by Felicien | Dec 7, 2018 | Education
As a business owner, it’s up to you to make sure that the information and data collected by your company are secure and protected against the many different types of cyber threats lurking within the dark web. Many people believe it is the responsibility of their IT company to handle this type of situation. While that may be true to an extent, they can only do so much. It is up to the company’s management team to understand what threats are out there and take proactive measures to prevent their clients’ information from falling into the wrong hands.
Social Responsibility Starts With You!
As a company, you are responsible for your client’s information. If they provide it to you, it’s up to you to make sure it remains secure. Enlisting an IT company to create a strong, security network is ideal. If you don’t take matters into your own hands and include a few measures of your own, however, your system will still have gaps. Multi-factor authentication, firewalls, and intrusion detection systems are just the beginning. Your clients depend on you to give them quality products and services, not internet liability risks. It’s up to you to be socially responsible when it comes to maintaining security protocols and protecting the sensitive information that you use during your business.
Owning Your Risk
Hardening your own environment by implementing cybersecurity protocols over and above what your IT management offers is essential if you want to truly protect your client base. Owning your risk is more than just taking control of your internet security. It involves working with your IT company to create a multi-level security network. You can start by working within the NIST (National Institute of Standards and Technology) framework which includes features that:
Identify potential risks and issues
Protect against cyber attacks
Detect possible intruders
Respond to possible breach or risks
Recover after an attack
By using this framework and adding your own security measures, it will be more difficult outsiders to access your system and steal your client’s or company’s confidential information. The key is using the tools and resources provided by your IT company and then expanding your efforts to achieve a level of automated security that doesn’t rely solely on human interaction.
Competitive Advantage
Companies that take the initiative and work to harden their cybersecurity often gain a competitive advantage over those who are lax and at a higher risk of cyber attack. Small to mid-size businesses can’t afford the danger of being breached. The fact is that once a small business experiences a breach, the majority of them end up going out of business after just a few months. As a business owner, if you want to maintain that competitive edge, you need to be proactive regarding cybersecurity. It means working hand in hand with your IT company on a regular basis to ensure you are doing everything possible to protect all of the data your company uses.
Perform cybersecurity audits. Beef up your firewalls. When it comes to internal data and information like financial reports and a client’s confidential information, use multi-factor authentication. This limits who has access to the data within the company, preventing those who don’t need the information from accidentally (or intentionally) tapping into it. Your IT company can help you find the right protection features so that there is little risk of any type of breach.
Regarding social responsibility, it’s up to you to ensure your company’s information is protected. If you aren’t socially responsible, then you’re overall liability dramatically increases and your business can find itself in jeopardy if a breach occurs. As a business owner or member of a management team, It is your responsibility to hire the right IT company and to also ensure that you are doing your part. It’s your responsibility to maintain accountability for your company’s assets. Separately, risks can tear your business apart. When you work with your IT company, you are better able to manage your company’s information and dramatically reduce your risk of a cyber attack.
by Felicien | Dec 7, 2018 | Education
The Department of Homeland Security and the Federal Bureau of Investigation issued a critical alert Dec. 3, warning users about SamSam ransomware and providing details on what system vulnerabilities permit the pernicious product to be deployed.
According to the alert, which came from the DHS’s National Cybersecurity and Communications Integration Center (NCCIC) along with the FBI, the SamSam actors targeted multiple industries—some within critical infrastructure—with the ransomware, which also is known as MSIL/Samas. The attacks mostly affected victims within the United States, but there was also an international impact.
As pointed out in the alert, organizations are more at risk to be attacked by network-wide infections than individuals because they are typically in a position where they have no option but making ransom payments.
“Organizations that provide essential functions have a critical need to resume operations quickly and are more likely to pay larger ransoms,” the alert states.
That does not mean individual systems cannot or are not attacked, but they are targeted significantly less by this particular type of malware.
How do SamSam actors operate?
Through FBI analysis of victims’ access logs and victim-reporting over the past couple of years, the agencies have discovered that the SamSam actors exploit Windows servers and vulnerable JBoss applications. Hackers use Remote Desktop Protocol (RDP) to gain access to their victims’ networks through an approved access point and infect reachable hosts. From there, the cyber actors “escalate privileges for administrator rights, drop malware onto the server, and run an executable file, all without victims’ action or authorization,” the report states.
