Focus on Security Archives - Third Rock

Travel Cyber Safe

Cathy Diehl — Tue, 26 Nov 2019 15:21:23 +0000

The holidays get busy. Traveling is stressful and we aren’t always as vigilant as we should be. In today’s world of data breaches, identity theft and cybercrime, there are many things we know to be cautious about. You wouldn’t give away your credit card number or let a stranger have access to your driver’s license. But are cyber safe with your phone? We have become so dependent on our phones to store sensitive and private data. Sometimes forget that we need to protect it too.

Let’s take a look at a scenario that could happen to any of us:

The morning was a rush and you made it to the airport on time, thankfully. After getting through security, there is a little time to breath. You grab some coffee, check your phone and realize you forgot to charge it. Ugh. Your phone needs to be charged to last the whole flight and still have juice when you land. You notice a charging station near your gate. There are even cords already plugged in, so you don’t have to dig yours out of your mess of a bag. Score!

You may not be as lucky as you feel. Cyber criminals are taking advantage of how dependent we are on our devices and their need to be charged. This new scam, known as “juice jacking” takes advantage of your connection to your phone.

How does it work?

Phone cords are designed for 2-way communication. Data can come in, but data also goes out. This can be seen every time you attach an iPhone to your computer and iTunes wants to download your data. Convenient when you want it, but bad when the criminals want it. Criminals download malware into the charging station or physically alter the charging station installing a cable connected to a virus laden device, and wait until you connect. They then have access to everything on your phone. What do you keep saved?

Passwords?
Credit card information?
Communications?
Photos?

Depending on the malware, they could download your data or install malware on your phone that will continue to monitor your usage. They might even lock you out of your phone completely. The biggest concern; you may never know. A week later you’re seeing fraudulent charges on an account and trying to figure out what happened. This is very similar to the card skimmers installed at gas stations.

What can you do?

Thankfully there are easy ways to avoid this scam.

Use your own AC adapter and cord
Plug into a wall outlet, not a charging station
Use a “charge only” cord at a charging station
Use personal car chargers
Use a portable charger

Be cyber safe this holiday season

Physical security is important and easy to remember. We see our wallet; we protect our wallet. This holiday season, let’s also remember our cyber safety.

The post Travel Cyber Safe appeared first on Third Rock.

IT Responsibly: Defend your Territory

Ed Jones, PMP, CHSP — Fri, 18 Oct 2019 14:00:28 +0000

In the days of old, people built giant walls to defend their land. It was easy to see the invading army approach. Pull up the drawbridge, light the arrows and defend your city. Today, the walls are digital and the invaders are invisible and often robots; sneaking in the back door or under the radar, pretending to be someone we trust or attacking out of nowhere. So how do we defend our territory in a modern technology age?

Ditch the passwords

Passwords are the first line of defense in protecting your private information. The problem with passwords though is that if you make them strong, they can be hard to remember. And if you follow the sound advice to not use the same password on any site, you may think you have to remember 30 plus long, hard to remember passwords! To this I give you 2 suggestions:

Get a password manager – Don’t trust Google to save your passwords. (see previous blog) A password manager is a vault to place all those hard to remember passwords in a secure location. Read Consumer Advocate’s top ten choices in their article here
Use passphrases – Instead of hard to remember letter, number and character combinations, use a full phrase as your password. Pick something you can remember and add modifications to in order to have a unique phrase for different sites. For example, “BobandSusan’sbankaccount!”

Multi-factor Authentication

Requiring 2 forms of verification is becoming a popular and simple way to secure data. Here’s an example one of my money accounts uses. I’m asked for the email, username, or phone number associated with my account. Once entered, I am then asked for a code that will be emailed or texted. This is very easy for me as a user. I don’t have another password to remember, the messages come through quickly and I can access my account. While it’s easy for me, it’s harder for a hacker. Someone would have to be able to access my phone or email to be able to access the original account.

