SecureWorks®, Inc., a global provider of information security services , reported today that attempted hacker attacks launched at its healthcare clients doubled in the fourth quarter of 2009. Attempted attacks increased from an average of 6,500 per healthcare client per day in the first nine months of 2009 to an average of 13,400 per client per day in the last three months of 2009. Attempted attacks against other types of organizations, protected by SecureWorks, did not increase in the fourth quarter.

“From October through December of 2009, we blocked hundreds of SQL Injection and Butterfly/Mariposa Bot malware attacks launched at our healthcare clients. These attempted attacks were responsible for the increase in our attack statistics,” said Hunter King, security researcher with SecureWorks’ Counter Threat Unit(SM) (CTU).

In the Fall of 2009, SecureWorks and the security community began tracking a new wave of attacks involving the latest version of the Butterfly/Mariposa Bot malware, according to King. If a computer is infected with the Butterfly malware, it can be used to steal data stored by the victim’s browser (including passwords), launch Distributed Denial of Service attacks, spread via USB devices or peer to peer, and download additional malware onto the infected computer.

Factors Contributing to Healthcare Attacks

SecureWorks noted that there are tow mini reasons that Heathcare entities are targeted:

1. Valuable Data Stores – Healthcare organizations often store valuabledata such as a patient’s Social Security number, insurance and/or financial account data, birth date, name, billing address, and phone, making them a desirable target to cyber criminals.

2. Large Attack Landscape – Because of the nature of their business, healthcare organizations have large attack surfaces. Healthcare entities have to provide access to many external networks and web applications so as to stay connected with their patients, employees, insurers and business partners. This increases their risk to cyber attacks.

“In order for healthcare organizations to effectively protect their sensitive patient data, they should consider employing a defense-in-depth strategy. This approach involves implementing multiple layers of protection to shield the organization from current and emerging threats,” said Jon Ramsey, CTO for SecureWorks.

SecureWorks has outlined a set of information security guidelines to assist the healthcare industry in protecting their patient data from cyber attacks and other data breaches. Adopting these security measures will also assist organizations in demonstrating their adherence to the HIPAA regulations and the requirements outlined in the new Health Information Technology for Economic and Clinical Health (HITECH) Act.

About SecureWorks

SecureWorks is a market leading provider of world-class information security services with over 2,700 clients worldwide spanning North America, Latin America, Europe, the Middle East and the Pacific Rim. Organizations of all sizes, including more than ten percent of the Fortune 500, rely on SecureWorks to protect their assets, improve compliance and reduce costs. The combination of strong client service, award-winning security technology and experienced security professionals makes SecureWorks the premier provider of information security services for any organization. Positioned in the Leader’s Quadrant of Gartner’s Magic Quadrant for MSSPs, SecureWorks has also won SC Magazine’s “Best Managed Security Service” award for 2006, 2007, 2008 & 2009. www.secureworks.com

Source: SecureWorks, Inc.

HEALTH PLAN WEEK is reporting is this week’s issue that health plans could face stiff penalties under HIPAA if they use enrollment information to contact members without their permission and urge them to join grassroots advocacy campaigns or take a stance on a political issue.

As a case in point the article cites a September incident where Humana Inc. pulled 900,000 names and addresses from its Medicare Advantage database and sent those beneficiaries letters recommending that they fight against proposed “significant cuts” to the MA program. CMS ordered Humana to cease all such mailings, which it says violated the health insurer’s Medicare contract. CMS also says the letters might have violated HIPAA, and asked the HHS Office for Civil Rights (OCR) to investigate

However, Jeff Drummond, a partner Dallas-based law firm, says Humana could defend the use of its enrollment data as falling into the HIPAA exemption for operations, contending this was an effort to communicate benefits information to its members, much like describing changes in a drug formulary, he tells HPW.

For more information visit the original article here.