This document provides information about building an effective ransomware defense program. It discusses the large costs ransomware attacks have had on the healthcare industry, with the average cost of an attack being over $60 million. A case study is presented on a 200 bed facility that was impacted by a ransomware attack, with their cash reserves being depleted, claims processing stopping, and revenue reductions of $2 million. The document outlines the operational impact of typical ransomware attacks, including two full weeks of downtime and multiple impacted systems. It stresses the importance of having ransomware runbooks, testing controls, and establishing communication plans to prepare and respond to such attacks.

1. 1
Public release is allowed
W E L C O M E
T O Y O U R
W O R S T
D A Y E V E R
A ransomware preparedness seminar:
How to build an effective ransomware defense program

2. 2
Public release is allowed
BUSINESS RESILIENCE
VALIDATION™
Expanding beyond compliance to help companies in highly regulated industries build a security and privacy approach that
responds everyday. We provide expertise to not only validate your people, process, and technology is working, but also
ensure you’re rehearsed, prepared, and resilient against threats.
Since 2004

3. 3
Public release is allowed
“Ransomware attacks cost the healthcare
industry $20.8 billion in downtime in 2020,
which is double the number from 2019.”
C OMPARI T E C H AN N UAL RE PORT

4. 4
Public release is allowed
Average Cost of Ransomware $60M+
RANSOMWARE
ATTACKS
HEALTHCARE
-Wired
560 Healthcare Organizations $21B+
LostTime 21 Days

5. 100,000
90,000
80,000
70,000
60,000
50,000
40,000
30,000
20,000
10,000
0
10,000
20,000
30,000
40,000
-2 -1 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Cash Reserves, Receipts & Expenses – Per Bed
Reserve Expenses Claims 2 per. Mov. Avg. (Reserve)
Post Attack
CASE STUDY
200 bed facility in a competitive market never
recovered
• $100K per bed deficit
• 6-10% reduction in revenue
Attack
Pre-Attack
• EHR down
• Claims processing stops
• Elective procedures diverted
• EHR back, other systems down
• Cash reserves depleted
5

6. 6
Public release is allowed
OPERATIONAL IMPACT
T YPICAL
2 Full Weeks of Downtime
• Opened 24/7 Incident Command Center
• Paper process for everything
• Confusion & inconsistency
• Downtime Boxes – designed for 2-3 days
Multiple Systems Impacted
• IT focus on Payroll & Materials Mgmt.
• No PACS – surgeries postponed
• BCA (24/7) devices – lost value quickly
• Limited workstation access made EMR
unusable
• Phones on same network lost ACD/Menu
functionality
6

7. 7
Public release is allowed
THE RECOVERY
Enterprise-Wide Effort
Solid four months of work and still
happening six months post event.
Confusion & Inconsistency
Departments, clinics, and ancillary
departments entering backlog of data.
Frustration & Delays
Some did nothing or pointed fingers.
Missing Data
Continue to find missing charge,
order, or result.
Delays
THE CLEANUP
14 days of paper orders, charges, & results.
Four months of matching patients in the system.
Additional Expenses
$250K-$500K in overtime, special
services, remediation assistance.
Lost Revenue
No claims processing for 60+ days
Revenue reduction of $2M.
No Progress
IT projects delayed for several months.
7

8. 8
Public release is allowed
“Only 44% of healthcare providers conform
with protocols outlined by NIST CSF.”
C Y N E RGI ST E K AN N UAL RE PORT

9. 9
Public release is allowed
PREPARE FOR RANSOMWARE
APPLYING PANDEMIC LEARNINGS TO SECURITY
Testing
Perform a Compromise
Assessment for signs of
adversarial activity
Social Distance
Limit the spread of
infection with
Network
Segmentation
Treatment Plan
Build a plan by creating and
maintaining runbooks and
practice on a regular basis
Contact Tracing
Get early warning signs
with Endpoint Detection
& Response
Checkup
Test controls in
production with
Security Control
Validation
Scrubs & Gowns
Separation of duties with
Privileged Access
Management
Masks
Apply PPE with Multi-Factor
Authentication
9

10. 10
Public release is allowed
RANSOMWARE RUNBOOK
REVIEWS
C Y N E RGI ST E K AN ALYSI S

11. 11
Public release is allowed
3 DUTIES
WRITE SOMETHING HERE
• Who detects and responds to
the incident?
• How do you determine it is an
incident of magnitude?
• Who decides?
• How do you communicate that
an incident has occurred?
Duty to Respond
• Who is on the team?
• Where / how do you get
together (potentially with
alternate systems)?
Duty to Convene
• Who makes the decisions?
• How do you handle lines of
succession?
• How do you make decisions
quickly with limited data?
• Who can you call for help?
(internal/external)
Duty to Act
RANSOMWARE RUNBOOKS
11

12. 12
Public release is allowed
COMMUNICATION PLAN
RUNBOOKS
CRISIS COMMUNICATION
IS AN ART
• Breaking glass and holding statements
• Internal and External Communications
• Define cadence of communications
• Social media
POLICY & PROCEDURE
DOCUMENTATION
12
• Policy is different than a procedure
• Reference multiple forms of evidence
• Update logs
• Exercise dates and hot wash
•.

13. 13
Public release is allowed
T H A N K Y O U
Additional Resources
• “Ransomware in 2021:We Know It’s an Issue, Now
What?” Podcast Episode
11940 Jollyville Road
Suite 300-N
Austin,TX 78759
(512) 402.8550