The healthcare industry led the nation in regulations for information security. In an effort to protect private health information (PHI), healthcare organizations are required to protect patient data against any reasonably anticipate threats or hazards.  You are required to perform risk assessments, but knowing your risk is not enough. Steps must be taken to fix issues and prevent data loss. Most other industries and states are joining the bandwagon with regulations of their own. The basics are the same: do your due diligence to protect data or face the consequences.

The Breach

The University of Rochester Medical Center (URMC) recently agreed to a $3,000,000 settlement with the Office of Civil Rights (OCR). URMC reported data loss in 2013 when an unencrypted flash drive was lost. They again reported a breach when a personal laptop with unencrypted ePHI was stolen from a treatment facility. The fine may seem steep when you think that only 43 patients’ data was on the stolen laptop. The bigger issue, however, was the lack of progress in breach prevention from the first to the second incident.

The Cost

Beyond the fine to the OCR, breaches can cost a company much more. According to the IBM Security Cost of a Data Breach Report 2019, healthcare is the industry with the highest average cost at $6.45 million, not including fines. Lost business was the largest contributing factor to this total, accounting for 36% of the total cost. Other factors include detection and reporting, notification of affected parties and post breach clean up.

 Corrective Action

The list of requirements mandated by the OCR look very similar to the actions that are expected to prevent the breach in the first place.

• Conduct a Risk Analysis
• Implement a Risk Management Plan
• Implement customized Policies and Procedures
• Train your staff
• Create and maintain a body of compliance evidence

Prevention is always cheaper

URMC is facing a guaranteed loss of $3,000,000 plus other expenses in breach clean up, notification and potential loss of business. The cost of our cyber risk management from assessment, reporting and remediation starts at $699/year for a small organization. Our automated tool, CyberCompass™, puts you in charge of your cyber risk, cybersecurity and compliance. Addressing all the requirements listed above, we also save you 70% of the typical cost, time and effort. An easy to use dashboard prioritizes your corrective actions, allowing you to work through them at your own pace. With built in regulations for most industries, start your move toward Cyber Confidence® today.

 Contact Us for more details or visit thirdrock.cybercompass.co

In the days of old, people built giant walls to defend their land. It was easy to see the invading army approach. Pull up the drawbridge, light the arrows and defend your city. Today, the walls are digital and the invaders are invisible and often robots; sneaking in the back door or under the radar, pretending to be someone we trust or attacking out of nowhere. So how do we defend our territory in a modern technology age?

Ditch the passwords

Passwords are the first line of defense in protecting your private information. The problem with passwords though is that if you make them strong, they can be hard to remember. And if you follow the sound advice to not use the same password on any site, you may think you have to remember 30 plus long, hard to remember passwords! To this I give you 2 suggestions:

1. Get a password manager – Don’t trust Google to save your passwords. (see previous blog) A password manager is a vault to place all those hard to remember passwords in a secure location. Read Consumer Advocate’s top ten choices in their article here
2. Use passphrases – Instead of hard to remember letter, number and character combinations, use a full phrase as your password. Pick something you can remember and add modifications to in order to have a unique phrase for different sites. For example, “BobandSusan’sbankaccount!”

Multi-factor Authentication

Requiring 2 forms of verification is becoming a popular and simple way to secure data. Here’s an example one of my money accounts uses. I’m asked for the email, username, or phone number associated with my account. Once entered, I am then asked for a code that will be emailed or texted. This is very easy for me as a user. I don’t have another password to remember, the messages come through quickly and I can access my account. While it’s easy for me, it’s harder for a hacker. Someone would have to be able to access my phone or email to be able to access the original account.

Recognize Imposters

A popular way for hackers to gain access to your data is called spoofing. They send an email from what appears to be a legitimate company claiming something to try and get you to give over your information. Your account has been compromised: type in your password. You’ve won a gift card: type in your password. You have been locked out: type in your password. We’ve seen suspicious activity: type in your password. You get the idea. Hackers use the logo of a trusted company to put you at ease, but when you click on the link it sends you to a spam site that is gathering your data, not resolving an issue. Here are things to look for:

• Is this normal behavior for the company in question? If not, don’t trust the link.
• Check the email address against valid emails you have received from the company
• Look at the link. If you click to a sign in page, check the website address. If you aren’t on the company’s main sign in page, do not put in any information.
• When in doubt, go to your account. If you want to check activity, type in the website address you know and sign in that way. Most companies will post the notifications inside your account so you can verify.

Have you recently purchased a new device? Smart phone, laptop, tablet or even a smart watch? Maybe you just downloaded the latest update to your computer or smart phone. Do you know what it did? Too many times we take for granted the base features technology and updates provide without checking that the privacy settings. Always check the settings represent what is best for you, not what is best for the company.

Location, Location, Location

Location services are very helpful. Let’s face it, who pulls out a paper map anymore when your navigation can tell you exactly how to get somewhere? However, your location does not need to be tracked at all times, so you should check the settings on all of your devices. Most apps have the option to only track while in use. When in doubt, it’s better to turn off location tracking until you find you need it. Phones are not the only devices that track location. Be sure to check settings on your laptop, tablets and smart watches.

“Checking in” on social media? Publicly announcing your location on a social media platform could potentially be dangerous. You are letting would be thieves and criminals know you are away from home, or informing an unwanted person how to find you.