Recognize Imposters

A popular way for hackers to gain access to your data is called spoofing. They send an email from what appears to be a legitimate company claiming something to try and get you to give over your information. Your account has been compromised: type in your password. You’ve won a gift card: type in your password. You have been locked out: type in your password. We’ve seen suspicious activity: type in your password. You get the idea. Hackers use the logo of a trusted company to put you at ease, but when you click on the link it sends you to a spam site that is gathering your data, not resolving an issue. Here are things to look for:

Is this normal behavior for the company in question? If not, don’t trust the link.
Check the email address against valid emails you have received from the company
Look at the link. If you click to a sign in page, check the website address. If you aren’t on the company’s main sign in page, do not put in any information.
When in doubt, go to your account. If you want to check activity, type in the website address you know and sign in that way. Most companies will post the notifications inside your account so you can verify.

The post IT Responsibly: Defend your Territory appeared first on Third Rock.

IT Responsibly: Check your settings

Ed Jones, PMP, CHSP — Fri, 11 Oct 2019 13:41:58 +0000

Have you recently purchased a new device? Smart phone, laptop, tablet or even a smart watch? Maybe you just downloaded the latest update to your computer or smart phone. Do you know what it did? Too many times we take for granted the base features technology and updates provide without checking that the privacy settings. Always check the settings represent what is best for you, not what is best for the company.

Location, Location, Location

Location services are very helpful. Let’s face it, who pulls out a paper map anymore when your navigation can tell you exactly how to get somewhere? However, your location does not need to be tracked at all times, so you should check the settings on all of your devices. Most apps have the option to only track while in use. When in doubt, it’s better to turn off location tracking until you find you need it. Phones are not the only devices that track location. Be sure to check settings on your laptop, tablets and smart watches.

“Checking in” on social media? Publicly announcing your location on a social media platform could potentially be dangerous. You are letting would be thieves and criminals know you are away from home, or informing an unwanted person how to find you.

Just Click “No”

Having your passwords saved is extremely convenient, especially if you follow the rule to have different passwords for every site. Google/Chrome wants to automatically save all of these passwords for you which seems very nice of them. The issue is this is not actually secure, especially if you use public WiFi. A hacker could easily write a script to steal the saved data on your computer.

Do you do a lot of online shopping? When your browser asks to save your credit card information, be sure to choose “never”. If a hacker can get your passwords, they can also steal your credit card information.

Public WiFi

Do you deal with sensitive data for work, bank online or simply enjoy online shopping? Accessing private accounts with private data on public WiFi puts you at extreme risk. It only takes one person with the know-how and malicious intent on the same WiFi to remotely access the information on your computer. Save sensitive work for private networks.

If you are a business owner, be sure to have separate WiFi networks for guests, non-sensitive data and sensitive data. Limit access to the network for sensitive data to those who need access.

PRO TIP: Consider using one computer to “surf” the web and one computer to ONLY access sensitive data web sites such as banking, financial services, stock trading, healthcare and insurance.

The post IT Responsibly: Check your settings appeared first on Third Rock.

BYOD – Do You Know What’s on Your Network?

Mike Moran — Sun, 20 May 2018 19:18:45 +0000

Is your company allowing employees to bring their own devices and use them to log onto the corporate network? If so, do you know what is happening on your network as well as how many devices are on your network?

Recently, I ran a network discovery at a company and found some interesting things. First, I ran the discovery during the “off hours,” meaning there should have been no one in the facility and only the automation and security systems operating. Instead, the scan showed 70 computers, instruments, and printers running on the network.

Next, I ran the same scan during business hours ― full production and full staff – resulting in 120 devices being found on the network. What were the additional devices? Some of the devices were corporate workstations which get turned off overnight, and the remainder of the ‘new’ devices were personal cell phones.

Now, depending on how your networks are configured, that might not be a problem. In a properly segmented network, company-owned devices would have their own segment, and employees’ personal cell phones, laptops, and tablets would be on one or more additional segments. In this case, however, the staff members’ devices were also on the production network, introducing significant risk for the organization. Phones are susceptible to all the same types of malware and viruses as computers. Yet, phones and tablets are much less likely to be running anti-anything (e.g., anti-virus, -malware, or -spyware).

Additionally, a lot of cell phones support tethering, which would allow the user to exfiltrate data via the cell phone to another computer, server, or cloud repository without the company being able to detect it. This would be done by connecting the device to the internal network and then tethering the device to the external network. Once connected, data can flow both directions, e.g.: Good data (company confidential data) going out and Bad data (viruses, malware, spyware) coming in. Or worse yet, someone else could establish a presence, which would allow them to attack other companies while disguised as your company or establish a server from which they transmit spam and porn from your network.

