionary safeguards they need in order to keep their system as secure as possible, which has, of course, led to the growth of Zoom bombing. It's literally interrelated. It's almost circular in nature.
And the best thing that hospitals and employers can do right now is provide as much teletraining as they can. Obviously, we want to make sure your software is patched. For example, Zoom. Zoom understands the Zoom bombing phenomenon as well as anybody.
It's just recently come up with a bunch of security patches within the last week to try and shut down some of the problems from people cracking into Zoom sessions. So patching is going to be very important. What's also going to be important is basically teleeducation, for lack of a better term, where companies are constantly reminding their employees, if you're going to telecommute, there's got to be a safe and secure manner in which to do it and some of the tips and tricks on how to do it. Like with our firm, we use virtual private networks.
We have password-protected rooms. We don't put our data out on social media, so it's not open to the public. and those type of defenses will cut down in an inordinate amount of cyber attacks just because most of the cyber criminals out there are what we used to call the FBI script kitties. People who are not really cyber proficient, but they're able to run scripts that are off websites that can infiltrate or cause problems.
And these are the things they can do right now to prevent a lot of these problems from happening. So Jason, once the COVID-19 pandemic subsides and the crisis involving the response to the actual disease is over, any predictions in terms of what the cybersecurity and information privacy cleanup will look like for healthcare sector entities? What will be broken that will need to be now fixed? After any breach, incident response type activity you always conduct in after action review.
And I think that same type of philosophy should be used here. We need to figure out what went right and what went wrong. And we have to ask people to start updating their disaster recovery plans, their incident recovery plans, to include an immediate switch to telecommuting or teleconferencing and the security precautions and safeguards that need to be put in place. There'll be a great opportunity when the COVID-19 virus is finally dead for us to look back on what went right and what went wrong and start putting security precautions in place.
So when this happens next time, and unfortunately there probably will be a next time, people will be much, much better prepared from a security and a cyber safety standpoint. Thanks, Jason. I've been speaking to Attorney Jason G. Weiss.
I'm Marianne Kolbysak-McGee of Information Security Media Group. Thanks for listening.