News and Music Discovery
Play Live Radio
Next Up:
0:00 0:00
Available On Air Stations

Cyber Bytes: Ransomware Attacks on Healthcare Institutions

Murray State hosts the Security Matters cybersecurity conference on April 21st.
Murray State hosts the Security Matters cybersecurity conference on April 21st.

In the next installment of Sounds Good’s Cyber Bytes series, Tracy Ross speaks with Dr. Michael Ramage, director of Murray State’s Cyber Education and Research Center, about cyber attacks against healthcare systems nationwide. Ramage explains how the cyber attacks began and what that means for medical and educational institutions, other businesses, and individuals.

Ramage begins by pointing to a clear demarcation point in the world of cyber security: before and after Stuxnet. “Stuxnet was designed to infect your computer, look at your computer to see if you were running a certain operating system connected to a certain programmable logic controller in a certain area of the world. If it was, it would do its thing. If not, it would replicate it to your contacts and to your USB drives that were connected and then essentially go dormant and go to the next one.”

“Development of Stuxnet started in 2005. It was actually detected in 2010,” he continues. “When cyber security researchers detected it, they noticed it was zeroing in on Iran and, in particular, it was looking for a computer connected to a programmable logic controller in a rural part of Iran that was not even connected to the internet.”

Ramage explains that Stuxnet was able to infect the offline computer when IT professionals running the machine updated their software. Researchers traced this ransomware to a uranium enrichment program in Iran. Ramage explains that it’s been said that the United States and Israel partnered to infect the computers in Iran, though this was never officially proven. “Whoever it was that officially targeted a computer not connected to the internet in a rural part of Iran succeeded,” he says.

“I share that story to say if somebody wants to target you or me, they can succeed with enough money, knowledge, and resources. These attacks that we’re seeing on hospitals, education, small businesses, and governments, all of these attacks…are exploiting the basic things that we know we should be doing: access control.”

Ramage says that failing to utilize protective access control measures are “allowing what could be an isolated incident to become a more widespread problem, and most of these things are starting because of a user clicking a link or opening an email. If we follow these basic steps, then these attacks that are successful would either not be successful at all or would be limited. The disturbing trend in these is that they are way more impactful than they should be.”

Ramage says that healthcare institutions are often targeted because the dire necessity to get these medical networks back online makes them highly profitable for cyber attackers. He also attributes their vulnerability to the number of access points available, from computers to medical equipment retrofitted to access the internet. Such was the case for a cancer clinic in Louisville whose network was hacked and who had to pay the attackers a ransom immediately to continue to provide life-saving treatments to their patients.

“I think the main takeaway would be — and I’ll even broaden it to all security managers and managers of organizations — you are a target. Accept that you’re a target. Accept that they’re coming after you. Try to figure out — and talk to a professional to figure this out — what steps you can take to prevent it from happening in the first place or minimize its impact on your organization.”

Ramage says this is especially important for medical and educational institutions where HIPPA and FERPA regulations require security breaches to be reported. “It becomes a real issue,” he concludes. “You have to report it to the federal government on how bad that was impacted. So, you can’t sweep it under the rug when it’s regulated.”

For more information on MSU's Cyber Education and Research Center, visit its website. Read the first installment of Cyber Bytes here.

Tracy started working for WKMS in 1994 while attending Murray State University. After receiving his Bachelors and Masters degrees from MSU he was hired as Operations/Web/Sports Director in 2000. Tracy hosted All Things Considered from 2004-2012 and has served as host/producer of several music shows including Cafe Jazz, and Jazz Horizons. In 2001, Tracy revived Beyond The Edge, a legacy alternative music program that had been on hiatus for several years. Tracy was named Program Director in 2011 and created the midday music and conversation program Sounds Good in 2012 which he hosts Monday-Thursday. Tracy lives in Murray with his wife, son and daughter.
Melanie Davis-McAfee graduated from Murray State University in 2018 with a BA in Music Business. She has been working for WKMS as a Music and Operations Assistant since 2017. Melanie hosts the late-night alternative show Alien Lanes, Fridays at 11 pm with co-host Tim Peyton. She also produces Rick Nance's Kitchen Sink and Datebook and writes Sounds Good stories for the web.
Related Content