Common medical devices such as oximeters, hearing aids, glucometers, and pacemakers can be turned into spyware and malware, say experts, warning that such devices can even leak your medical data if not layered with adequate cyber protection. Industry experts are now seeking urgent Central government intervention to recognise this threat and immediately put in place measures to plug any possible drain.

Their warning comes close on the heels of the ransomware attacks suffered by Indias top tertiary care hospitals, leading to the siege of millions of medical records and vast amounts of health data at Delhis All India Institute of Medical Sciences, Safdarjung Hospital and Lady Hardinge Medical College and Hospitals. A ransomware attack is a computer virus that encrypts ones essential files and renders them inaccessible unless the hacker is paid for the key to open them.

Indian multinational pharmaceutical company Sun Pharma, the worlds fourth largest generic pharma firm, was also among the establishments that recently took a hit. These attacks ran parallel to the series of failed attempts to hack into Indias top medical research organisation, the Indian Council of Medical Research (ICMR).

What these attacks indicate is our vulnerability, said Shuchin Bajaj, founder director of the Ujala Cygnus Group of Hospitals, adding that these electronic health records contain one of the most valuable databases of knowledge: sensitive patient information.

Now, experts are warning that it is not only large healthcare establishments that are under threat. Many personal use medical technology devices including oximeters, hearing aids, glucometers, medical monitoring watches, and implants such as pacemakers and insertable loop recorders meant for long-term monitoring and recording of electrical activity of the heart all contain software as medical device (SaMD) and software in medical devices (SiMD) and are usually connected to the internet, mobile phones, servers, and the cloud.

If not given adequate cyber protection, these devices can be turned into spyware and malware and can even breach data. Currently, there are no guidelines on the regulation of SaMD and SiMD. Therefore, we suggest that the government should consult with industry experts to identify the challenges that could pose a risk to national security, warned Pavan Choudary, chairman, Medical Technology Association of India (MTaI), adding that the biggest challenge with medical devices was their small size.

India has one of the worlds top 20 markets for medical devices and the fourth-largest in Asia. The medical devices sector in India is projected to reach $50 billion by 2025, according to the India Brand Equity Foundation. According to statistics from the Commerce Ministry analysed by the Association of Indian Medical Device Industry (AiMeD), medical device imports rose by a record 41% to 63,200 crore ($ 7.91 billion) in 2021-22 from 44,708 crore ($5.59 billion) in 2020-21.

The Indian population is growing at a rate of 1.6% per year and has an elderly population of over 100 million. Rapid economic growth, rising middle class incomes, and the increased market penetration of medical devices has left the population vulnerable, experts say.

India currently lacks any centralised data collection mechanism which gives an exact cost of data corruption for the healthcare industry. However, it is clear that data -- now called the new oil -- is seeing a threat that has become rampant, sophisticated, and severe, said Arushi Jain, director, Akums Drugs and Pharmaceuticals. As pharmaceutical companies continue to embrace digital transformation, their highly sensitive, valuable information becomes even more at risk for cyberattacks, she said.

Pharma companies face their IT environment being landed with legacy hardware and software. In particular, operational technology devices, networks and systems that support business did not have IT security in mind when built. These networks and systems need to connect with IT networks, which exposes them to an organisations entire threat landscape and creates new opportunities for cyber criminals, she explained.

While the Central government is currently pushing to digitise health records, data protection and cyber-security are governed by the Information Technology Act and the Contract Act. The government has also introduced the Digital Personal Data Protection Bill, which is currently pending before the Parliament.

Data protection is not rocket science, but requires legal and technical artisanship, the allocation of adequate resources and the training of all professionals involved in the processing of personal data, says the World Health Organisation (Europe) in its paper, titled The protection of personal data in health information systems principles and processes for public health. It advocates for continuous effort that is based on an institutional vision, a governance concept and a willingness to be accountable.

Go here to see the original:
Your medical device could be spying on you; industry demands protective laws - The Hindu

Community Care of City of Kawartha Lakes (CCCKL) has a new program, New Frozen Meals on Wheels, offering frozen prepared meals that can be used whenever you need a break. For a menu and further details go to mow.ccckl.ca.

CCCKL will hold a Seniors Awareness Event, May 4, 10 a.m.-3 p.m. at the Lindsay Legion, 12 York St. N., Lindsay. The day will focus on types of abuse, power of attorney, internet security, scams and more. A light lunch will be provided.

Space is limited so if you are interested, call 705-879-4112 to reserve a space.

