Search This Blog
Sunday, November 8, 2020
Early, low-dose, short-term methylprednisolone decreased mortality in critical COVID-19
Amazon Workers Angry at COVID Precautions Should’ve Taken Complaint to OSHA: Judge
A federal judge has dismissed a lawsuit filed by Amazon warehouse workers in New York, saying their complaints about the company’s coronavirus response should have been taken to the federal Occupational Safety and Health Administration (OSHA) instead of the courts.
The Seattle Times notes that the lawsuit, filed in June, accused Amazon of creating a “public nuisance” by refusing to implement proper coronavirus mitigation policies at its JFK8 warehouse.
Amazon, claimed some warehouse employees, maintained a “culture of workplace fear” in which workers are instructed to “work at dizzying speeds, even if doing so prevents them from socially distancing, washing their hands, and sanitizing their work spaces.”
But U.S. District Judge Brian Cogan, based out of Brooklyn in New York City, said that OSHA is better positioned to “strike a balance between maintaining some level of operations in conjunction with some level of protective measures.”
“No doubt, shutting down JFK8 completely during the pandemic while continuing to provide employees with pay and benefits would be the best protection against contagion at the workplace,” Cogan wrote, attempting to emphasize the need to balance workers’ safety with corporate profits.
Cogan said that courts typically lack the specialized expertise to address workplace safety and public health issues. He also stated that the case’s unique contours—presumably due to Amazon’s pan-national presence—could lead to similar lawsuits being resolved with conflicting rulings.
“Court-imposed workplace policies could subject the industry to vastly different, costly regulatory schemes in a time of economic crisis,” Judge Cogan wrote.
However, attorneys for the warehouse workers were critical of Cogan’s ruling.
Cogan’s deference to OSHA, the attorneys said, “should be very concerning to anyone who cares about the health of American workers, given that OSHA has been virtually AWOL throughout this crisis.”
But Lisa Levandowski, a spokesperson for Amazon, said the company rapidly evolved its internal policies to effectively manage coronavirus-related workplace hazards.
“Nothing is more important than the health and safety of our employees, which is why at the onset of the pandemic we moved quickly to make more than 150 COVID-19 related process changes,” Levandowski said in a statement.
Nevertheless, workers’ advocates have maintained that Amazon has anything but its lower-level employees’ best interests in mind.
The advocacy groups backing the lawsuit, including Towards Justice, Public Justice, and Make the Road New York—all three of which supported workers in their case against Amazon—said Cogan’s decision is “devastating.”
The decision, they said, “frees Amazon to continue to discourage workers to take adequate time to wash their hands at workstations, to fail to promptly pay for quarantine leave in line with some state laws, to undergo ‘contact tracing’ that doesn’t include the most basic steps in tracing worker contacts, and to continue failing to clearly communicate to workers about what they should do if they begin experiencing symptoms or believe they’ve been exposed.”
Sources
Amazon N.Y. warehouse workers’ COVID lawsuit tossed by judge
Amazon worker lawsuit over coronavirus safety dismissed by New York judge
Judge dismisses Amazon worker lawsuit over coronavirus safety
https://www.legalreader.com/judge-says-amazon-warehouse-covid-complaints-osha/
Short on Staff and PPE, Nursing Homes Prepare for Hard Winter
COVID-19 hit nursing homes with a situation that they "were not equipped to handle," according to David Coppins, CEO and co-founder of IntelyCare, a workforce management company specializing in post-acute care. In the following Q&A, Coppins discusses the battle that nursing homes have had to confront during the pandemic, and Pennsylvania CNA Christine Pepple offers a frontline perspective.
Can you list the factors that make nursing homes so vulnerable to the pandemic?
Coppins: Most healthcare workers would tell you that they were not adequately prepared to handle this virus. It has been traumatic across the board. But the nursing home community has experienced incredible loss during the pandemic, and it feels as if they have been wrongfully blamed for that loss. They were thrust into a situation they were not equipped to handle.
Nursing homes, by nature, are not designed to manage highly infectious diseases like a hospital. Hospitals are designed with the assumption that everyone could have an infectious disease, and their workers also operate under that assumption. Nursing homes take what precautions they can, of course, but they do not have the equipment hospitals do, and their workers typically deal with the management of chronic conditions.
In the first wave, when there was a desperate need to get healthcare heroes PPE, hospitals had the purchasing power to acquire PPE quickly. Nursing homes simply don't have that same purchasing power, and were effectively left to scramble for what little PPE remained – often times at 10x the typical price. There was also widespread movement from the public to get all available PPE to hospitals – you had people buying up N95s and donating them to their local hospital. The nursing homes did not benefit from public support in the same way.
It also is important to note that the nursing home population is the most at risk of all patients. It's largely geriatric residents, or people living with chronic conditions. These folks have multiple risk factors for COVID-19. The care at nursing homes is also very touch-oriented. There are multiple CNAs in and out of rooms helping residents with teeth brushing, feeding and washing, and those CNAs, as I mentioned, were not afforded proper PPE, and were forced to use their PPE over and over again.
Finally, it bears saying that nursing homes struggled with staffing prior to the pandemic. The pandemic only exacerbated their short-staffing problem. Hospitals were impacted as well, but in most cases, hospitals canceled elective procedures and were able to re-allocate staffing resources to COVID-19 dedicated floors. Nursing homes did not have this same pool of people to rely on – they're only fall back was agency staff which was also severely taxed.
While there was no ideal situation to be in during the pandemic, nursing homes found themselves in a uniquely unfortunate one – they didn't have the financial resources, the PPE, or the workforce levels to cope."
What are the key lessons learned from the initial experience during the first wave of COVID-19? What measures are being taken to make nursing homes safer for nurses and residents?
Coppins: At the start, there was a rationing of supplies. The CDC recommended that nursing home staff refrain from using masks and gowns for every resident, and they also recommended the reuse of the same mask for long periods of time. And, nursing homes are very touch-oriented – which facilitated the spread of the virus from patient to provider. That was the first problem.
Due to resourcing and staffing issues, some facilities struggled to maintain COVID-19 specific units. While facilities did have COVID-19 specific units, they were not always able to adequately isolate workers and residents to those units. And hospitals were also sending COVID-19 patients to nursing facilities, which, in some instances, introduced COVID-19 to previously unexposed populations.
When we talk about measures to fix this problem, they're expensive ones. We're talking about the high cost to redesign facilities for infection control, and affording a higher capacity of PPE. Ultimately, the biggest takeaway is that the government should have stepped in faster to get necessary PPE to nursing homes. They simply did not have the purchasing power to compete with hospitals.
To prepare for another wave, there needs to be a prioritization of PPE, and an investment in reusable PPE.
Have nursing homes started to benefit from the various state and federal funding efforts?
Coppins: There are various state and federal funding efforts to help out nursing facilities – but those funds were exhausted through PPE price gouging, paying for agency staffing, and the high cost of testing. It was a short-term solution. Those funds are running out, and as far as anyone can tell, there is no second wave stimulus money on the horizon. These facilities are going to be scrambling for PPE and staffing again soon enough.
What are nursing homes doing to counteract the CNA staffing shortage? Can CNAs expect higher wages or bonuses?
Coppins: Some pay rates have gone up. Right now, nursing homes simply don't have the cash flow to put towards recruiting and staffing. And CMS reimbursement rates haven't changed – they need to be reevaluated and updated to match the current demand.
Staffing levels are still recovering from the unemployment act. It blew up CNA shortages. The indiscriminate application of the federal bonus had an unintended catastrophic effect on CNA staffing. Many CNAs stayed home and out of the workforce while there was a desperate need for people to work.
We may see an increase in CNAs working in the coming months. Unfortunately, there have been massive layoffs in the service industry (restaurants, retail, entertainment, etc). So you have a large population of people in need of work. Nursing homes might be an appealing prospect for those populations, and there are plenty of programs out there trying to quickly recruit and train new CNAs. But I think it will be some time before we see if this has any impact on the staffing shortage."
Pepple also provided for her first-hand view from the nursing home front lines.
How has the pandemic changed the working routine of CNAs? How has it changed the way they interact with nursing home residents?
Pepple: For me, it's really just wearing the PPE and being aware of new protocols. If I have been working at a facility that has COVID-19 exposure, sometimes I will be restricted from working at other facilities. Now I am just wearing a mask and eyewear. Earlier in the pandemic, I was head-to-toe in PPE, including a plastic gown. It was so uncomfortable.
But as for how I've interacted with residents, not much has changed. I have a job to do. And the residents need my care. This has been so hard on them. Luckily, visitations are coming back, and we're now able to take them to the dining room and they can get their hair done.
How have CNAs been coping with the hardships of working during the pandemic?
Pepple: The hardest thing for me was the stigma. I wasn't really able to see friends and family because I was working with COVID-19 on a regular basis. It's been hard.
Luckily, the facilities have our backs. They have all gone above and beyond to make sure we were taken care of, and the residents were taken care of. It's good to see some of the activities opening up and having the residents get to see each other again.
Do nursing home workers feel better prepared for the next wave of COVID?
Pepple: We know what to expect now. We're resilient. Nurses and nursing assistants are going to continue to do their jobs because our residents need us.
We are more prepared now. It feels like we have a lot of PPE and we have more structure now than we did at the beginning. When they bring a resident in from the hospital they quarantine for two weeks on the COVID-19 wing. If you're working there, you wear a gown, masks, and protective eyewear. And if you're on a wing where there's no COVID-19, we're just wearing eyewear and masks. We're also getting tested every week – the facilities I have been working with have been so on top of it.