The lesson to learn is that things are never as easy or as secure as you think they are. Be diligent about policies, processes, and knowing what should be flowing where on your network.

If you have concerns about your cyber security and would like to improve your cyber confidence and compliance, please contact us at: info@thirdrock.com

Building a Cyber Confident℠ World

The post BYOD – Do You Know What’s on Your Network? appeared first on Third Rock.

MACRA 2017 deadlines are coming. Do you have a Security Risk Assessment scheduled before December 31st?

Julie Rennecker, PhD, BSN — Thu, 02 Nov 2017 14:00:41 +0000

Right now the healthcare industry is in the final race to complete the requirements for MACRA, the new reimbursement scheme for Medicare. Thousands of dollars are at risk – failing to satisfy the MACRA requirements in 2017 will result in payment reductions for all of 2019!

Submerged within the 2,398 pages of MACRA lies a key requirement for eligibility – completing a security risk assessment (SRA). The SRA is a “core requirement.” Without an SRA, a healthcare practice can undo all their other efforts to achieve the high score needed to get full Medicare reimbursements and bonuses. In fact, without an SRA, a practice is likely to face payment penalties in 2019.

Be aware of two misunderstandings that give healthcare practices a false sense of security in meeting the annual requirement for a Security Risk Assessment:

“My EHR is HIPAA-compliant, so I don’t need to do an SRA.”

Simply installing a certified electronic health record (EHR) does not fulfill the Meaningful Use or MACRA requirement for a security risk analysis. Even with a certified EHR, you must perform a full security risk analysis to ensure that you are properly safeguarding all the protected health information (PHI) you maintain, whether in paper or electronic form.

“My IT service takes care of all that security stuff.”

Don’t assume your IT service provider is taking care of security. IT companies typically believe they are only responsible for installing a firewall and anti-virus application and keeping your computers running. They assume the Practice Manager is handling all other aspects of system security, including policies and procedures, staff training, password maintenance, mobile device management, and facility security.

The Security Risk Assessment isn’t just busy-work. Completing an SRA and fixing any identified gaps will increase your cybersecurity and complete a critical HIPAA requirement, saving you thousands in penalties and fines as well as protection from a breach.

Doing an SRA should be an important year-end “To do.” It will give you peace of mind, letting you go into the New Year feeling more protected and positioned to increase your revenue. Don’t miss out!

If you have any questions about performing a Security Risk Assessment,

please contact us at: compliance@thirdrock.com.

Protect Your Patients. Protect Your Practice. Protect Yourself.™

The post MACRA 2017 deadlines are coming. Do you have a Security Risk Assessment scheduled before December 31st? appeared first on Third Rock.

The Most Common Mistakes in Cybersecurity are Preventable

Clint Eschberger — Thu, 12 Oct 2017 14:00:59 +0000

Many of the issues we see in cybersecurity, whether you are in healthcare, retail, finance, etc., are by and large preventable. It is not about having a big budget or a large team of experts. No, some of it is just common sense. It is not unlike driving a car. When driving a car you take several basic, yet important, steps to try and lower your risk of an accident. You look both ways at a stop sign, you drive safely to avoid losing control, you keep your car in working condition, and just in case you are in an accident, you’re protected by your auto insurance.

Nothing really difficult. Does it mean you will never have an accident? Of course not, but you significantly lower your risk.

When trying to protect your organization’s information, some of the worst – and most common – information security errors are also the ones that are the most preventable. Let’s take a look…

Vigilance is often the first step. What do I mean, by vigilance? It is simply not taking security for granted. Far too often I hear, “The chances something will happen to us are so small.” That always sounds good, until something happens.

Antivirus is something that is surprisingly overlooked. It is not always that organizations forget to install it, it is that they forget to keep it updated and the license renewed. If your Antivirus is outdated, for any reason, it is almost as bad as having no protection.

Email security is often overlooked, even though it is one of the easiest targets for hackers and cyber-thieves. Whether it is due to lack of end-user training or lack of security in place, it is a huge target for hackers. First and foremost your email users should be trained on proper email safety, such as how to avoid phishing messages.