Darts

The Royal Canadian Legion, Branch 497 Omemee will host the Acreman Dart Tournament, April 29. Registration begins at 9:30 a.m., play at 10 a.m. There is a 16-team limit and teams must be registered by April 22., $20 per person. For information or to register contact Karen at 705-740-3620.

Mothers Day brunch

The Omemee Swans will hold a Mother's Day brunch, May 14, 11-1 pm at the Omemee Legion. Cost is $15 per person, children under 8 free. Payment can be made one week in advance by e-transfer to omemeeswans@gmail.com. For further details call Kathy at 705-750-8689.

Menu is quiche, sausages, salad, mini muffins and cinnamon rolls, and fruit.

Medical centre board

The Omemee Medical Centre (OMC) is a not-for-profit corporation that provides the facility for local primary care providers. The volunteer board of directors is responsible for governing and managing the safe operation of the building.

OMC is looking for interested people to serve on its board.

Application forms and additional information can be found at omemeemedicalcentre.ca. Applications are due April 30. Questions can be sent to the Recruitment Committee at omemeemedicalcentre1@gmail.com.

Seniors

The Omemee Seniors Exercise classes which focus on low impact exercise is held at the Legion, Tuesdays and Thursdays, 10-11 a.m. Cost is $10 per month and your first class is free.

The Omemee Seniors Social Club, open to anyone 55 yrs. and up, will be held Apr. 25 at the Legion. Lunch is served at 12:30 p.m. but come early and settle in. A 10-month membership is $15. A short meeting follows lunch followed by bingo or euchre.

For further information contact Lynda at 705-799-6493.

If you have any news items for future columns, please send to cowsandcranio@gmail.com or call 705-799-7064.

Follow this link:
Opinion | Omemee: New Meals on Wheels program offers a frozen ... - The Peterborough Examiner

5 No Brainer Internet Security Tips

The internet has become a necessary part of every household. There is hardly any American home that does not have an internet connection. With such wonderful technology that connects you with the entire world, concerns regarding security also arise. In this regard, it is highly essential that you must take a few steps in order to strengthen your internet security. Well, fret no more because we are here to lessen your worries by enlightening you with some of the best yet no-brainer internet security tips that are quite beneficial in the long run.

One of the first and most essential steps you need to take is getting a subscription to a reliable and secure Internet Service Provider (ISP). For this, you have to be very vigilant and on your toes. Dont go for any provider that already has a questionable reputation in the industry. You must keep this in mind, your ISP can get access to all your valuable data and information. It must protect you from any kind of breaching and hacking by providing the utmost security.

For this, if you ask us, we would recommend looking for Spectrum in the area. You are likely to find it since it is serviceable in more than 40 states in the United States. Whats more, it is countrywide known for its secure connection and security suite that further adds a protective layer so that you can browse on the world wide web without any worries or concerns of security. You can learn more about it by dialing the numero de Spectrum (for Spanish customers only) and getting all the information regarding its secure connectivity.

Even though it is pretty common knowledge, it is surprising how many people often dont take this into account. Using a strong password can make a huge difference. One of the most common passwords people use is their date of birth or pets name. These types of passwords are quite easy to crack. Moreover, only adding one or maybe two numerical or capital letters wont make your password strong. As a matter of fact, there is a comprehensible criterion that everyone must follow while creating a password.

By keeping the abovementioned criteria, you can create a strong password that is difficult for anyone to guess.

Wi-Fi networks are essentially the entry points to your computer, devices, and accounts. If you access public Wi-Fi, you basically invite viruses, malware, and any kind of cyber threat into your device. In the current age and time, practically every place has a public access network. Whether it is a coffee shop or an airport, you can get connected to the free network in a matter of a few seconds.

BUT DONT DO IT!

Yes, we cannot stress enough how dangerous it could be, especially if your bank accounts are logged in and you have sensitive information on your device. Data breaching is a real thing and it is astonishing how people take it for granted. One wrong move with the technology can cost you a lot and therefore, be very cautious whenever you are using the internet in public areas.

VPN connections are your saviors. They provide you the much-needed protection from online threats by making your online activities untraceable. By enabling a VPN on all your devices, you can protect your information from becoming leaked. Always remember, while using the internet, your security is always at stake, but by enabling a VPN, you can hide from cyber threats.

In addition to all of this, online transactions also become secured if you have a virtual private network enabled while accessing public Wi-Fi. This way, you can use the free internet as much as you want.

There are several benefits of using a VPN, one of which is that it allows you access to the content that has been restricted in your area, for instance, Crackle is not allowed to be used in your general area. To access it, you can install an excellent and reliable VPN, enable it, and revisit the website to make it accessible.

