Most people during a time a data breach occurs focus mainly on what data was accessed, but many do not inquire as to how long the breach was allowed to occur without detection or expulsion from the system. The time frame between the initial access and discovery of the hijack can have an enormous impact on the overall magnitude and effects of a cyber-attack on the organization.
Cybersecurity is more than just about deterring and preventing attacks. It is about quickly detecting cyber-attacks. The longer an unauthorized individual has access to a system, the more chances the intruder has had to search through, access and ex-filtrate sensitive data from the system. This window of opportunity is frequently when the most extensive damage is caused by an intruder.
This issue is exemplified by the case of the Rocky Mountain Associated Physicians data breach, where the cyber-attacker gained unauthorized access to internal systems, and the attack was discovered after the cyber-attacker had already infiltrated operationally-critical systems and exfiltrated sensitive patient information.
Detection delays occur more often than most people think. Cyber criminals today often begin designing cyber-attacks with little or no chance of detection to make them undetectable by their potential targets. Attackers will often use many different techniques to hide themselves while they gather information and conduct operations, including blending their activity in with other legitimate activity.
One reason for the delays in detection is that healthcare systems are quite complex and therefore very difficult to monitor effectively. Medical facilities utilize multiple systems – these systems provide patient data, billing, and administrative functions and will be interconnected. In order to effectively monitor all of these various systems for indicators of compromise and threats, you need good threat detection capabilities.
The Rocky Mountain Associated Physicians data breach is an example of how long it took for this type of attack to be detected and how long it took for the organization and its patients to realize that their data had been compromised. For the time period of when the attacker gained initial access until the time that the breach was detected (not to mention the time taken to contain the breach), sensitive information like personal and financial information and medical records had been compromised. A longer time frame for an attacker to operate undetected increases the chance that they copied and/or misused the information during this period of time before the breach was discovered.
An additional aspect of this challenge to be addressed is how an organization investigates a cybersecurity incident. Organizations must collaborate with cybersecurity professionals to find out exactly what has happened, what data may have been affected, and who could be at risk after detection of suspicious activity. The investigation will take time, causing both the organization and individuals impacted to experience uncertainty during the investigation.
Patients may also have issues responding appropriately since they did not receive timely notification of the incident. Consequently, if patients' names and/or financial information have been compromised and they were unaware that they were victimized, they would not have been in a position to identify early signs of misuse (e.g., suspicious account activity, fraudulent activity). Therefore, a delay in discovering that they had been victimized could contribute to the overall impact of the data breach.
In this regard, organizations must implement proactive security measures to address this challenge. To this end, organizations need to invest in real-time monitoring systems that can accurately detect anomalies; rapid response systems that can detect an unusual event as it is occurring; and utilize these systems to limit the amount of time attackers will have access to sensitive data.
Individuals need to continue to educate themselves and to remain vigilant after they are notified. For example, individuals should monitor their financial accounts (upon receiving a notification of a cyber-attack) to reduce the risk of being victimized. They should also review their medical records for any potential errors caused by data breaches to minimize risks due to delays in the identification of a breach.
With the continual evolution of cyber threats, the time frame associated with when a breach occurs has become equally as critical as the breach itself. The Rocky Mountain Associated Physicians data breach serves to remind us of this. Cybersecurity professionals must consider time as an important factor when monitoring for potential cyber threats. When cyber threats can be quickly identified by cybersecurity teams, they can be acted upon faster and can minimize or eliminate potential loss caused by cybercriminal activities.