Firewalls these days are often the first line of defense and for smaller shops they are often setup by the internet service provider. The bad thing about that is the provider often leaves the default username and password in place which allows hackers to easily gain access to the firewall and let themselves in the door without knocking. This is generally a very easy change that takes only a few minutes to correct.

Speaking of passwords! I hate to break it to you, “1234” or “password” is a really, really poor password.

Finally, one of the most common mistakes in cybersecurity is…

Backups! I know some are saying, “What do backups have to do with cybersecurity?”

EVERYTHING!

Not unlike having insurance for your car, it is only important when you need it the most. Backups are your insurance for bad things happening, whether it is a cybersecurity issue, an accidental file deletion, or a disaster. Having backups that are stored securely offsite are one of the most important steps to protect your business. There are many options to fit all budgets and organizations.

The biggest thing from all of this is to simply not overlook cybersecurity. I know it is easy to say, “It won’t happen to me.” but the odds are it will.

So, buckle up!

In recognition of October being National Cybersecurity Awareness Month, Third Rock is offering a FREE mini-Risk Assessment to promote the role cybersecurity plays in protecting your patients, your practice and yourself. In addition, we welcome you to visit our HIPAA and Cybersecurity Resources page. Do you have a cybersecurity question you’d like answered? Email us at info@thirdrock.com or give us a call at 512.310.0020. We’d be more than happy to help!

Protect Your Patients. Protect Your Practice. Protect Yourself.™

The post The Most Common Mistakes in Cybersecurity are Preventable appeared first on Third Rock.

Don’t Click the Download Button!

Robert Felps — Thu, 05 Oct 2017 15:18:56 +0000

I thought about naming this blog “Would the Real Download Link Expose Yourself.” But, a few people said that wasn’t a great title. Go figure!

I’m sure you’ve visited a website to download something, maybe an image or install software or maybe some template to design a cool new flyer. You’ve probably also clicked on a large green or teal or blue or some other lovely color button that said, “Download”, only to find out it was an ad to some trash item you’re not interested in nor do you want. It’s an irritation and waste of time. So, you return to your previous page or site and hunt for the real download link, which is often just the words “Download Here” linked to your download object.

What you may not realize is, these fake download buttons may be taking you to a site to infect your computer with a virus or malware or ransomware. You think you just visited some jerk that wants to sell you some trash. In reality, that’s the least of your worries. It may be a site operated by cyber criminals trying to steal data from your computer or hijack your computer for their use. From now on, double check that the Download link or button is the correct download link you want.

Here are some tips to help you identify the fake ones vs. the real ones.

Add a trustworthy ad blocker to your web browser. uBlock Origin is a good one we use.
Learn to look at the “Download Button” and see if it has a the little ad play button (right arrow) in it or around it.
Put your mouse over the button and look at the URL it displays in the bottom left of your screen, if it’s not the local URL domain (of the current web site), something is probably not right, so don’t click.
Better safe than sorry, only visit reputable sites to purchase goods online and download items.

Remember, be careful!

Join our free monthly newsletter to stay up-to-date on HIPAA and cybersecurity.

Take our confidential free mini-Risk Assessment.

Protect Your Patients. Protect Your Practice. Protect Yourself.™

The post Don’t Click the Download Button! appeared first on Third Rock.

It is Time for Us to Take Control of Our Data!

Ed Jones, PMP, CHSP — Thu, 28 Sep 2017 16:38:47 +0000

The EquiFax breach really has me angry. Mostly because I have no control over any aspect of this mess. EquiFax scoops up data on all of us without our consent. They seem unaccountable and untouchable. With a last name like mine, I’ve had many opportunities to dispute incorrect data on my credit reports, which is always time consuming and irritating. They make it known how unimportant you are and assume you are “guilty” unless you prove otherwise. They collect data on all the people in the U.S. old enough to make purchases using credit, and they don’t even bother to encrypt it! Worse yet they didn’t even bother to patch their systems after they had several breaches earlier this year! Talk about arrogant!

Is EquiFax just one bad apple? Sadly, they are not. Historically, industries with self-certification of compliance to data protection regulations have woefully low compliance. Government surveys say the healthcare industry is about 15 percent compliant! With respect to the credit card industry, they are better than the healthcare industry by a whopping 5 percent! Eighty percent of businesses fall short. The insurance and financial industries currently have NO regulations to protect your data! The “good news” is regulations are being drafted and are being implemented starting with New York state.