Here is the thing, you cannot go over to the internet without coming across a website that demands an email address or registration. In this regard, not every website is legit. In fact, a lot of these are scams and will continue to send you shady or suspicious emails containing malware or viruses. Moreover, these websites will spam your inbox with fraudulent emails and this will further increase your risk of clicking on threatening links.

So, in order to save yourself from such cyber threats, you can use disposable email generators that give you an email ID you can enter into sites where you probably dont want to give your personal ID. After this, you will not have to constantly worry about receiving weird and shady emails from suspicious websites.

As much as we are thankful to the technology of the internet for making our lives easier. Thus, we cannot ignore the fact that it has also increased the concerns of security. Therefore, to minimize any and all cyber threats. We recommend following the abovementioned tips to protect yourself online from dangerous agents.

Machine Learning And RPA : How RPA Leveraged

5 No Brainer Internet Security Tips

See more here:
5 No Brainer Internet Security Tips - Rebellion Research

SAN JOSE, Calif., April 05, 2023 (GLOBE NEWSWIRE) -- Noname Security, the leading provider of complete and proactive API security, today announced Noname Public Sectors Hardened Virtual Appliance making the API security platform available to the U.S. Federal Government, highly regulated industry customers, and FedRAMP-authorized vendors. The appliance is the first of its kind in the comprehensive API security space and is designed to deliver a drop-in, secure, and scalable system for discovering, monitoring, and protecting mission-critical APIs and data.

Governments and highly regulated industries have unique security needs. Having worked closely with many Federal agencies during my career, I know how impactful it will be to provide this level of security and insight into APIs and provide options that make it easy to meet government standards, said Dean Phillips, Executive Director of Public Sector Programs at Noname Security. The government and regulated industries are not immune from cyber criminals, they are targeted as much if not more than most organizations. Were excited to arm them with the tools they need to protect their assets.

Federal agencies can use the Noname API Security Platform to protect their APIs in real-time and detect vulnerabilities before they are exploited. Noname Securitys Hardened Virtual Appliance makes the API security platform available completely offline with no reliance on internet connectivity, perfect for isolated and controlled environments. It is a finely tuned package of advanced software and premium support built and secured to Federal Government specifications, enabling customers to comply with the most rigorous standards, including Federal Information Processing Standards (FIPS)1 and Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)2. Noname collaborated with a FedRAMP 3PAO, The MindPoint Group, on the development of the Noname Hardened Virtual Appliance.

Noname Securitys Hardened Virtual Appliance enables access to a powerful, complete, and easy-to-use API security platform that helps:

Noname Public Sector LLC has made it easier to deploy, configure and manage the platform via the new Noshell() interface. The shell offers innovative features such as the ability to perform on-demand STIG audits of the internal system itself, while aiming to reduce the overall attack surface of the system.

To learn more about Noname Securitys hardened platform, please contact publicsector@nonamesecurity.com.

Supporting Resources

About Noname Security & Noname Public Sector LLCNoname Public Sector LLC empowers the worlds most critical organizations to protect their most important data. With decades of military and civilian public sector experience, Noname Public Sector combines a deep understanding of government agency requirements with leading expertise on their unique API security considerations. Government agencies using Nonames complete, proactive API security solutions can securely harness their data to serve the public and stay ahead of adversaries. Noname Public Sector LLC is privately-held and based in Herndon, VA.

Noname Security is the leading provider of complete, proactive API Security. Noname works with 20% of the Fortune 500 and covers the entire API security scope Discovery, Posture Management, Runtime Security, and API Security Testing. Noname Security is privately held, remote-first with headquarters in Silicon Valley, California, and offices in Tel Aviv and Amsterdam.

Media ContactStephanie SchlegelOffleash for Nonamenoname@offleashpr.com

1 FIPS 140-2, titled Security Requirements for Cryptographic Modules, is a U.S. government computer security standard used to accredit cryptographic modules. Compliance with the standard is required for equipment used in federal facilities and has become a common stipulation in other public and private IT deployments.

2 Security Technical Implementation Guides (STIGs) are configuration standards developed by the Defense Information Systems Agency (DISA). They are designed to make device hardware and software as secure as possible, safeguarding the Department of Defense (DoD) IT network and systems.

Compliance with STIGs is a requirement for DoD agencies, or any organization that is a part of the DoD information networks (DoDIN). This includes defense contractors that connect to the DoD network or system.

