Ransomware no longer biggest cyber security threat, report finds

Ransomware attacks are becoming less prevalent as cyber criminals look to news way of attacking a system, a new report has found.

Instead, hackers are turning towards hidden HTTPs tunnels that appear as normal encrypted web traffic to target healthcare organisations.

The Vectra 2019 Spotlight Report on Healthcare identified Internet of Things (IoT) devices; unpartitioned networks; and reliance on out-dated systems, as weakness most likely to be exploited by cybercriminals looking to steal personal information and disrupt organisations.

It called for greater use of artificial intelligence (AI) and machine learning to detect hidden threats in IT networks before they can be exploited by hackers.

According to the report, ransomware, which was used in the WannaCry attack on the NHS two years ago, has become much less prevalent in the second half of 2018.

Attacks in which hackers hide their command-and-control communications in HTTPS tunnels, which often looks like service provider traffic, were the most common type of attack, according to the US-based AI company.

“Behaviours that point to the use of external remote access tools are the second most-common detections in healthcare,” the report said.

“Although these behaviours are consistent with cyberattack command-and-control communications, these behaviours also occur when healthcare organisations communicate with independent labs, imaging centres and other service providers.”

These can include anything from IT services logging in to user machines to high volumes of outsourced services.

But the report cautioned that health organisations should still continue to monitor for ransomware, as it still remains a concern.

“The increase in medical IoT is beneficial for patients but makes securing healthcare systems a challenge due to limited security controls around these devices,” said Brett Walmsley, chief technology officer at Bolton NHS Foundation Trust.

“Having the visibility to quickly and accurately detect threat behaviours on and between all devices is the key to good security practice, regulatory compliance and managing risk.”

Software technologies company Check Point also identified IoT devices as the weakest link in IT networks in a recent cyber security report.

It found outdated software and operating systems leave the NHS “vulnerable” to attack and recommended separating patient data from IT networks to make it harder for hackers to find.

Two years ago this month (12 May) the WannaCry attack brought parts of the NHS to its knees and proved the services was woefully unprepared for a cyber attack.

Just after 1pm in the afternoon NHS Digital’s CareCERT unit sent an alert to the Department of Health and Social Care informing them that four NHS trusts had reported ransomware attacks affecting a number of hospitals.

By 4pm, the ransomware had spread to 16 trusts and it was at this point NHS England publicly declared a major cyber security incident.

It led to disruption of at least 80 out of 236 hospital trusts in England, as well as 603 primary care and affiliate NHS organisations.

Subsequently NHS England published a “lessons learned” report in order to prepare the health service for any potential attacks in the future, but its still not known how many of the 22 recommendations have been met.