RDP ransomware campaigns are typically accomplished through stolen login credentials—sometimes purchased from darknet marketplaces—or brute force attacks. Since they do not rely on victims completing a specific action, detecting RDP intrusions is challenging, according to the alert.
Ransom notes instructing victims to establish contact through a Tor hidden service are left on encrypted computers by the SamSam attackers. Victims are assured that once they pay the ransom in Bitcoin, they will receive links to download cryptographic keys and tools for decrypting their network.
Where did SamSam originate?
The Department of Justice recently indicted two Iranian men who allegedly were behind the creation of SamSam and deployed the ransomware, causing approximately $30 million of damage and collecting about $6 million in ransom payments from victims. The crippling ransomware affected about 200 municipalities, hospital, universities and other targets during the past three years, according to an article from Wired.
Keith Jarvis, a senior security researcher at SecureWorks, reiterated the sophistication of the SamSam ransomware and how it gains access to systems through weak authentication or vulnerabilities in web applications, methods that don’t require the victim to engage in a particular action. Hackers also go out of their way to target specific victims whose critical operations rely on getting systems up and running as quickly as possible, making them more likely to simply pay up.
What technical details about SamSam are important?
In the joint DHS and FBI report, the federal agencies provided a list, though not exhaustive, of SamSam Malware Analysis Reports that outline four variants of the ransomware. Organizations or their IT services administrators can review the following reports:
MAR-10219351.r1.v2 – SamSam1
MAR-10166283.r1.v1 – SamSam2
MAR-10158513.r1.v1 – SamSam3
MAR-10164494.r1.v1 – SamSam4
What mitigation and prevents practices are best?
In general, organizations are encouraged to not pay ransoms, since there is no guarantee they will receive decryption keys from the criminals. However, relying on a contingency plan or waiting out an attack, as advised by the FBI, is difficult when an entire operation has been compromised.
The best course of action is for organizations to strengthen their security posture in a way that prevents or at least mitigates the worst impacts of ransomware attacks. The FBI and DHS provided several best practices for system owners, users and administrators to consider to protect their systems.
For instance, network administrators are encouraged to review their systems to detect those that use RDP remote communication and place any system with an open RDP port behind a firewall. Users can be required to use a virtual private network (VPN) to access the system. Other best practices, according to the report, include:
Applying two-factor authentication
Disabling file and printer sharing services when possible, or using Active Directory authentication or strong passwords for required services
Regularly applying software and system updates
Reviewing logs regularly to detect intrusion attempts.
Ensuring third parties follow internal policies on remote access
Disabling RDP on critical devices where possible
Regulating and limiting external-to-internal RDP connections
Restricting the ability of users to install and run the unwanted software application
This just scratches the surface of actions that administrators and users can take to protect their networks against SamSam or other cyber-attacks. The National Institute of Standards and Technology (NIST) provides more thorough recommendations in its Guide to Malware Incident Prevention and Handling for Desktops and Laptops, or Special Publication 800-83.
Information technology specialists can also provide insight and advice for how organizations can detect gaps or vulnerabilities in their cyber-security that leave them susceptible to SamSam or other malware infections.
by Felicien | Dec 7, 2018 | Education
If you own or run a healthcare organization, you probably have someone on staff who acts as your security compliance officer. However, is it their primary job or area of expertise? Having a knowledgeable and experienced security compliance officer or resource is very important since the consequences of violating privacy regulations can be quite serious.
For example, did you know that federal regulators can fine an organization up to $50,000 per HIPAA violation and as much as $1.5 million per year in fines for releasing a patient’s protected health information (PHI)?
That’s why you need to know what a security compliance officer does and if it makes sense for you to work with an external company to help your organization comply with security regulations to avoid hefty fines.
What are a security compliance officer’s responsibilities?
According to the American Health Information Management Association (AHIMA), a healthcare security compliance officer oversees activities for developing, implementing, maintaining, and following an organization’s privacy policies and procedures. This is to ensure a patient’s PHI is kept secure and you’re complying with federal and state privacy laws.
Some of the compliance officer’s responsibilities include:
Understanding government privacy regulations, especially HIPAA rules, to make sure your organization is complying with them.
Assessing your organization’s risks and what steps are necessary to prevent and minimize exposure of your patients’ PHI.
Creating, testing, and reviewing an organization’s information security systems to protect PHI.
Setting up a security awareness program to meet HIPAA reporting requirements.
Overseeing a reporting and management system to record and investigate a data breach, and prevent future violations.
Maintaining a budget to fund information security management programs and processes.
Managing a training program for employees to help prevent a privacy breach.
Who should be your security compliance officer?
Since this is such an essential role in your organization, it’s critical to have the right person for this job. It shouldn’t be just a part-time or extra job for one of your employees, such as an office manager or human resources director. As mentioned, the consequences of a data breach can be very serious and expensive.
While having IT experience can be helpful, this position also includes auditing, training, handling an incident, and managing business associate agreements with external partners and vendors. Other responsibilities may consist of making and updating a disaster recovery plan and overseeing facility security.
An ideal candidate is someone with the ability to organize, understands HIPAA and other privacy rules, and is knowledgeable about IT and computer systems.
In addition to picking the right person for the job with the relevant experience, the position should have the authority and power to implement needed changes to ensure compliance with HIPAA and privacy rules.
What if you use a cloud-based IT service?
You might assume if you use a cloud-based service for your IT systems, then you don’t need to worry about HIPAA compliance. However, an organization must ensure such services are secure and perform a risk analysis before using a cloud service for storing or transmitting electronic protected health information (ePHI).
In 2015, St. Elizabeth’s Medical Center in Brighton, MA had to pay $218,400 in penalties for violating the HIPAA Security Rule when they uploaded data without doing a risk analysis of the cloud service. An organization needs to set up risk management policies to lower the chances of a data breach as much as possible, even if they use a cloud-based service.
If you manage a healthcare organization, a cloud service provider is considered as a “HIPAA business associate.” This means they must sign a business associate agreement (BAA) before patient data is uploaded to the cloud service. You must have a signed BAA even if the information you upload is encrypted and the cloud service doesn’t have a decryption key.
What can happen if you don’t have a signed BAA from a cloud-based service provider? In one case, Oregon Health & Science University was fined $2.7 million by the Department of Health and Human Services’ Office for Civil Rights because they didn’t get a signed BAA from a cloud-based IT vendor.
The business associate agreement should outline how ePHI is used and disclosed and that both parties have security procedures to prevent the unauthorized release of PHI. This includes verifying that the cloud service vendor:
Has reliable systems so information is readily available to a healthcare organization.
Maintains a back-up and data recovery system in case of a natural disaster, ransomware attack, or other emergencies.
Allows you to obtain data from their systems if you stop using their cloud services.
Keeps information as secure as possible.
Limits the use, retention and disclosure of PHI.
Should you work with a consultant or IT provider?
In some cases, you may decide that you need to work with an IT professional or consultant to assess your IT systems and infrastructure for potential weaknesses that can lead to a privacy breach.
Also, it may not be ideal for your internal staff to perform a risk assessment since it can be a challenge to objectively evaluate their practices and identify weaknesses. If you decide to contract with a third party for a risk assessment, make sure they’re experienced and knowledgeable about HIPAA and privacy rules.
Another option is using compliance software that’s customized for your organization’s needs and structure to help perform a risk assessment, train employees, and handle other functions.
by Felicien | Dec 7, 2018 | Education
December 7th, 2018, is National Pearl Harbor Remembrance Day. It marks the 78th year since the tremendous military disaster that brought America into World War II. It’s a time for somber reflection and to honor those who made the ultimate sacrifice in that tragedy, those who survived to go on to fight another day in that conflict, and the few who are still living. Millions of Americans will mark the day by displaying the American flag, attending tributes and memorial services and school and public educational presentations, by visiting with survivors at reunions, and in more personal ways.
History Of Pearl Harbor Remembrance Day
On the 23rd of August, 1994, the U.S. Congress officially designated December 7th as National Pearl Harbor Remembrance Day. In November of the same year, President Bill Clinton issued a proclamation declaring 1994 to be the first year of recognition, and it was subsequently observed the following month. It is not a Federal holiday so government offices and schools, as well as other businesses and organizations, remain open.
A Day That Will Live In Infamy
At approximately 7:48 AM on Sunday morning, December 7th, 1941, 353 Japanese aircraft, including fighters, dive bombers, and torpedo bombers, launched an attack on the U.S. naval base at Pearl Harbor, Hawaii, as well as U.S. Army Air Corps wings based at nearby Hickam and Wheeler airfields. The attack caught American forces by complete surprise. There had been no formal declaration of war or any type of warning by the Japanese.
The effect was devastating. 2,405 American sailors, soldiers, and civilians were killed and another 1,178 others were wounded. Almost 20 U.S. Navy warships, including eight battleships, were destroyed or severely damaged, as well as 188 aircraft.
The next day, President Franklin D. Roosevelt declared war on Japan, delivering his famous speech to Congress saying that the attack was “a date which will live in infamy.” Americans entered World War II with the popular slogan ‘Remember Pearl Harbor’ as their battle cry.
How To Observe Pearl Harbor Remembrance Day
American are encouraged to show their observance of the day by displaying the United States flag outside of their homes, and at half-mast, if displayed on a pole, until sunset on December 7th. Many also plant flags on the graves of veterans and attend reunions and other events associated with the day.
by Felicien | Dec 6, 2018 | Education
In this article, we’ll be going over the top seven ways to protect yourself and your business from email phishing attempts. But first, what is phishing?
Phishing Defined
Although it may sound like a recreational sport, phishing is not a virtuous practice. It is, instead, the deceitful and illegal practice of trying to obtain personal information by way of fraudulent emails.
Most of the time, phishing emails purporting to be from a legitimate business, like a store, bank, or online service. Frequently, these are establishments where you actually hold an account, so receiving them, at first, may seem reasonable. It’s when you look at the details of such emails that things become troublesome.
The goal of phishing emails is to appear legitimate while luring personal information, like the following, out of you:
Login information (usernames and/or passwords)
Social security number
Credit card or financial information
Date of birth
And other (usually financially related) information
If you end up giving the fraudsters this data, their ultimate goal is to use it to hack into your life in some way — often by getting access to your bank accounts, credit cards, and more.
If you’re concerned about phishing, here are seven tips for catching fraudulent emails and staying away from phishing attempts altogether.
1. Don’t send personal information.
Be on the lookout for emails that ask for your personal information. Whether you hold an account with the purported sender or not, nearly all establishments avoid asking for personal information by email.
Therefore, if you get an email like this, it’s likely a scam. This is especially true if the email specifies that the issue is urgent and if you don’t send the information right away, your account will be cancelled or other repercussions will ensue.
2. Try hovering over links and/or buttons.
If you receive an email where there is a web address or link, there’s a way to check if the address is legitimate or not. To do this, hover your mouse over the link (or button). A small box should appear showing the website. If this website is legitimate, it will be the actual establishment’s website. If it looks unusually long or has a different name, do not click the link.
3. Always type web addresses in directly.
As a rule, never use links directly from emails. If you receive an email from your bank stating that you need to update personal information, this may worry you. So, to double check, type your bank’s actual website into the search bar and see if they still ask you for this information when you login from there.
4. Only use secure websites.
There are ways to check that a website is secure. You’ll know when these two key features are present:
– “https” will be present at the start of the web address
– There will be a security lock icon (usually to the left of the web address)
5. Double check the security certificate by double-clicking the security lock icon.
By double-clicking the lock icon, you’ll be able to see the security certificate for the website. If, when you click the lock, you receive a warning message or there is no certificate available, stay away from that website.
6. Avoid using public WiFi.
At all costs, avoid using public WiFi — especially when banking, shopping, and entering personal information. It’s always better to use your phone’s cell phone connection.
7. Watch for “personalization” … with one caveat.
It’s always a better sign if emails use your actual name instead of “user” or “sir or madame,” but also keep in mind that even phishing emails can be crafty enough to know your actual name. In the end, if you receive an email addressed to your name, that’s not enough to signify that the email is legitimate. Look for other factors too.
Remember to always … be cautious and suspicious!
