Analysis by Tenable’s Security Response Team (SRT) has revealed 237 breaches in the healthcare sector in the calendar year 2020. The incidents continued into 2021, with 56 breaches already disclosed by the end of February 2021.
Ransomware was reported as the most prominent root cause of healthcare breaches, accounting for a whopping 54.95%. The top ransomware used was Ryuk, accounting for 8.64% of ransomware-related breaches. It was followed by Maze (6.17%), Conti (3.7%) and REvil/Sondinokibi (3.09%).
Third-party breaches accounted for over a quarter of the breaches tracked and nearly 12 million exposed records. Other leading causes included email compromise/phishing (21.16%), insider threat (7.17%) and unsecured databases (3.75%).
Apart from the obvious strain of dealing with the pandemic, telehealth solutions surfaced as a prominent risk area over the last year. While it may be the much-needed answer to getting medical care to those in need, beyond the limitations of social distancing norms, telehealth solutions considerably expand the surface area for attacks.
“As the COVID-19 pandemic continues to place unprecedented strain on global healthcare infrastructure, attackers are finding what was already an attractive target even more enticing. Technology dependent services such as telehealth, COVID-19 contact tracing app, and a rush to develop and distribute vaccines have greatly expanded the attack surface. With no signs of cyberattacks slowing down in 2021, healthcare organisations need the resources and tools necessary to understand and reduce their cyber risk,” said Rody Quinlan, Security Response Manager, Tenable.
In order to reduce the risk of compromise, healthcare organizations should take a two-pronged approach to reduce the growing threats:
Prioritise vulnerabilities: Identify and remediate vulnerabilities most likely to target and impact your organisation.
Address the root cause: Once the vulnerabilities most likely to introduce business risk are identified and prioritized, remediate them and continue regular maintenance check-ups.
This month Patch Wednesday contains 82 CVEs, a fix for CVE-2021-26411, a remote code execution flaw in Microsoft Internet Explorer and a reminder to organizations to apply patches to address the Proxylogon and other Microsoft Exchange related zero-days. Please find below a comment from Satnam Narang, Staff Research Engineer, Tenable.
“This month’s Patch Wednesday release addressed 82 CVEs, 10 of which are rated critical. This month’s release contains a fix for CVE-2021-26411, a remote code execution flaw in Microsoft Internet Explorer that has been exploited in the wild as a zero-day. This is tied to a vulnerability that was publicly disclosed in early February by researchers at ENKI who claim it was one of the vulnerabilities used in a concerted campaign by nation-state actors to target security researchers. In the ENKI blog post, the researchers say they will publish proof-of-concept (PoC) details after the bug has been patched. As we’ve seen in the past, once PoC details become publicly available, attackers quickly incorporate those PoCs into their attack toolkits. We strongly encourage all organizations that rely on Internet Explorer and Microsoft Edge (EdgeHTML-Based) to apply these patches as soon as possible.
“It’s imperative for organizations to ensure they’ve also applied patches to address the Proxylogon and other Microsoft Exchange related zero-days that were disclosed last week as part of an out-of-band advisory, which nation-state groups and other threat actors have exploited indiscriminately. In addition to patching, it is vital for organizations to do their due diligence and hunt for indicators of compromise to ensure attackers haven’t established a foothold within their networks.” — Satnam Narang, Staff Research Engineer, Tenable.
“The pandemic has further accelerated the need to address gender equity within organisations – and it starts with businesses ensuring the fair treatment of women in alignment with their needs and ensuring they feel valued at their workplace. The reality is that the tech industry still struggles with representation. At Zendesk, women make up 37% of our workforce in the APAC region and 31% of our global leadership teams. While we’ve made great strides, we know there’s always more work to be done.
Wendy Johnstone, Zendesk
Change can only happen when gender equity is one of an organisations’ core corporate values and where supporting policies are agreed at the top and rolled out across the entire organisation. That’s why at Zendesk we have a broad range of practices and policies that focus on intentional hiring, interview bias training, talent management and development programs and employee community groups. The goal is to empower our workforce to collaborate with each other, seek out qualified women for roles across the company, and create a space where women can be themselves, form supportive relationships and reach their full potential,” Wendy Johnstone, SVP & COO, Asia Pacific, Zendesk.
2. Esper.io
Vineetha Vijayakumar, Head of Product & Program, Esper.io.
“Numerous articles have been written about dealing with the pandemic and how we evolved work & management principles. Especially in the field of technology, women have led the effort in making empathy a key enabler in adjusting to remote work – empathy among colleagues, families, friends and the society at large. Let’s shine a spotlight on these stories of leadership, strength and resilience shown by women all over the world. Let’s internalize, amplify and celebrate these stories to spread more hope and empowerment.,“Vineetha Vijayakumar, Head of Product & Program, Esper.io.