STIGs are also aligned with the Centre for Internet Security (CIS) benchmarks - Level 3.

Read more from the original source:
Noname Security Announces the Industry's First - GlobeNewswire

After avoiding the TikTok craze for the last five years, I finally cavedtwo months ago and set up an account for work purposes to follow Euronews' recently launched profile.

I used my phone number to sign up as it was new and barely used for anything else, and it was pretty much the personal information I cared the least about.

The platform sent me a login code via SMS, I gave Euronews a follow, scrolled a couple of videos on the "for you" page, and then forgot about my account for a month or so.

The sign-up and login process was very easy. Perhaps a little too easy.

A couple of weeks later, when I next logged into my account, my profile name was different, I had posted five cat videos, and was friends with someone called "Cookies Galaxy".

How was that possible? I appeared to be logged into someone elses account.

According to TJ Sayers, Cyber Threat Intelligence Manager at CIS Center for Internet Security, this is a fairly common problem.

"It's kind of a circumstantial thing where someone will get a new number and move on from an old phone number, and the cellular provider relocates that number to somebody," he told Euronews Next.

I had access to the personal information of the account holder (who appeared to have been inactive since 2020), including a list of comments they had made, every single one of their likes, their direct messages, and their email address.

"It sounds like what happened to you is maybe the persons account you got into didn't have any other additional step for authentication (besides their phone number) when they created their account," he further explained, "so you were able to use the number and log into the account".

While my switch happened unintentionally, malicious attempts to take over phone numbers have boomed with the rise in popularity of cryptocurrencies in 2019, according to the cyber expert. Hackers have increasingly tried to gain access to and lock users out of their phones to take control of important banking accounts, including digital wallets.

"Some people are actively trying to compromise phone numbers and email addresses in order to gain access to accounts for other nefarious purposes," said Sayers.

There are two ways of taking over someone elses number, or "SIM swapping". Hard swapping entails taking control of a persons physical SIM card, while the soft version implies calling the phone provider and impersonating the owner of the number by using information, such as the persons date of birth or address, openly available on the Internet.

"People don't even think that when they post social media stuff, it could be used by an attacker," said Sayers, adding, "what [scammers] will do is socially engineer that customer service agent into transferring your number to their device".

While a pin code is enough to avoid hard SIM swapping, preventing soft swapping takes more effort.

Asking your provider to set up a two-step code with a passphrase or a specific number is one way to do that. To avoid having your social media taken over, you can also use an apps registration lock, which can link your account to non-phone number-based identifiers.

For TikTok, the most straightforward solution is to avoid signing up with your phone number. In addition, you can also set up two-factor authentication (2FA), an extra pin generated on the spot, on top of your regular password. TikTok is still trialing this, but 2FA is already in use at other social media companies, such as Instagram.

Still, experts recommend refraining from using 2FA with text messages, as inadvertent swapping can still occur. "Once that happens, (scammers) can go and reset all of your accounts, because theyll get all of your two-factor authentication codes," said Sayers.

"Back when 2FA or multifactor came around, the predominant venue was to either get the code via text message or to get it via e-mail. Unfortunately, the threat landscape has evolved quite substantially and text messages are no longer the best practice for receiving authentication codes," he added.

"Email is a good option, but even better than that is to have some form of an app on your phone. So like Google Authenticator, Microsoft Authenticator, or Authy".

While authenticators are easily available and companies such as Twitter are moving away from texts, according to Sayers, industry buy-in is still behind.

"It's not really a technological next step that we need. It's more of an adoption next step. We're still pretty behind the curve with trying to get people away from text messages," he said.

Meanwhile, physical security keys such as Yubikey, which need to be plugged into a computer to authenticate and are deemed the most secure authentication technology right now, are becoming more widespread.

"Of course, we're going to see threat actors evolve and they'll start trying to attack those other new methods and then new technology will come out," warned Sayers, adding that the damage a person can suffer will depend on the use they make of social media accounts.

Reputational damage could be huge, according to the expert, but "spear phishing" - gaining access to sensitive data by impersonating the person for nefarious reasons - is also likely.

We live in a virtual world and a lot of times, especially post-COVID, a lot of people are working remotely. So if you can take over a social media account, people may not even second guess that you're contacting them through that account because it looks like you're them. So they can use that to try to gain access to more sensitive information, he explained.

As a bottom line, the expert is pretty clear. "Generally, for social media security, you can't go wrong with a unique long password, and I really emphasise unique and long," he said.

Read more:
I accidentally hacked into someone else's TikTok account. It's more ... - Euronews