Node Chats

Healthcare suffers a 51% spike in web app attacks in response to COVID-19 vaccine

The healthcare sector experienced a surge in web application attacks in December when the distribution of the first COVID-19 vaccines began, according to new data from Imperva.

Attacks increased 51% last month from November, an industry increasingly targeted by cyber-criminals over the past year due to the global pandemic.

Web application attacks are serious weaknesses or vulnerabilities that allow criminals to gain direct and public access to databases with the goal of using the sensitive data within. Many of these databases contain valuable information such as personal data and financial details, meaning they are frequently targeted.

Four specific web application attacks saw the largest increases in December:

1.) Cross-site scripting (XSS) detections
2.) SQL injection attacks
3.) Remote code execution/remote file inclusion
4.) Protocol manipulation attack

How can healthcare organisations reduce web application attacks?

1.) Web Application Firewalls (WAFs): A vital defence for critical applications and data. WAF controls access to web applications using rules designed to recognise and restrict suspicious activity, such as SQLi, XSS and exploitation of vulnerabilities. By continuously updating the rules they are prepared to catch the latest attack and exploitation techniques before they can harm important resources.

2. Vulnerability Scanning and Security Testing: The fact web applications connect external users to data and services easily makes them big targets for attackers. Scanning and testing databases, networks and applications can help find where the vulnerabilities are and how to mitigate them.

3. Secure Development Training: Provide your developers, testers, project managers and architects with the latest information regarding secure software development. Ensure there is a baseline of security awareness so staff can confidently design, build and deploy secure software and applications.

Terry Ray, Imperva, said that 2020 has been an “unprecedented year” of cyber activity, with global healthcare organizations (HCOs) experiencing 187 million attacks per month on average. That’s almost 500 attacks per HCO each month, a 10% increase year-on-year.

The US, Brazil, UK and Canada were the top countries targeted last year.

Ray believes that Healthcare’s reliance on third-party applications to save time and money may have exposed them.

“While there are sometimes business advantages to third-party applications, the risks include: patching only on the vendor’s timeline, known exploits that are widely publicized and constant zero-day research on widely used third-party tools and APIs.”

Ray also highlighted how exploiting web application vulnerabilities is the most common cyber attacks directed at healthcare organisations.

“Reliance on JavaScript APIs and third-party applications creates a threat landscape of more complex, automated, and opportunistic cybersecurity risks that are increasingly challenging for all organizations to detect and stop. And while ransomware attacks commonly land healthcare organizations in the news, it’s only the vulnerable application front-end to all healthcare data that experiences the variety and volume of daily attacks noted above.”

In just the first three days of 2021, Imperva saw a 43% increase in data leakage.

Node Chats

5 Cyber Threats You Will Encounter In 2021

Here are our predictions for 2021 based on statistics collected from 2020.

We warned of ransomware, phishing and remote worker security last year but they won’t be disappearing from our top threats any time soon.

Newcomers AI-driven threats and Cloud threats grow as we rely on these services more and more.

Find our article on the top cyber threats of 2020 here.

Prevention and detection are key to avoiding these cyber threats.

Insurance is necessary but shouldn’t be your only line of defence. Actions need to be taken to help avoid cyber attacks in the first place.

We provide prevention and detection tools with our insurance in the hope you never have to experience a cyber attack. But if the worse should happen we will be there to help you fix it.

Learn more by checking out our in depth articles on some of the cyber threats:

Node Chats

SolarWinds Breach: What you need to know

SolarWinds, a popular IT security vendor with 300,000 global customers (including many small to medium size businesses and their Managed Service Providers), has suffered a major compromise.
 
If your organization uses the SolarWinds Orion Platform, READ ON. If you’re not sure, ask someone in your organization that does.
 
Even if you don’t use the SolarWinds Orion Platform, one of your business partners may be among the 18,000 organizations potentially affected by this breach. 

SolarWinds, a popular IT security vendor with 300,000 global customers (including many small to medium size businesses and their Managed Service Providers), has suffered a major compromise.
 