Saturday, November 7, 2020
Ryuk is challenging traditional 'find a flaw, fix a flaw' strategy
Security organizations need their employees to think like adversaries — it could be the best form of defense.
As healthcare and election security collided this week, security researchers have been breaking down the Ryuk ransomware strain and its likely execution path. Reactionary response is usually too late when it comes to ransomware, and "pulling the plug" to stop a spread is an unrealistic tactic.
"A lot of these attack vectors are things you should be testing now," said Charles Henderson, global head of X-Force Red at IBM Security, while speaking on a webcast Monday. It's basic security hygiene.
Federal agencies issued an alert for Ryuk and threat group UNC1878 targeting healthcare organizations Oct. 28. Ryuk's dwell time is shrinking, targeting about 20 organizations per week, according to IBM.
But Ryuk is a commodity malware, available to anyone.
"It's very easy to point out that there are phishing deficiencies in healthcare organizations. But the truth is that phishing is a pretty effective attack vector across all industries," Henderson said.
After falling off the radar for the better half of 2020, Ryuk's infection strategy evolved. Here are the typical steps leading up to a Ryuk execution:
Initial access
Phishing and spearphishing remain king. The UNC1878 threat group typically relies on gaining access by leveraging and repurposing online marketing platform SendGrid. "Generally, they're going to make it through perimeter security devices, because they're not necessarily nefarious in nature, they're not going to be on spam block lists," said Chris Sperry, manager of X-Force Threat Research at IBM Security, while speaking on the webcast.
The emails, if sent with a Google Doc link for example, can make it past detection mechanisms. "It's very hard to protect against legitimate traffic with legitimate links sent through your premier devices," he said.
Even attachments with a double extension and ending in ".ext" can circumvent filters because they're not actually attached to the messages, said Sperry. "Otherwise, you would think a double extension attachment like that would likely be detected on the inbound ingress to the mail server with any basic security solution applied."
As soon as the link is clicked, the BazarLoader or BazarBackdoor will be dumped into a system and phone home. It's the central infiltration for UNC1878 and newer than Emotet and Trickbot.
The commodity malware uses EmerDNS, which is decentralized blockchain-based and rarely monitored, according to Sperry. "I'm not sure how many people are really detecting alternative DNS such as EmerDNS." It also uses alternative domains when communication with its C2.
When defending against an alternate DNS, companies could use egress filtering to prohibit the port used by EmerDNS. However, when using the egress filtering, some organizations "confuse deterrence and prevention," Henderson said.
"I think the general logging or blocking of this proprietary protocol is probably the most optimal way," Sperry said.
Cobalt Strike
Red teams and adversaries alike rely on Cobalt Strike. Cobalt Strike allows intruders to map out the environment, and use Mimikatz, LaZagne or Kerbrute for obtaining passwords.
The bad actors are "collecting the information that they need to essentially pre-populate a targeting file or a number of targeting files," said Sperry. These batch files help propagate Ryuk using Windows Management Instrumentation (WMI) or PowerShell.
It's "interesting with this group to see a crossover in terms of their tools, they're generally signed by certificate," which is indicative of the operators' intentions, said Sperry. IBM found overlap in code signing certificates between Cobalt Strike Beacon and Ryuk.
Until caught, bad actors can impersonate enough "legitimate company information" to obtain a code signing certificate, which provides them means to initiate the attack.
Where to focus
There is no universal solution for ransomware prevention, and even simulated phishing campaigns for employee awareness and deterrence fall short. Instead, companies should try to measure what percentage of failure they face while factoring in human error.
"The simple fact is, if you're relying on training to save you, eventually you're going to have a major issue," said Henderson. "I don't think many CISOs would claim to have solved the fishing problem just quite yet."
For backups, the DHS's CISA recommends the "3-2-1" rule, which says "three copies of all critical data are retained on at least two different types of media and at least one of them is stored offline."
Even if a company has sufficient backups, ransomware evolved to data exfiltration, changing how companies respond to an attack.
Reacting to an attack shouldn't be a security organization's first taste of ransomware. Mitigation goes beyond pen testing and threat intelligence testing, and into red team testing. "It's a bit like playing whack a mole … As you hit one, three more will pop up," said Henderson.
Cyberattack simulations better prepare an organization to think like an attacker, otherwise the security organization remains reactionary. "Because most organizations have a high number of unpatched vulnerabilities, they're not going to get to zero vulnerabilities anytime soon," said Henderson. Organizations have to move beyond the "find a flaw, fix a flaw" mindset and think like an adversary, otherwise it becomes "a matter of IT controls rather than security controls."
https://www.healthcaredive.com/news/ryuk-phishing-trickbot-ibm/588490/