In May, Ireland’s publicly funded healthcare system, Health Service Executive (HSE), suffered from a ransomware attack allegedly carried out by the Conti ransomware gang. During a hearing on Wednesday, Paul Reid, HSE’s director general estimated the total cost of recovery would be $600 million. Even after the initial recovery cost of $120 million, Reid explained that further necessary investments that include upgrading affected systems and hiring technical experts to triage the damage add to the cost. Reid also stated HSE has decrypted 75% of its servers following the attack and it would likely take several more months before they are fully recovered.
Analyst Notes
Efforts to combat ransomware globally have intensified in the last several months. Even Russia has publicly stated they may cooperate with the U.S. when it comes to holding cyber criminals accountable. The damage caused by the attack on HSE is a prime example of why it is important to take proactive measures against cyber-attacks. To protect against ransomware attacks, organizations should regularly back up data, air gap, and password protect backup copies offline. Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides. Implement network segmentation. Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., hard drive, storage device, the cloud). Install updates/patch operating systems, software, and firmware as soon as practical after they are released. Implement monitoring of security events on employee workstations and servers, with a 24/7 Security Operations Center to detect threats and respond quickly. Use multifactor authentication where possible. Use strong passwords and regularly change passwords to network systems and accounts, implementing the shortest acceptable timeframe for password changes. Avoid reusing passwords for multiple accounts. Focus on cyber security awareness and training. Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
Sources:
