Sun Pharmaceutical Industries was hit by a Ransomware attack. The Ransomware attack caused a breach of certain file systems and data theft of certain company’s and personal data. According to Deloitte Data Security Report 2022 – the major 3 Cyber Risk concerns that Indian Pharma Companies faced in 2022 were:
- Ransomware Attacks
- Data Theft &
- IP Theft
1) Data Breaches
When cybercriminals gain unauthorized access to confidential data, it causes a data breach. Cyberattacks could be money motivated as well. Thus, successful data breaches lead to financial loss, reputational damage, and regulatory penalties. To mitigate such cyber risks, businesses must enforce the following solutions: Implementing Robust Access Controls Organizations must implement MFA for employee authentication. The users must know better to keep robust passwords instead of easily crackable ones. Also, they must implement role-based access controls to restrict sensitive data accessibility. Encrypting the Data Encrypting the data whilst it is at rest and in transit. This is to ensure protection from unauthorized access. Regular System Updates & Patches Keeping the systems and software up-to-date eliminates the possibility of vulnerability exploits. Cybercriminals dwell on outdated software as their entry point to gain access. Apply security updates and patches to address vulnerabilities in software and systems.2) Phishing and Social Engineering Attacks
Social Engineering is the most common attack method used by Cybercriminals. Phishing emails lure people into sharing confidential data, making financial transactions, or installing malware. To combat these risks: Cybersecurity Employee Awareness & Training Organizations must conduct Cybersecurity Awareness training for all IT and Non-IT users. Educate the users about setting up strong passwords, clickbait, falling victim to phishing attacks, and the consequences of downloading malicious content. It is vital to conduct regular Cybersecurity training sessions. It helps them to identify phishing emails, suspicious links, and social engineering techniques. Email Filtering & Spam Detection Users must be equipped to spot phishing/spam emails and must report them. Organizations should be implementing email filtering mechanisms to detect and block phishing emails. Incident Response Plans Companies must formulate and put in place an Incident Response Plan. This response plan must be effective and prompt if a cyberattack succeeds.3) Ransomware Attacks
Ransomware encrypts data, holding critical data hostage. It leads to operational disruption and potential data loss. To minimize the impact of ransomware attacks: Regular Backups Maintaining backups regularly can help prevent data loss in the case of a ransomware attack. When an organization has a backup strategy in place, data can be restored without paying the ransom. Endpoint Protection Deploying robust endpoint security solutions to detect and prevent ransomware infections. Network Segmentation Segmenting the network to isolate critical systems from the rest of the network, limiting the spread of ransomware. It aids to prevent a cybercriminal from gaining access to sensitive data and systems.4) Third-party Risks
Pharma companies often rely on third-party vendors, suppliers, and contractors. Introducing such 3rd parties could pave the way to security vulnerabilities. To address this: Perform Due Diligence Assess and validate the security posture of third-party vendors before onboarding them. Confirming if they meet Cybersecurity standards such as HIPAA, ISO27001, etc. is mandatory. Establish Robust Vendor Contracts It is advisable to include security clauses and requirements in 3rd party contracts. Also, to hold them accountable to maintain Cybersecurity best practices. Regular Audits & Assessments Performing security audits & assessments of own as well as 3rd party systems and processes at regular intervals. This is to ensure that they remain compliant with security standards.Wrap Up
Cybersecurity threats pose a serious threat to the Pharma Industry due to the confidential and lucrative data they possess. Hence Pharma Companies must keep up-to-date on the latest Cyber risks & monitor their networks for any suspicious activity. It is more important than ever for them to put in place key Cybersecurity steps to protect sensitive data. For Cybersecurity Awareness Training, Data Encryption, regular Backups, DLP, Network Segmentation, Phishing Awareness Simulation, or any other queries/requirements, please email [email protected]. 