3. Acuver Consulting
Sahiba Singh, Chief People Officer at Acuver Consulting
“There is so much stereotyping. Women are good at tech, women are good managers, women can drive and can read maps. But still there are plenty of societal preconceived notions that are imposed on us. Women are constantly being compared to their male counterparts. Thus, I choose to challenge all those who think like this. Stereotyping needs to stop! Corporates should be gender neutral and responsibilities should be assigned based on the skill set,” Sahiba Singh, Chief People Officer at Acuver Consulting.
4. Tenable
“The theme of International Women’s Day this year is #ChooseToChallenge. It’s more important than ever for us to challenge the status quo within the technology industry. Perhaps most especially this is true for cybersecurity, as a lack of diversity is a threat to our collective success.
Jacquie Young, Senior Director of Channels, APAC, Tenable
“Innovation sits at the core of cybersecurity and failing to innovate would mean we’re not delivering new solutions to keep people and businesses safe in the changing threat landscape. If everyone on a security team thinks the same, the race has already been lost with attackers. A diverse workforce is a prerequisite to unlocking the full potential of any team or organisation. Only through increased inclusion and diversity – of race, gender, perspective and thought – can our industry achieve greater creativity and innovation, think outside the box, and outmaneuver our adversaries.
The fight for more diversity and inclusion in the industry doesn’t start or end with International Women’s Day. We must continue to champion women in the industry, lift each other up and give each other opportunities so that we can help create a more inclusive world for us all.” – Jacquie Young, Senior Director of Channels, APAC, Tenable.
5. Shoptimize
“At Shoptimize, we firmly believe in equal opportunity for women, and building an inclusive, bias-free organization has been our topmost priority.
Sathya Ramaganapathy, VP Marketing at Shoptimize
The rise of Indian eCommerce has not only boosted India’s economy but has also opened up many opportunities for women. From entrepreneurs building and scaling businesses to increased representation across functions, be it in leadership, tech, or sales & marketing roles – we have been privileged to have a ringside view of the women fueling the eCommerce boom,” Sathya Ramaganapathy, VP Marketing at Shoptimize.
6. Hocomoco
“Women are breaking every stereotype and excelling across sectors, including real estate which is predominantly considered male-dominated. It’s also interesting to note that women are also amongst the fastest-growing group of consumers in terms of purchasing land/house.
Ritu Pusti, Brand Manager- Hocomoco
At Hocomoco, we have always believed in giving weightage to talent/skill over gender, and to build a bias-free organization. Our project management team has close to 50% women employees, and some of the crucial departments (interior and marketing) in the company are headed by women,” Ritu Pusti, Brand Manager- Hocomoco.
Microsoft has issued out-of-band patches for multiple zero-day vulnerabilities exploited in the wild by a nation-state threat actor called HAFNIUM. Satnam Narang, Staff Research Engineer at Tenable says that by Microsoft choosing to patch these flaws out-of-band rather than including them as part of next week’s Patch Tuesday release leads us to believe the flaws are quite severe. Here’s a full analysis provided by Tenable along with a quote from Satnam Narang below.
“Four zero-day vulnerabilities in Exchange Server have been exploited in the wild by a nation-state threat actor called HAFNIUM. The fact that Microsoft chose to patch these flaws out-of-band rather than include them as part of next week’s Patch Tuesday release leads us to believe the flaws are quite severe even if we don’t know the full scope of those attacks.
“While Microsoft says that HAFNIUM primarily targets entities within the United States, other researchers say they have seen these vulnerabilities being exploited by different threat actors targeting other regions.
“Based on what we know so far, exploitation of one of the four vulnerabilities requires no authentication whatsoever and can be used to potentially download messages from a targeted user’s mailbox. The other vulnerabilities can be chained together by a determined threat actor to facilitate a further compromise of the targeted organization’s network.
“We expect other threat actors to begin leveraging these vulnerabilities in the coming days and weeks, which is why it is critically important for organizations that use Exchange Server to apply these patches immediately.” –Satnam Narang, Staff Research Engineer, Tenable
“At least four proof-of-concept exploit scripts for CVE-2021-21972, a critical remote code execution flaw in VMWare’s vCenter Server solution are currently available. We know that the availability of proof-of-concept code or exploit scripts following the publication of a critical vulnerability is a boon for threat actors.
“While some cybercriminals may be adept at developing their own proof-of-concept exploits, threat actors are keen on leveraging what’s publicly available, as evidenced in the Copy Paste Compromises report from the Australian Cyber Security Centre in June 2020 that arrived at the same conclusion.
