Malware attack response - healthcare organization
1) Likely malware types and how they compromise data integrity
a. Ransomware - This is almost certainly present when patient data becomes unreadable and
operations stop. Ransomware encrypts files and holds the keys until a ransom is paid. For a
hospital this means electronic health records (EHRs), scheduling systems, and imaging files can
become inaccessible, causing care delays and risking patient safety. Ransomware commonly
enters through malicious email attachments or links (phishing) and runs code that finds and
encrypts data across network shares and backups, exploiting weak permissions and exposed
services. (Make It Easy Education, 2022)
b. Remote Access Trojan (RAT) / Backdoor - Attackers use phishing to trick staff into running
code that installs a backdoor. A RAT provides persistent, unauthorized remote access to systems.
Once inside, attackers can exfiltrate patient data (violating integrity and confidentiality), tamper
with records, or deploy ransomware more effectively by moving laterally across the network.
RATs exploit social-engineering gaps and systems with unpatched remote administration tools.
(Hailperin, 2019)
c. Credential-stealing malware (info-stealers / keyloggers) - These capture usernames,
passwords, and tokens from users and browsers. With stolen credentials, attackers gain
legitimate access to EHRs and administrative consoles, so actions look “normal” and bypass
simple perimeter defenses. This compromises data integrity because unauthorized users can alter
or delete records, hide traces, or disable logging. Credential-stealers exploit weak password
practices, lack of multi-factor authentication (MFA), and software vulnerabilities that allow
keyloggers to run undetected. (Make It Easy Education, 2022)
How these malwares exploit vulnerabilities (summary):
Social engineering (phishing) gets code executed by humans.
Weak access controls and broad permissions let malware move and encrypt more files.
Unpatched systems and exposed services allow remote code execution and persistence.
Lack of encryption or weak backups allow attackers to hold data hostage or alter it
without easy recovery.
2) Access control strategies and security policies (audits, training, monitoring)
Access control strategies (actionable)
1. Least Privilege & Role-Based Access Control (RBAC) - Give users only the access
they need. Clinicians get access to the patient records they must see; administrative staff
cannot access clinical imaging or server admin consoles. RBAC reduces the number of
accounts malware can use to spread. (Hailperin, 2019)
2. Multi-Factor Authentication (MFA) - Require a second factor for all remote and
privileged logins. Stolen credentials alone should not grant access.
3. Network Segmentation & Micro-segmentation - Separate clinical systems,
administrative systems, guest Wi-Fi, and vendor access into distinct network zones. If
malware infects one zone, segmentation limits lateral movement.
4. Privileged Access Management (PAM) - Control and monitor administrative accounts;
use just-in-time elevation so high privileges are granted only when needed and for a short
time.
5. Strong Password Hygiene & SSO with SAML/OAuth - Enforce long passphrases,
password managers, and single sign-on to reduce password reuse and phishing success.
Security policy recommendations (specific)
Regular audits
Monthly vulnerability scanning of all Internet-facing assets and quarterly internal pen
tests focused on EHR and backup systems.
Annual configuration audit of access controls, group memberships, and privileged
accounts. Keep audit logs for at least one year and review them automatically for
anomalies.
Employee training
Mandatory, quarterly phishing simulations with immediate feedback and targeted
training for those who fail.
Role-based security training (clinicians, admin, IT, vendors) that includes safe handling
of patient data, spotting social engineering, and steps to take if a suspicious email is
received.
A clear, enforced policy for removable media and personal device use.
Monitoring systems
Deploy centralized logging (SIEM) that collects endpoint, network, and application logs
and runs behavioral analytics to detect unusual access patterns (e.g., off-hours access,
mass file encryption).
Endpoint Detection and Response (EDR) on all endpoints with automated containment
(isolate an infected host).
Real-time alerting for suspicious activity: repeated failed logins, unusual privilege
escalation, large outbound data transfers.
Regular testing of alerting workflows so staff know how to respond when alarms arise.
These controls together create a layered defense where human training, policy, and technology
reduce the chance of successful compromise and speed detection and recovery.
3) Encryption technologies vs ransomware risk - how they help and comparison with
traditional cryptography
How encryption helps mitigate ransomware risks
1. Data-at-rest encryption (full-disk and file-level) prevents attackers from reading patient
data even if they steal disk images or backups. If backups are encrypted and keys are
protected, exfiltrated copies are useless to attackers.
2. Key management separation - Store encryption keys offline or in a dedicated Hardware
Security Module (HSM). If ransomware encrypts files, attackers won’t have the keys to
decrypt backups.
3. End-to-end encryption for data in transit - Use TLS for all communications so
credentials and patient data aren’t captured in transit by a network-level malware.
4. Immutable, encrypted backups - Use write-once or immutable snapshots with separate
credentials and network paths so ransomware cannot encrypt or delete backups. This
ensures recoverability without paying ransom.
Modern encryption approaches vs traditional cryptographic methods
Traditional symmetric encryption (e.g., AES) is still foundational and fast for bulk
data encryption. It requires secure key storage; if keys are exposed, attackers can decrypt
data. Proper key rotation and access control are essential.
Public-key (asymmetric) cryptography is used for secure key exchange (e.g., using
RSA/ECDH) and enabling technologies like TLS and secure file sharing.
Modern enterprise practices add layers: centralized key management, HSMs,
separation of duties, automatic key rotation, and integration with identity systems. These
controls reduce human mistakes that historically weakened cryptographic protections.
Zero Trust and cryptographic identity: Modern approaches tie encryption keys to
identity and device posture, so keys are usable only when both user and device meet
policy this limits attackers who have credentials but not the trusted device state.
Implications: Traditional cryptography provides strong algorithms, but modern deployments
focus on key lifecycle and access controls these are what stop ransomware from negating
encryption. Encrypted backups help only if keys are unavailable to attackers and backups are
isolated. Thus, combine cryptography with sound architecture (segmentation, IAM, immutable
backups) for real protection.
4) Final practical checklist
Enforce MFA and least privilege now.
Deploy EDR + SIEM and immutable encrypted backups.
Run quarterly phishing tests and monthly vulnerability scans.
Use HSMs for keys and keep backup networks separate.
Practice incident response drills with clinical stakeholders.
References
Hailperin, M. (2019). Operating systems and middleware: Supporting controlled interaction.
(Creative Commons Attribution-ShareAlike 3.0 Unported License).
Make It Easy Education. (2022, March 16). Computer Security Threats || Virus, Worms, Adware,
Spyware, Hacker || How Threats are Spread [Video]. YouTube.
[Link]