The scary thing about a cyber breach, is according to reports (Fire Eye Report), 97% of all networks have been breached. Think about that for a moment and realize that there is a good chance that your organizations network has been breached at some point. Now whether that breach was successful at gaining sensitive data, like ePHI, or not it is hard to tell. Which in its self is even more concerning than the fact that you had been breached. You just don’t know and that is bad!

You want to know what is truly scary! If you go by some of the recent headlines with the likes of Anthem, Premera, and Advantage Dental, the hackers had 90+ days to find and take what they wanted after they breached networks. Think about that for a minute. Not only were these big organizations, with big budgets, breached, but the attackers were able to probe around the networks for over 90+ days to find what they were looking for and take it without being noticed! The attackers need that time to not only find what they are looking for, but then find a way to take it. Which tells you it could have been  stopped.

The breach is only the beginning, it takes time to steal the ePHI.

Anatomy of Cyber Attack

This is why doing an annual Risk Assessment by itself is only part of the solution. Having tools that are able to continually keep you compliant and discover evidence of a breach or malware that could lead to one. What is even more important is to not put more load on your IT department. Many of the tools that we looked at, that had a chance to mitigate these attacks, were good at giving you all the information. The problem is they gave you ALL the information and you had to sift through the hay to find the needle. When we decided to partner with Signacert for our Third Rock Assurance™ solution, it was in part due to the fact that they removed all that noise and presented us with the issues that needed to be fixed. In all of these major breaches, our solution would likely have found the problems almost immediately, reducing the risk and impact. There would have been no attacker on the network searching for 90+ days.

I will leave you with this. With all of these huge breaches in healthcare recently, including the latest UCLA breach. There is a very good chance many of you reading this post will have been effected in one way or the other.