Image: Microsoft
Microsoft has made today its AccountGuard service free for healthcare organizations working on the front lines of the coronavirus (COVID-19) pandemic.
The AccountGuard service is an anti-phishing protection system that Microsoft provides only to a very small number of selected users.
Those who are admitted in the AccountGuard program receive extra protection and attention from Microsoft’s security staff. This includes additional security features for their email accounts to detect spear-phishing emails that originate from the infrastructure of known hacker groups, and especially nation-state actors. More precisely, the service provides:
- Notification in the event of a verifiable threat or compromise by a known nation-state actor against the participant’s Office 365 account.
- Notification to both the organization and, where possible, the impacted individual if a registered Hotmail.com or Outlook.com account associated with the organization is verifiably threatened or compromised by a known nation-state actor.
- Recommendations to the participating organization for remediation if a compromise is confirmed.
- A direct line to Microsoft’s Customer Security and Trust team.
- Best practices and security guidance specific to Healthcare organizations.
- Access to cybersecurity webinars and workshops.
Microsoft launched the AccountGuard service in 2018, and until today, the service has only been available to political campaigns, election officials, and other organizations involved in the electoral process.
In a blog post today, Microsoft annonced an expansion of this system to include two new types of organizations — healthcare entities and human rights groups.
Expansion for healthcare providers
Tom Burt, Microsoft’s Corporate Vice President on Customer Security & Trust, announced that Microsoft is expanding this program today to include healthcare organizations after multiple reports of cyber-security incidents that disrupted the activity of hospitals and clinics during the ongoing COVID-19 outbreak.
This includes incidents like the attacks targeting the Brno University Hospital in the Czech Republic, the Paris hospital system, Spain’s main hospital network, hospitals in Thailand, an Illinois health agency, and the attacks targeting the World Health Organization.
AccountGuard may not have been able to prevent all the attacks listed above, but it could have prevented some, namely those that began with a spear-phishing email received by a hospital employee.
Burt says AccountGuard for Healthcare will be available starting today in 29 countries across North America and Europe, where AccountGuard is currently already available.
Future plans include expanding the service to more countries, pending local laws and regulations.
Microsoft says the service will remain free for all healthcare organizations “until the COVID-19 pandemic subsides.”
Expansion to human rights orgs
In addition, Microsoft has also made AccountGuard available for human rights and humanitarian organizations. This is a natural expansion of the AccountGuard service and has no connection with the coronavirus outbreak.
“Leading human rights and humanitarian organizations including Amnesty International, CyberPeace Institute, Freedom House, Human Rights Watch and Physicians for Human Rights have already registered for our AccountGuard threat notification service through an initial pilot,” Burt said.
With the AccountGuard service being honed to detect spear-phishing attacks coming from nation-state hacking groups, the AccountGuard service’s expansion to human rights organizations is a natural evolution for the program, as humanitarian organizations are often the target of attacks from state-sponsored groups.
Healthcare organizations can sign up here, while human rights and humanitarian organizations can sign up here.