I hope EquiFax is a tipping point for the consumers in our country! It’s time we take control of our data and demand it is properly protected. Nothing seems safe when each morning news declares there is another data breach and the North Koreans launched another missile! It is alarming and discouraging. But I shouldn’t have to give away my hard-earned credit score to buy that shiny new toy for my man cave (I wish!) for a low price on the Internet. I shouldn’t have to worry that my most confidential data is in jeopardy because I had my annual physical! Should I buy that insurance policy to protect my family, or will the data I provide on the application fall into the hands of cybercriminals and cause significant damage to my family?

Going forward, I will do my homework when purchasing online by selecting reputable companies and not chasing the lowest price. I will ask my doctor when was the last time his practice did a security risk assessment and all staff had cyber security training? Does their medical system encrypt the data at all points (most don’t)? I will look at my financial and insurance companies with a skeptical eye and make informed decisions. I will also add my voice to the Equifax failure to better protect my children and their future.

I encourage you to take our confidential free mini-Risk Assessment to see how compliant your organization is. Should you discover you aren’t as compliant as you had hoped, contact us at compliance@thirdrock.com. We’d be happy to help you improve your score and protect your patients, your practice, and yourself!

The post It is Time for Us to Take Control of Our Data! appeared first on Third Rock.

PHISHING ALERT – DocuSign – Don’t click!

Julie Rennecker, PhD, BSN — Fri, 22 Sep 2017 19:40:42 +0000

Heads up, everyone – our team has gotten phishing emails like this one posing as messages from DocuSign.

DON’T CLICK unless (a) the message is from someone you know and (b) is a message and document you were expecting.

If you receive too many documents via DocuSign to remember if you were expecting the message/document or not, take these precautions:

· Hover your mouse over the Download link.

· Carefully read the url that appears.

· If the url is not for DocuSign, delete the email immediately.

· Then ask your IT provider to ensure the web filter, firewall, and anti-virus are all up-to-date.

DocuSign is a legitimate business that provides a valuable service to the business community. This is not their fault – these messages are a hoax.

Join our free monthly newsletter to stay up-to-date on HIPAA and cybersecurity.

Protect Your Patients. Protect your Practice. Protect Yourself. ™

The post PHISHING ALERT – DocuSign – Don’t click! appeared first on Third Rock.

Focus on Security: In plain sight

Clint Eschberger — Thu, 27 Jul 2017 14:00:58 +0000

Sometimes we tend to focus strictly on the technical side of security and compliance and fail to notice the very important issues hiding in plain sight. While a hacker breaking into your network and stealing ePHI is the threat that is being talked about the most, it is sometimes the overlooked old-fashioned threats that present the greater risk.

Think about how many times a patient record has been sitting somewhere and how long does it actually take for someone to pick it up and walk off? What about allowing easy access to documents or equipment that contain sensitive data? Over the years we have seen clients forget some of the simple things that they could do to protect patient information.

Below is a simple walk-through checklist that you can use to recognize and fix security issues that may be hiding in plain sight…

Have any documents been left on the counter face up when not in use?
Have patient documents been left on a surface that is accessible to patients, visitors, vendors, etc.?
Have paper charts been left unattended where someone could grab them while walking down a hall?
Are all discarded documents containing PHI shredded or placed in a locked container to await shredding?
Have security cameras been installed to track unauthorized access to anywhere patient data could be found?
When calling a patient from the waiting room, do staff use only the patient’s name, and preferably only a first name?
Have staff logged out of all unattended computers, especially those in exam rooms and publicly-accessible hallways?
Do you and your staff lock unattended rooms that could provide access to the network or computer equipment?
Is the back door (or other secondary entrance) ever left open or unlocked for any reason?
Do you and your staff lock offices when unattended?

Sometimes, just by walking through on a weekly basis you can find simple issues that need to be addressed. We recommend doing this during business hours as you want to see what your visitors see. Not only will this help you be more vigilant in your security, but it will allow visitors to rest easier seeing that you are actively taking steps to protect them and their health information.

Protect Your Patients. Protect Your Practice. Protect Yourself.™

info@thirdrock.com | 512.310.0020

The post Focus on Security: In plain sight appeared first on Third Rock.