Just Click “No”

Having your passwords saved is extremely convenient, especially if you follow the rule to have different passwords for every site. Google/Chrome wants to automatically save all of these passwords for you which seems very nice of them. The issue is this is not actually secure, especially if you use public WiFi. A hacker could easily write a script to steal the saved data on your computer.

Do you do a lot of online shopping? When your browser asks to save your credit card information, be sure to choose “never”. If a hacker can get your passwords, they can also steal your credit card information.

Public WiFi

Do you deal with sensitive data for work, bank online or simply enjoy online shopping? Accessing private accounts with private data on public WiFi puts you at extreme risk. It only takes one person with the know-how and malicious intent on the same WiFi to remotely access the information on your computer. Save sensitive work for private networks.

If you are a business owner, be sure to have separate WiFi networks for guests, non-sensitive  data and sensitive data. Limit access to the network for sensitive data to those who need access.

PRO TIP: Consider using one computer to “surf” the web and one computer to ONLY access sensitive data web sites such as banking, financial services, stock trading, healthcare and insurance.

In January 2019, Spiceworks surveyed 600 IT and security decision makers over a wide variety of companies, all with one thing in common: their use of third-party vendors or Business Associates (BAs). Their findings should have everyone looking more closely at their BAs. Some of the key findings were:

• 90% of companies with third-party policies review them annually
• 81% consider their policies effective
• 44% of the companies experienced “a significant, business altering data breach caused by a vendor”
• 15% of breached companies were notified by the vendor of the breach

These statistics are startling, highlighting the chasm between the BA risk management process and the reality of vendor incident response. The most disturbing findings came after the breach. Almost 70% of the breached companies made no change to their obviously faulty risk policies and procedures, with only half of them discontinuing the vendor relationship! The negative, business altering consequences include a combination of increased operational cost and complexity, disrupted operations, financial loss and reputational damage. Reason would move to making changes, but many don’t know where to start.

Evaluate Your Vendors

Companies need to take decisive steps with their business associates to protect their customers’ data. At a minimum, a “trust by verify” approach is required, while many companies are moving to a “zero trust” model. Some options include:

• Contractually obligate vendors to security and privacy practices
• Review your vendors’ security and privacy policies and procedures including their risk management plan
• Require security risk assessments be performed annually
• Conduct a joint risk management review focusing on data exchange and management, prior to enabling the BA access to your data
• Request historical review and references

Security should be a joint effort

It is essential to keep an inventory of all third-parties who can access and share your data, but that is not enough. This study found over two thirds of the companies were not confident that their vendors notify them when sharing data with other subcontractors. Properly vetting your BAs may increase the trust relationship, but additional steps should be taken.

• Coordinate responsibilities between both parties
• Require and review breach notification protocol
• Require insurance and other forms of indemnification
• Maintain regular communication of security expectations and execution

The need for vendors and BAs will always be present in our ever changing, collaborative world. Take the steps necessary to protect your company, your clients and your vendors.

Reference

Nearly half of firms suffer data breach at hands of vendors. Mark Sangster. 6 March 2019. https://www.esentire.com/blog/nearly-half-of-firms-suffer-data-breach-at-hands-of-vendors/

One of the biggest challenges in data and information security is knowing your threat level. IBM security recently released their 2018 X-Force Threat Intelligence Index. They monitor daily security events in 130 countries throughout the year for a comprehensive understanding of trends in cyber threats.

One of the most prominent ways organizations were found to be inadvertently open to attacks was due to improper configuration of cloud services. Misconfigured cloud servers accounted for 43% of more than 2.7 billion compromised records. This is an increase of 20% over recorded incidents in 2017.  According to the survey, “misconfiguration is now the single-biggest risk to cloud security, with 62% of surveyed IT and security professionals noting it as a problem”. While most of these breaches appear to be the result of inadvertent actions, it is possible for an insider to maliciously expose data and hide it as an accident.

No matter the style of attack, financial gain is almost always the motivation. Over the past few years, ransomware became a popular choice for cyber criminals. In 2018, however, we actually see a decrease in the use of ransomware by 45%. Why? Because cryptojacking is proving far more lucrative for criminals, thus increased in use by 450%! Without the need of any hardware of their own, a cyber criminal can install a cryptocurrency miner virtually undetected. Once installed, not only is the criminal gaining valuable coin at the owner’s expense, but they are also opening the door for other kinds of breaches.

The number of recorded vulnerabilities has exponentially increased in the last 3 years. This is due to the “ever-expanding attack surface as new players such as IoT devices, and other smart technologies enter the fray.” The attack surface references the span by which an organization has entry points for a cyber criminal to infiltrate. Finance and Insurance registered as the highest targeted industry, due to their access to Personal Identifiable Information (PII) links directly to bank account and credit card data that can be monetized quickly. Professional services, such as legal, CPAs and consulting, is the third most targeted industry with the second highest likelihood of a breach. Valuable customer data combined with limited security budgets and staff makes it “as vulnerable as it is lucrative”.

With all of this seemingly troubling news, you may be asking: what can we do to protect ourselves? As IBM states, we must “make security an integral part of culture and overall structure”. This is done by changing your threat landscape to reduce your risk of exposure. And that starts with knowing your risks. Our Cyber Quick Check is the first step to understanding your risk, and takes less than 5 minutes. Based on your Cyber score, discover the recommended next steps. With dedicated action and your part and the use of our automated cyber risk management system, CyberCompass™, we can increase your protection to 80% in only 90 days. The threats are real, but protection is available. Don’t wait in the dark any longer. Protect yourself and your business from threats today.