By Louise O’ Sullivan, ICT Security Services Manager at HEAnet; Ireland’s National Education and Research Network
In May 2021, Ireland was subjected to an unprecedented ransomware attack on its full healthcare system. The HSE (Health Service Executive) systems were targeted with Conti ransomware which saw many of the HSE’s systems encrypted. This type of ransomware is designed to be operated by an attacker, rather than through an automated process. It is thought the attack originated from a phishing email.
This attack caused significant levels of disruption for the HSE necessitating many hospitals having to revert to pen and paper, with the majority of appointments being cancelled. It was reported that there is the potential that patient, staff or administrative data was compromised. It should be noted that no ransom was paid and a week after the initial attack the decryption key was provided. As the attack was so large the NCSC of Ireland, An Garda Síochána and the army were involved in the response.
As this attack affected so many people within Ireland, cybersecurity became the new topic of conversation, even more so as this attack was happening during the current COVID-19 pandemic. We at HEAnet found our clients requirements for awareness training on ransomware increase drastically within the months that followed.
Following this attack, the ICT Security Services team at HEAnet observed the following key learnings:
- Real-life examples
Continued Security Awareness Training using real-life examples relevant to the industry you work in really informs the attendees.
- Phishing emails
It is imperative to know what phishing emails are and the key elements that will identify this type of email. This is one of the main ways in which ransomware enters an organisation.
- Ransomware playbook
The importance of implementing an incident response plan including a ransomware playbook. This playbook is a valuable resource as it will determine the steps to follow in the attempt to recover any affected system of ransomware.
- Understanding ransomware
It is also extremely important for any institution to understand how ransomware can enter a network. Below is an outline of the common approach a ransomware attack may take.
https://www.exabeam.com/wp-content/uploads/2017/07/Exabeam_Ransomware_Threat_Report_Final.pdf
Based on our observations, the ICT Security Service at HEAnet has now included more information around ransomware and its prevention in Security Awareness Training. The service is also currently holding a number of workshops on ransomware from a technical perspective.
To conclude, the healthcare system ransomware attack in Ireland has brought immense focus on cybersecurity not only for the government but all businesses, colleges and organisations within Ireland. It highlights the need for us to try and work in a more proactive capacity rather than a reactive approach to cybersecurity and its threats.
Other References:
- https://www.siliconrepublic.com/enterprise/hse-cyberattack-explainer-conti-ransomware
- https://www.thejournal.ie/hse-ransomware-attack-2-5440082-May2021/
Author
Louise is the ICT Security Services Manager at HEAnet; Ireland’s National Education and Research Network for the past four years. She holds both a degree and Masters from NUI, Galway and is a certified CISA auditor and Lead ISMS Implementer. Her background is primarily in IT Audit, Security consulting and Cyber Security working in companies including Deloitte, AON and PwC.
Also this year GÉANT joins the European Cyber Security Month, with the 'Cyber Hero @ Home' campaign. Read articles from cyber security experts within our community and download resources from our awareness package on https://connect.geant.org/csm2021
