Their report published in December 2020 confirms a similar finding in a joint report by a German public broadcaster Bayerischer Rundfunk and ProPublica last September that found millions of records were unprotected by passwords or basic security precautions.
For their study the CybelAngel analysts led by senior analyst David Sygula looked at 4.3 billion IP addresses and found 2,140 unprotected servers across 67 countries with 45 million files freely without the need for hacking tools or even usernames and passwords. The records often contained sensitive metadata including personal healthcare information.
“The fact that we did not use any hacking tools throughout our research highlights the ease with which we were able to discover and access these files,” Sygula added in a press release. “This is a concerning discovery and proves that more stringent security processes must be put in place to protect how sensitive medical data is shared and stored by healthcare professionals."
The company advises four simple steps:
- Determine if pandemic response exceeds your security policies: Ad hoc NAS devices, file-sharing apps and contractors may take data beyond your ability to enforce access controls
- Ensure proper network segmentation of connected medical imaging equipment: Minimize any exposure critical diagnostic equipment and supporting systems have to wider business or public networks
- Conduct real-world audit of third-party partners: Assess which parties may be unmanaged or not in compliance with required policies and protocols.
- CybelAngel provides a complimentary, comprehensive 30-day data exposure assessment healthcare and other organizations use to measure their risk and uncover priority issues.
The full report is available for download in exchange for contact information on the company’s website.
Source: CybelAngel blog/press release
No comments:
Post a Comment