SLAM Method: How to Prevent HIPAA Email Phishing Attacks
Cyberattacks are on the Rise
Cybercrime hit the scene in the 1970s as computer information technology (IT) took shape. What started as spam mutated into malware and viruses (the first virus was reported in 1982, created and released by a higher schooler, no less!). Remember having to download pop-up blockers and Norton Antivirus software or having your computer crash?
Cyberattacks rose by 42% from 2021 to 2022 (genuinely astounding). Transitioning to cloud-based infrastructures created a cornucopia of critical failure points and security gaps. Not only does this cost billions, but it creates a deadly ripple effect reputationally and legally and can threaten human life in the healthcare setting.
While many would argue that cyberattacks can be blamed on one failed password or misconfiguration, hacking happens in stages, making it critical to be vigilant. This article will define some key terms, explain types of email phishing, describe the SLAM method, and provide examples of how to protect yourself.
Who Does the Hacking?
There are four key players in this cyber world:
- Cyber attackers: someone or a computer bot that tries to steal, expose, alter, disable, or destroy information.
- Cyber defenders: someone or a computer bot that protects a computer from being hacked.
- Developer: who creates computer software.
- End-user: the person or computer who uses the software.
A large meta-analysis in 2021 looked at 70 articles published in the last 12 years on cybersecurity. While several security gaps made the headlines, phishing rose to the top.
What is Email Phishing?
Email phishing is an online scam where cybercriminals send emails designed to appear as if they are from legitimate sources to trick people into giving out their personal information, such as bank account numbers, passwords, or credit card numbers.
What is a Common Indicator of a Phishing Attempt?
The emails often appear to be from well-known organizations, such as banks or tech companies and contain links that direct users to malicious websites or to download malicious software. The websites or software may then capture and store the user’s personal information, allowing cybercriminals to access those sensitive details.
In addition to stealing personal information, email phishing can spread malicious software or ransomware, which can be used to encrypt a user’s data and demand payment for its release (this has happened at numerous hospitals in recent years).
In some cases, malicious URLs or files may be sent within the email, which, if clicked, can install malicious software on the user’s device. As such, it is essential to exercise caution when opening emails from unknown or suspicious sources and not click any links or download any attachments. Find out how to ensure your email is HIPAA compliant here.
Types and Examples of Phishing
1. Deceptive Phishing - This attack uses deceptive emails to trick users into clicking malicious links or downloading malicious attachments. Examples include emails that appear to come from a legitimate company, such as a bank, that ask users to verify their account information or download an important document.
2. Spear Phishing - This attack is more targeted than deceptive phishing and is tailored to a specific group or individual. Examples include emails from a sender pretending to be a co-worker asking for sensitive information or an email from a sender posing as a government agency asking for confidential data.
3. Whaling - Whaling is a spear phishing attack targeting high-level executives or other important people within an organization. In most cases, the attacker attempts to gain access to sensitive information or resources by impersonating a CEO or other executive.
4. Clone Phishing - Clone phishing is a type of attack that involves creating an exact copy of a legitimate email and sending it to the target. The attacker will usually modify the link or attachment in the email to point to a malicious site or download.
5. Smishing - Smishing is an attack targeting mobile devices like smartphones and tablets. The attacker sends text messages with malicious links or attachments. When the user clicks on the link or downloads the attachment, their device is infected with malware.
Email phishing attacks are one of the most common ways hackers gain access to sensitive data. Under the Health Insurance Portability and Accountability Act (HIPAA), healthcare providers and other organizations must protect the privacy and security of their patient’s protected health information (PHI). To this end, one of the most effective ways to protect against HIPAA email phishing attacks is the SLAM method.
What is the SLAM method?
The SLAM method is an acronym for:
- Stop, Look, Ask, and Manage, which involves double-checking the
- Sender, Link, Attachment, and Message.
This catchy four-step process can help organizations protect against phishing attacks and ensure compliance with HIPAA.
The first step is to Stop. This step is all about prevention. Organizations should take proactive steps to protect against email phishing attacks, such as implementing strong security policies, regularly training staff on identifying phishing emails and using email filtering tools to detect and block malicious emails.
Before ever opening an email, check the Sender or who it’s from. Sometimes to see this, you need to hover the mouse over the sender's name to reveal the original email address. For example, the domain name could have spelling errors or random words.
Safe: support@microsoft.com
Unsafe: support@microsoftt.com, support@axium.microsoft.com
Notice the spelling error and domain difference?
The second step is Look. This step involves assessing emails for signs of a phishing attack. When staff receives emails, they should check to ensure the sender is legitimate (as described above), that the email is not attempting to trick them into clicking on malicious Links, and that the email is not asking for any sensitive information.
The most common example is an email describing that your login information has been compromised or needs to be changed. It will ask you to click a suspicious link to change your password, but the webpage will require that you enter your current username and password to proceed. The URL will usually not be the company’s true website address.
The third step is Ask. If there is any doubt about the legitimacy of an email, staff should ask a trusted source or the IT department for confirmation. When in doubt, never open any Attachments.
The final step is Manage. This step involves managing any emails that have been identified as phishing attempts. All suspicious emails should be reported to the IT department and deleted from the system. Any misspellings, grammatical errors, strange wording, etc., within the Message should prompt you to take caution.
By following the SLAM method, organizations can protect against email phishing attacks and ensure compliance with HIPAA. The SLAM method is a simple but effective way to reduce the risk of a data breach. You can also protect your information by ensuring your organization has the proper technical safeguards.
Enroll in HIPAA Training Online Today
For information on how to stay HIPAA compliant, sign up for one of our HIPAA courses.
