Cyber Attacks ≠ Compliance

In our recent “Cyber Threats Cannot Compete with Strong Compliance” blog, we covered cyberattacks in the financial and retail industries and the importance of visibility, network access and control, and risk management to achieve strong compliance, defend against cyberattacks, and grow a successful and secure business. In this blog, we take a quick look at the attacks that hit government and medical industries, the regulations these verticals face and how to build a strong compliance foundation. A deep dive into each of these verticals can be found in “The Compliance as a Strategy for Business Success eBook”.

The DNC Got Phished

How did Russian hackers gain access to the email correspondences of the Democratic National Convention throughout the recent US election? The answer is by using the oldest trick in the book: phishing emails. In one case, John Podesta, chairman of Hillary Clinton’s campaign received a phishing email, which was in fact correctly identified as such by an aide. The problem was that the aide accidentally made a note calling the email “legitimate” instead of “illegitimate”, leading Podesta to open the email. This single mistake placed over 60,000 highly sensitive emails in the hands of the Kremlin, which went on to distribute the information to websites like WikiLeaks.

Even after the FBI sent a special agent to warn to the DNC of the phishing emails, their IT did not respond to the warnings because computer logs did not reveal any intrusion. Podesta should not have required an aide to manually mark the email as illegitimate. Had the DNC incorporated an agentless solution into their network, they could have automatically monitored, identified, tagged, or blocked a potential attack.

The Dark Web Over the Medical Industry

Since 2010, the number of attacks against healthcare providers has risen by over 125% and risk levels in the industry are now at the highest ever. In fact, just last year, cyber criminals hacked over half a million patient records and began selling them over the Dark Web for profit of approximately $365 per record. That is about one-third more costly than selling stolen financial records – no wonder that this form of theft is growing at a dizzying speed. Part of the big issue is that hospitals, private clinics, vendors and insurance companies all share digital information, which of course creates the perfect conditions for cyber-criminal activity.

There is no doubt that the medical industry is struggling to uphold HIPAA regulations regarding privacy, security and enforcement. As medical connected devices continue to grow, a solution that is scalable across a wide range of institutions is a must. It is crucial that every institution sharing this data implements a solution that enables security teams to have complete visibility of all connected devices in real time, including switches, wireless controllers, VPN gateways, and routers.

A Boardroom, Samsung and the CIA

Among the 7,800 CIA records released via WikiLeaks, it was revealed how the CIA has been taking advantage of devices like Samsung’s smart TVs to spy on people across the United States.  Under the codename “Weeping Angel”, the CIA used malware that makes the television act like a bug and send recordings back to them.

Samsung had already warned within its privacy policy that the voice recordings are uploaded to servers and can be passed on to third parties. However, while it is possible for the user to shut off the microphone completely, the CIA found a simple way to circumvent that. As such, organizations need to check the state of their equipment, whether it be a smartphone, laptop or a TV screen. Any device that can record and has access to the internet is susceptible to hacking. Companies must safeguard their equipment and implement practices like device lock-down, micro-visibility, and risk monitoring.

Whether you run a financial, governmental, retail or healthcare organization, it is essential to see, control and automate your network. Without full network visibility, it is impossible to control devices or maintain compliance standards. The challenge for many is how to maintain a level of security (even large companies struggle to attain compliance) often with limited resources and budgets. Portnox’s advanced technology – available both on-premise and in the cloud – gives security officers and network operators the tools they need to see and control any device, at any time, from any place. With these tools, Portnox makes compliance a more straightforward and smooth process, setting your business up for success.

Download our new eBook on “Compliance as a Strategy for Business Success and learn how you can stop cyberattacks by maintaining strong compliance and visibility over your network.