Be aware of the strategies needed to strengthen network security at your dental practice and reduce the risk of a ransomware infection.
Ransomware attacks are a persistent threat in today’s environment and show no signs of slowing. According to FTI Consulting’s 2022 Resilience Barometer, 67% of respondents expect to pay ransoms in the future. Despite the belief that ransomware attacks are happening only to large organizations with large budgets, threat actors do not care whom they are attacking or the type of organization involved. Instead, they look for any opportunity that can be leveraged, whether that involves stealing assets or information or simply disrupting business operations.
Smaller organizations or those without intellectual property or proprietary information like a dental practice may not think they are targets and are therefore safe from ransomware. This is a dangerous mind-set. Ransomware attacks are effective because threat actors are usually uninterested in the data they are encrypting or stealing. There is more value in selling them back to the organization than there is in selling them to a third party on the dark web. As a result, ransomware actors focus on applying as much pressure as possible to be paid, regardless of the type of data or information the organization possesses.
Beyond the financial cost of paying a ransom or the expenses needed for remediation, ransomware attacks should be concerning to dental practices for 2 main reasons: reputation damage and exposure of protected health information (PHI). A mishandled ransomware attack can cause patients to lose trust in the practice and take their business elsewhere, and rebuilding this trust can take years. If PHI is stolen or compromised during a ransomware attack, these data are at risk of exposure, creating ramifications for patients (eg, identity theft) and HIPAA violations for the practice (eg, hefty fines, potential investigations from the US Department of Health & Human Services Office for Civil Rights, and penalties).
Reputation damage and PHI exposure are significant enough to cause permanent damage to the practice, requiring preparation before a ransomware attack with a crisis communications plan. This plan should be able to functionally answer vital questions such as the following: When systems are taken offline during an attack, what is the plan for contacting patients, employees, and other stakeholders? Who is responsible for leading the crisis communications response? In support of this response, are there advisers already retained, or do they need to be identified and hired?
Once the crisis communications plan is established, it should be tested and regularly updated to ensure its effectiveness and ability to keep pace with evolving threats. The plan should not be used for the first time during a live incident. Testing in advance will allow for tweaks and for team members to be comfortable in their response roles.
But a crisis communications plan alone is not enough to mitigate the risks from ransomware attacks. Proper protections should also include:
Cybersecurity is the responsibility of everyone who works at your dental practice—not just of your information technology team. Although there is no silver bullet for ransomware, you can use several strategies to strengthen network security at your dental practice and reduce the risk of a ransomware infection.