“There are confirmed reports that attackers are probing for vulnerable vCenter Server systems. According to a Shodan search, there are over 6,700 publicly accessible vCenter Servers. Coupled with the availability of these exploit scripts, it is all the more imperative for organizations to apply the available patches immediately instead of relying on temporary workarounds.”– Satnam Narang, Staff Research Engineer, Tenable
Tenable®, Inc. the Cyber Exposure company, today launched Tenable.ep, the industry’s first, all-in-one, risk-based vulnerability management platform designed to scale as dynamic compute requirements change. Tenable.ep combines the company’s industry-leading products — Tenable.io® Vulnerability Management, Tenable.io Web Application Scanning, Tenable.io Container Security and Tenable Lumin – into one platform, enabling customers to see all of their assets and vulnerabilities in a single dashboard alongside key threat, exploit and prioritization metrics. Moreover, Tenable.ep’s single, flexible asset-based licensing model frees organizations to dynamically allocate licenses across all asset types according to their unique attack surface and modify as their environment changes.
The ability to quickly spin up and connect modern assets to the corporate environment is critical to digital transformation and work-from-home initiatives. But cybersecurity pricing models designed for on-premises computing can force enterprises to choose between assessing one asset type over another, frequently charging premiums for assessing cloud assets or web applications. Tenable.ep solves this challenge with a single license that gives customers unrivaled flexibility to take a holistic, rather than piecemeal, approach to vulnerability management. Whether it’s a web application, a cloud instance, a container image, remote worker or a traditional server, each asset counts exactly the same. The platform also includes unlimited deployment of local Nessus and web application scanners at no additional cost.
Highlighting the significance of this announcement in India, Kartik Shahani, Country Manager, Tenable India said “With two years’ worth of digital transformation activity compressed into two months, it’s clear that the boundaries which used to define traditional enterprise networks are becoming less discernible. Security teams now have the daunting task of securing an amorphous attack surface which starts at the corporate network and extends into employees’ homes.”
“To combat this issue, a variety of single-purpose tools, each with different licensing and pricing models are used to gain visibility across an organisation’s attack surface. Tenable.ep solves this problem by providing organisations in India a comprehensive risk-based vulnerability management solution, managed by a single license for simple procurement and easy deployment,” he added.
Commenting on the benefits of Tenable.ep, Anuj Gupta, CEO Hitachi Systems Micro Clinic, a Tenable partner said, “As organisations scale and evolve to adapt to changing work models, security capabilities need to be equally adaptable. Tenable.ep enables customers to see and assess all assets and vulnerabilities in a unified view, thereby making it easy for security teams to assess and accurately prioritise the vulnerabilities and assets that matter most.
“Attackers don’t differentiate between asset types and neither should defenders. So we designed Tenable.ep to give organizations the power to identify every asset and exposure, predict which vulnerabilities are most likely to be exploited and act to address critical risks,” said Renaud Deraison, co-founder and Chief Technology Officer, Tenable. “Tenable.ep delivers risk-based vulnerability management within a single, unified solution without the need to purchase separate products and manage different licensing models.”
Tenable has a track record of innovating to raise the bar for cybersecurity. With Predictive Prioritization, Tenable helped organizations evolve from trying to fix everything with a critical CVSS score to taking a risk-based approach that focuses on fixing what matters most. Frictionless Assessment removed the barriers to unified visibility of cloud assets. Now with Tenable.ep, the company is bringing these innovations together and simplifying how disparate assets are assessed so that organizations can approach their vulnerability management programs holistically.
Tenable.ep is now available for all new and existing Tenable customers.
Tenable products will also continue to be sold as separate solutions.
“Safer internet day is perhaps more important than ever this year. In the last twelve months, the way we work or access education has changed beyond recognition. Organisations have opened up networks to accommodate a remote workforce. Students are using apps and services, typically the realm of the corporate world, to participate in virtual classes. Many of these cloud-based tools and services are accessed using personal devices that are unsecured or beyond the remit of the IT or security team. This expanded attack service presents an attractive target for attackers who frequently use personal devices to not only steal data on the device itself, but also look to move laterally across networks and cause further harm.
Research by Tenable’s Security Response Team, examining details from 730 publicly disclosed data breaches in 2020, found that threat actors rely on unpatched vulnerabilities in their attacks. These ‘broken windows’ are primarily used to gain initial access into a target network. From there, attackers leverage serious vulnerabilities, like Zerologon, to elevate privileges, granting themselves the ability to gain access to domain controllers within the network.
Most of these attacks are avoidable with basic safety steps. Good security awareness and basic cyber hygiene prevents mistakes that can cause serious harm. In tandem, it is critical that users take responsibility for updating and securing their devices to close these broken windows.
With technology now an integral part of modern life we all have a part to play in securing the devices we use.” — Adam Palmer, Chief Cybersecurity Strategist, Tenable
