On July 15, 2021, the U.S. government announced new resources and initiatives to protect American businesses and communities from ransomware attacks. The new website, StopRansomware.gov, establishes a one-stop hub for ransomware resources for individuals, businesses, and other organizations. It is a collaborative effort of the U.S. Department of Justice (DOJ) and the U.S. Department of Homeland Security (DHS) with federal partners to help private and public organizations mitigate their ransomware risks.
StopRansomware.gov is the first central hub consolidating ransomware resources from all federal government agencies. Before the launch of this website, individuals and organizations had to visit a variety of websites to find guidance, latest alerts, updates, and resources, increasing the likelihood of missing important information. The website reduces the fragmentation of resources, which is especially detrimental for those who have become victims of an attack. It integrates federal ransomware resources into a single platform that includes clear guidance on how to report attacks and the latest ransomware-related alerts and threat information from all participating agencies. The website includes resources and content from DHS Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. Secret Service, the DOJ’s FBI, the Department of Commerce National Institute of Standards and Technology (NIST), and the Departments of the Treasury and Health and Human Services.
The Secretary for the Department of Homeland Security, Alejandro Mayorkas, stated, “As ransomware attacks continue to rise around the world, businesses and other organizations must prioritize their cybersecurity. Cyber criminals have targeted critical infrastructure, small businesses, hospitals, police departments, schools, and more. These attacks directly impact Americans’ daily lives and the security of our nation. I urge every organization across our country to use this new resource to learn how to protect themselves from ransomware and reduce their cybersecurity risk.”
Ransomware is a long-standing problem and a growing national security threat. Roughly $350 million in ransom was paid to malicious cyber actors in 2020, a more than 300% increase from the previous year. Further, there have already been multiple notable ransomware attacks in 2021, and despite making up roughly 75% of all ransomware cases, attacks on small businesses often go unnoticed. Cyber-attacks, including ransomware, exploit the weakest link. Many small businesses have yet to adequately protect their networks, and this website can assist organizations, businesses, and others to take simple steps to protect their networks and respond to ransomware incidents while providing enterprise-level information technology (IT) teams the technical resources to reduce their ransomware risk.
DHS, DOJ, the White House, and the federal partners encourage all individuals and organizations to take the first step in protecting their cybersecurity by visiting StopRansomware.gov. The website can be accessed at: Stop Ransomware | CISA.
Issue:
The healthcare sector is now one of the largest victims of ransomware due to its vulnerability to the confidentiality and the critical nature of online patient records. It is imperative that all nursing facilities become proactive in preventing ransomware attacks to avoid data breaches which are reportable in terms of the Health Insurance Portability and Accountability Act (HIPAA). Nursing facility leaders and the Privacy/Compliance Officer should be aware of the new tactics that are being used by malicious ransomware attacks and provide training to all staff with access to electronic medical records, email, or internet on best practices to prevent a ransomware attack. Additional information is available in the Med-Net Corporate Compliance and Ethics Manual, Chapter 6 Data Integrity.
Discussion Points:
- Review facility policies and procedures on cybersecurity. Ensure that policies are kept current and fully implemented based on best practices designed to prevent ransomware attacks.
- Train all appropriate staff on best practices to prevent, respond to, and report ransomware events. Document that the trainings occurred and file in each employee’s education file. Provide additional training as new information becomes available.
- Periodically audit to ensure that staff are knowledgeable and utilizing best practices in preventing ransomware attacks.
