This is the third in a series on cybersecurity related to the healthcare industry. The first two posts dealt with the incidence and impact of cybersecurity breaches and the responsibilities of each individual case manager in preventing breaches. This article will discuss the incidence and significance of “Phishing” and what you can do to make sure you are not caught in a phishing attack. This is just part of the article, for more, check out - http://www.tcshealthcare.com/cybersecurity-for-case-managers-how-to-prevent-phishing-attack

1. Cyber Security for Case
Managers: Phishing Attacks
PAT STRICKER, RN, MED

2. Phishing by Definition:
PHISHING IS A SCAM AIMED AT GETTING AN ONLINE USER TO REVEAL PERSONAL OR
CONFIDENTIAL INFORMATION FOR THE PURPOSE OF IDENTITY THEFT. THERE ARE THREE
TYPES OF ATTACKS:
CYBER SECURITY FOR CASE MANAGERS: PHISHING ATTACKS
Phishing – an exploratory attack targeted at a broad audience to manipulate victims into
opening file attachments or embedded links in an email. The scammers’ goals are to obtain
sensitive data, personal information, or user/network credentials that can lead them deeper
into an organization’s data. A basic attack is distributed en-masse or blasted out like spam.
Spear phishing - a targeted phishing that is more sophisticated and elaborate than a
phishing attack. It focuses on a specific company or individual and combines tactics like
personalizing or impersonating users so the spear phishing email is extremely accurate and
compelling. It also attempts to bypass or evade email filters and antivirus software. The
goals are the same – to coerce a target into opening an attachment or embedded link that
provides long-term access into an organization’s system and the ability to introduce
malware, Trojans, key loggers, port listeners and multi-vector attacks.
Whaling – very similar to spear phishing, but a more specific form of attack, targeting
corporate upper management by name with the intent of obtaining confidential company
information. Whaling involves using an email or webpage that appears legitimate and
contains a high sense of urgency. It is often disguised as a legal subpoena, client complaint
or internal executive directive.

3. How it Starts
A phishing scam typically starts with a
legitimate-appearing email from a
person, company, or website asking the
user to update personal information, such
as a password, credit card, social security
number, or bank account number. The
message looks authentic and comes from
organizations a user may have accounts
with. It also may include legitimate-
looking company logos and formats that
the company uses. In fact, it usually looks
so authentic that up to 20% of recipients
respond to them and 91% of data
breaches start with a phishing attack. The
average cost of a phishing attack is $1.8
million. In fact, the 2015 HIMSS
Cybersecurity Survey of 300 top
healthcare information professionals
stated that phishing attacks are their
biggest future security fear and the #1
thing that keeps Chief Information
Security Officers up at night.
Phishing Trends
The Phishing Activity Trends Report shows
that there were 630,404 unique phishing
attacks detected from January to September,
2015. This means 36% of the world’s computers
are infected with this type of malware. While
some employees are specifically targeted
because of their position or types of
information they have access to, all individuals
and companies should assume they are or will
be targets of phishing attacks.
However..
There are necessary steps you can take to
help prevent these kinds of attacks..

4. Here are some Ways!
01/10
Phishing scams are frequently presented in the form of spam
or pop-ups that are introduced through email. To make sure
you are not a victim of a phishing attack, let’s review some
things you can do to prevent getting hooked”. Two articles, 8
Ways to Prevent “Phishing Scams” and 10 Tips to Prevent
Phishing Attacks provide the following useful suggestions to
help guard against phishing:
Are not personalized.
Come from unknown senders.
Ask you to confirm/update personal information (especially when
they are urgent).
Threaten you with frightening information, if you do not respond.
Duplicate the image of a real company or are visually similar to a
real business.
Copy the name of a company or an actual employee of the
company.
Promote gifts, or the loss of an existing account.
Learn to identify phishing emails, such as those that:

5. COMMUNICATE PERSONAL
INFORMATION ONLY VIA PHONE OR
SECURE WEBSITES:
Do not give personal information over the phone
to anyone who calls you and do not call the
phone number provided in an email asking you to
update your information. Look up the number of
the company or organization and call them to
verify if the email or call is legitimate.
For email transactions, make sure the website is
secure before giving any information.
SITES WITH THE NEW, MORE
PROTECTED TLS CERTIFICATE ARE
SAFER..
--than those with the older SSL certificate, since
they are protected from eavesdroppers.
Even if the browser address has a padlock or a
green address bar, you cannot be guaranteed that it
is totally safe, since “phishers” are applying for
certificates in names of companies that are very
similar to the real website name, e.g.
“emergencypaypal.net” or “phypal.com” instead of
“paypal.com” or “banskfamerica.com” instead of
“bankofamerica.com”.
If the “phisher” has been able to get a certificate,
the site may have a padlock or a green address bar,
but the name will be a little different than the
official site. So check the website name carefully.
If you are still unsure about the sites validity,
double-click the padlock icon to see the security
certificate. In the “Issued To” in the pop-up window
you will see the name matching the site you think
you’re on. If the name differs, you are probably on a
spoofed site.
LOOK FOR A PADLOCK IN THE
BROWSER ADDRESS AND A “GREEN
ADDRESS BAR”
--indicating the site has applied for a SSL
certificate , showing they are the legitimate
owner of the website and that information
to and from the site is encrypted.

6. If your browser gives you a
message about an
"untrusted security
certificate" for a website,
do not proceed to the
website, as it is not
trustworthy.
Do not download files or open
attachments in emails from
unknown senders.
Even if emails are from known senders, be certain you
know the files or attachments are trustworthy before
downloading or opening them.
Files or attachments that you are not expecting could
contain malware that could infect your computer by
downloading unwanted files onto your system.
Be wary of links that offer low cost products. They
could lead to phishing webpages that can gain access to
your credit card information.

7. Beware of embedded links in emails
--that ask you to update your personal information
or password, even if the email appears to come from
someone you do business with. Phishing websites, in
addition to looking legitimate by using company
logos, links to the site, etc., also try to appear to be a
security-conscious organization by notifying you
that your account was compromised and asking you
to be proactive and re-register or change your
password. They may even provide a hyperlink to
make it “quick and convenient” for you to update
your information. However when you click on the
link, it will take you to the phishing website, not the
legitimate website, and steal your information. To
prevent being “caught”:
Hover over the hyperlink to determine the address of
the hyperlink. You should be able to tell if it is the
official website address or a copy-cat. Example:
www.banskfamerica.com instead of
www.bankofamerica.com.

8. Beware of pop-ups
Never enter personal
information in a pop-up
screen.
Do not click on links in a pop-
up screen.
Do not copy web addresses
from pop-ups into your
browser.
Do not submit personal
information into pop-up
screens, since legitimate
organizations do not ask you
to submit information that
way.
Enable pop-up blockers.
05/10
Always enter the
company website
address yourself
--or look up the company phone number
and call to see if they are requesting the
information. Legitimate businesses
usually do not request personal
information by email.
Never enter personal
information through
links provided in an
email.
Only login and enter personal
information once you are sure you are on
the official site.

9. Use anti-spyware, firewalls, spam
filters, and anti-virus software.
Update the programs regularly to assure they are
able to block newly identified viruses and spyware.
Anti-spyware and firewalls prevent phishing attacks
from gathering data from your computer, such as
webpages containing personal information, like
credit cards.
Spam filters identify files that could contain spam
(unsolicited commercial email – UCE). The filters
look for spam based on content, false information in
headers, blacklisted files or known spammers,
specific senders, or wording in the subject line or
body, or unapproved senders.
Antivirus software scans every file which comes
through the Internet to your computer to prevent
viruses from deleting files or directory information.

10. REMEMBER..
Anyone can be targeted almost anywhere online, so you
need to keep an eye out for “phishy” schemes. I’m sure
you don’t want to be the one responsible for allowing a
malware, virus, or spyware to gain access to your
organizations computer system, or worse yet, the one
responsible for a data breach that resulted from your
phishing attack.
Watch out for the “phish”!

11. To Continue Reading Visit..
www.tcshealthcare.com/cybersecurity-for-case-
managers-how-to-prevent-phishing-attack