An opportune time to build cyber resilience

Now is the ideal time for Australian healthcare providers to review, refresh and strengthen their cyber security defences.

After months of pandemic, we are finally seeing grounds for optimism. Vaccines have been approved and are being distributed to communities around the world.

While Australia’s healthcare system has fortunately not been overwhelmed by new patients, there are signs of a surge in healthcare cyber attacks. The Australian Cyber Security Centre (ACSC) published a record number of cyber alerts in 2020, and late last year identified “a sustained campaign by sophisticated cybercrime actors impacting the Australian health sector.”¹ So there is no time for complacency.

Australia’s resilience to the pandemic provides an opportunity to strengthen our cyber defences. As this pandemic has demonstrated, taking a proactive approach to foreseeable problems is by far the most effective strategy in the long run.

Priorities to keep up to date

The Australian Cyber Security Centre (ACSC) warns that various forms of cyber attacks, including ransomware, are rising in volume and sophistication. The healthcare sector is particularly likely to be targeted for multiple reasons, such as the inherent value of healthcare data in general (and vaccine-related intellectual property in particular), as well as potential vulnerabilities arising from rapidly implemented pandemic response related workflows and workarounds.

Fortunately, implementing a few simple countermeasures will greatly reduce your risk of cyber attack, and may also improve the resilience and functionality of your information systems.

Apply software updates and patches as soon as they’re available

Software updates and patches routinely include security updates that address vulnerabilities before they can be exploited. Cyber criminals can be surprisingly agile in exploiting vulnerabilities, so it is important to have a responsive process in place to receive patch notifications when they become available, and ensure they are assessed, tested, and deployed in a timely manner.

The ACSC reported in March 2021 that malicious actors are exploiting Microsoft Exchange servers², and strongly recommends applying the latest updates immediately to address this vulnerability. Detailed technical advice is also available for those who need it.³

Many systems provide an option to download and apply software updates automatically. We recommend using this option if appropriate for your organisation.

Enhance your organisation’s security awareness

There is a growing understanding that the creation of safe environments requires a certain amount of shared vigilance. We’ve all learned how to mitigate the pandemic through social distancing and other measures. A very similar security awareness needs to be developed to manage cyber security risks. It’s not just a job for experts, it’s something that we all need to maintain awareness of as we go about our daily lives.⁴

The Agency’s Digital Health Security Awareness course is a free online training program that focuses on cultivating cyber security awareness across the health sector. With regular reinforcement, this new level of awareness can become an embedded part your organisation’s culture, to the benefit of yourself, your colleagues, and the people you serve.

Scamwatch offers the following advice:

“Scammers may try to obtain your personal information by claiming it is required for you to get the COVID-19 vaccine. Don’t give personal information to anyone who calls you about the vaccine. Vaccine offers that ask for personal or financial information are scams. If you receive unexpected emails or text messages about the vaccine, don’t click on any links. They may contain malware and give your personal information to a scammer.”⁵

• Australian Cyber Security Centre
• Report a cyber-crime
• Scamwatch
• IDCARE

^{1 Australian Cyber Security Centre (October 2020) Sustained targeting of the health sector
2 Australian Cyber Security Centre (March 2021) Exchange server critical vulnerabilities
3 Australian Cyber Security Centre (March 2021) Advisory 2021-002: Active exploitation of vulnerable Microsoft Exchange servers
4 Australian Digital Health Agency (March 2019) Security Behaviours: Encouraging everyone to be aware of information security
5 Scamwatch COVID-19 vaccination scams}