If your organization uses the SolarWinds Orion Platform, READ ON. If you’re not sure, ask someone in your organization that does.
 
Even if you don’t use the SolarWinds Orion Platform, one of your business partners may be among the 18,000 organizations potentially affected by this breach. 

We strongly recommend you contact all business partners with whom you share sensitive business information or allow access into your IT environment to ensure that, if they use the affected platforms, they are taking the recommended actions below.

If you are allowing an affected partner access into your IT environment, we recommend disabling that access until the issue has been remediated.

Indeed, the Cybersecurity and Infrastructure Security Agency (CISA) has advised everyone that uses the SolarWinds Orion monitoring software to assume they’ve been “compromised by threat actors and assume that further persistence mechanisms have been deployed.”

What Happened?
The compromise allowed hackers to inject malicious code into legitimate software released by SolarWinds for its Orion platform, a suite of network management tools.

This malicious code is a backdoor that communicates with command-and-control servers operated by a malicious third party.

This supply chain attack has been connected with the recent FireEye and U.S. Department of Homeland Security (DHS) hacks.

Affected organizations may have been compromised by malicious hackers as early as May 2020.

What/Who is Affected?
The compromised platforms are SolarWinds® Orion® Platform software builds for versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1.

The known affected products for these Orion Platforms are:

  • Application Centric Monitor (ACM)
  • Database Performance Analyzer Integration Module*(DPAIM*)
  • Enterprise Operations Console (EOC)
  • High Availability (HA)
  • IP Address Manager (IPAM)
  • Log Analyzer (LA)
  • Network Automation Manager (NAM)
  • Network Configuration Manager (NCM)
  • Network Operations Manager (NOM)
  • Network Performance Monitor (NPM)
  • NetFlow Traffic Analyzer (NTA)
  • Server & Application Monitor (SAM)
  • Server Configuration Monitor (SCM)
  • Storage Resource Monitor (SRM)
  • User Device Tracker (UDT)
  • Virtualization Manager (VMAN)
  • VoIP & Network Quality Manager (VNQM)
  • Web Performance Monitor (WPM)

SolarWinds said Orion update versions 2019.4 through 2020.2.1 (released between March 2020 and June 2020) also contain the malware.
 
If your organization uses any of the affected Orion affected platforms/products, we recommend you immediately investigate what versions you are running and take the below steps.

What to Do 
Affected organizations should immediately power down or disconnect from their network SolarWinds Orion products, versions 2019.4 through 2020.2.1 HF1.

SolarWinds recommends the following immediate actions.

  • All customers with any of the above affected products for Orion Platform v2020.2 with no hotfix or 2020.2 HF 1 to upgrade to Orion Platform version 2020.2.1 HF 2 as soon as possible. This version is available here.
  • SolarWinds asks customers with any of the below products listed as known affected for Orion Platform v2019.4 HF 5 to update to 2019.4 HF 6, which is available for download here.
  • The hotfix release 2020.2.1 HF 2 is now available in the SolarWinds Customer Portal at customerportal.solarwinds.com
  • All customers should update to release 2020.2.1 HF 2, as this release replaces the compromised component and provides several additional security enhancements.

If you cannot upgrade immediately, SolarWinds recommends installing your Orion Platform behind firewalls, disabling internet access for the Orion Platform, and limiting the ports and connections to only what is necessary. For more information, read SolarWinds Orion Platform best practices configurations and the entire SolarWinds security advisory.

Recent Comments
    About Node International

    We provide leading comprehensive insurance coverage combined with essential cybersecurity prevention and detection tools.

    Related Links
    Cyber Insurance Newsletter

    Interested in Cyber Insurance?

    Privacy Settings
    We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
    Youtube
    Consent to display content from Youtube
    Vimeo
    Consent to display content from Vimeo
    Google Maps
    Consent to display content from Google
    Spotify
    Consent to display content from Spotify
    Sound Cloud
    Consent to display content from Sound