The majority of attempts were SSH brute force authentication attacks, a method used by threat actors to gain access into servers by using an automated list of usernames and passwords, which constituted 79 percent of the attacks on the secure server and 71 percent in instances using minimum, cloud-native security. Similar to SSH attacks, the second largest group of attacks were MySQL authentication attacks, a method hackers use to gain access to databases by using brute force username and password combinations.

The data collected from this honeypot reinforces the importance of health care organizations implementing security standards and protections within their IT infrastructure. As health care IT platforms continue to transition to the cloud, health care organizations should take full advantage of what providers have to offer, and then some. Just because you’re able to offload responsibilities to the cloud does not mean you can rely solely on the security of the provider. Best practices for health care systems to proactively protect against attacks targeting cloud environments include:

• Keep your software up to date: This single step will help prevent a majority of exploit-based attack vectors. This means patching your operating systems, system utilities, and any code running on your server, such as application plugins and themes for CMS products.

• Restrict administrative control: For protocols such as RDP or SSH, consider adding Source IP-based restrictions. For CMS products, such as WordPress or Joomla, consider using configuration options to limit administrative login page access to trusted IPs

• Limit Access: Use a firewall to only expose the services you need to the outside world.

Additionally, below are two common cloud configuration errors and tips on how to remediate them:

• Using password-based authentication for administrative access: As the honeypot showed, brute force attacks are all too common. By limiting SSH access to key-based mechanisms this attack surface can largely be mitigated.

• Default or simple passwords for application components: Make sure that any systems or applications requiring a password to authenticate are using strong codes to do so. A quality and secure password is one that is unique and long - don’t worry too much about the old rule regarding letters, numbers, and symbols.

Concurrent with applying best practices, health care organizations should invest in complementary technologies and third-party expertise, such as consultants and managed security providers as a force multiplier. As illustrated in this honeypot experiment, although hyperscale cloud providers offer standard protections, third-party security technologies and expertise can make the difference between preventing an incident and paying to remediate one.

Health IT Homepage