Approximately 75% of ransomware attacks on the healthcare sector over the past year occurred during weekends or holidays, highlighting the urgency for organizations to strengthen their staffing and security measures during these high-risk periods. Jeff Wichman, director of incident response at security firm Semperis, emphasized the need for proactive preparation.

"In reality, we should be staffing up because if the attackers know for a fact that on weekends we, as citizens, take time off. Organizations should be staffing up into the holiday season. Not down," Wichman stated.

However, many healthcare organizations face significant staffing constraints, making it challenging to ensure adequate coverage on weekends and holidays. "In that case, then it's working with partners," he explained. "If the firm can afford to get a security operation center, a managed service provider that can provide that coverage on weekends and holidays. Perfect. But you've got to make sure that they're staffed completely during the holiday and weekend seasons, as well."

Wichman also stressed the importance of being prepared for worst-case scenarios by conducting regular recovery drills and testing system restoration processes. "That includes practicing recovery drills, bringing back your critical assets in a timely fashion, really understanding how long does it take to bring back operations, and not from a theoretical," he said. Organizations cannot assume they can "just push a button, and the backup will restore the domain controller. There are more steps involved," he warned.

"They really need to get that real-time, objective [process] nailed down," Wichman concluded.

In an interview with Information Security Media Group, Wichman also discussed critical topics such as:

• The importance of testing and validating backups;
• Common identity management mistakes that lead to security vulnerabilities;
• The potential impact of upcoming cybersecurity regulations in the healthcare industry.

With over 20 years of experience in information security, Wichman has handled a wide range of incident response investigations, from minor business email breaches to significant ransomware attacks. As an expert in digital forensics and incident response, his insights highlight the critical steps healthcare organizations must take to fortify their defenses against cyber threats.