by Felicien | Jun 1, 2018 | Education
Your dental practice has much more to do than worry about computer and IT problems. Your staff is busy serving your patients. But if you’re like others, you’re overrun with spam. Even malicious programs like ransomware can be delivered right into an employee’s inbox. Without proper training, employees often open these emails and download malware. This can threaten your patients’ private health data.
Since all our devices are now connected to the internet via networks, it’s very important that your computers and networks have the highest protection. Any attack on your system or database can cause more than just computer problems—your data can be hacked and sold on the Dark Web. This is not only stressful, but it can affect your good reputation.
We regularly get calls from dentists who are concerned that their network might be infected with malware or computer viruses. And, we’ve seen cases where the dentist office paid the ransom to get their files returned, but the criminals came back asking for more money. Some of these malicious files can hide in the background and still be working behind the scenes to compromise your database.
Unless your IT provider knows how to secure your network from cyber criminals and beat them at their own game, you could fall victim to them as well.
We’ve seen a sharp increase in the number of dental practices involved in these attacks. So, we’ve written this Guide to arm you with pertinent facts about cyber theft. Here’s what you can do to protect your IT systems.
What’s Hiding In Your Computers?
What You Need To Know About Spyware, Malware & Hackers
Today’s cybercriminals know how to create malware and viruses that are hard to find and difficult to eradicate. They are also adept at finding vulnerabilities in computer networks where they can enter and secretly infect systems. Thieves may have already infiltrated your practice’s network without you even knowing they’re there.
Spyware
Spyware secretly monitors your computing actions. It exploits user behavior and application vulnerabilities. It gives a hacker sensitive information that you want to keep private.
Spyware refers to hidden programs hackers install on your computers without your permission. They infect your system to spy on your computing actions, gather information, and send this information back to their home base.
In some instances, spyware steals identities, passwords, contact files, and more. It can also take over your computers and use them for illegal activities. Plus, all this will alter your web browsers and slow down your computers.
Spyware is often attached to free online software downloads or to counterfeit links clicked on by users. It infects computers when someone downloads things like free applications, music, emoticons, and screensavers. It piggybacks onto the download and runs undetected in the background where it collects data about you, your practice, your patients, and more until it’s removed.
Your employees may believe these files are legitimate when they aren’t. Just one innocent worker can accidentally infect your entire network with spyware.
Malware
Malware is short for malicious software. Malware comes in the form of worms, viruses, trojans, spyware, adware, and rootkits. It steals protected data, deletes documents, or adds software that you haven’t approved. Unlike spyware, malware can replicate itself from one computer to the next. It does this via a network connection, or even via your email accounts without you knowing it.
A malware infection can corrupt your files, alter or delete data, distribute confidential information such as bank accounts, credit card numbers, and other personal data. Plus, it can disable hardware, prevent you and your employees from using your computers, and cause your entire network to crash.
Malware is difficult to eliminate – it fights back when you try to clean it from your system. In some instances, you must completely wipe all the information from your computers and hard drives to eradicate it. This requires a complete re-install of your operating system and applications. Unless you have an enterprise-based cloud backup along with a reliable onsite backup solution, malware could cause you to lose all of your patient and other important data.
Hackers
Hackers are criminal computer programmers. They try to gain unauthorized access to your computers or a network. Hackers may try to alter your system or security features from their original purpose.
Hackers design spyware and malware programs that attack your computers. They may have a criminal intent to steal money from you, hold a grudge against your business, or simply do this for fun.
Today’s hackers are intelligent and use sophisticated exploits to gain unauthorized access to computer systems and networks.
Some of the techniques hackers use include:
Vulnerability scanning that looks for unknown weaknesses in your system.
Password cracking where they retrieve passwords from data you’ve stored or have transmitted.
Packet sniffing using applications that capture data packets to view data and passwords in transit.
Spoofing attacks that mimic legitimate websites to trick your employees into visiting them.
Rootkits that work to gain control over your operating system.
Trojan horses that open a backdoor into your IT system so they can gain access to it.
Self-Replicating Viruses that insert copies of themselves into executable codes, files, or documents.
Key Logging Tools that record every keystroke on the infected computer.
11 Signs That Your Computer Is Infected
Since many malicious programs hiding in your computing environment, it’s not easy to find them. One way to tell if you’ve been infected is:
When you’re swamped with pop-up advertisements that interrupt your work.
Your computer is slow, locks up, or crashes frequently.
The home page on your web browser changes on its own, and you can’t change the settings.
You see toolbars on your web browser that you didn’t put there.
You get a second or third web browser popping up behind the main browser that you didn’t approve.
Strange files suddenly appear.
Your CD drawer opens or closes by itself.
You constantly get errors in MS Outlook/Outlook Express.
You notice emails in your “Sent Items” folder that you didn’t send.
Some of your files are moved or deleted.
The icons on your desktop or toolbars are missing or blank.
4 Misconceptions About Computer Threats
“I Can Remove Spyware And Malware On My Own”
Many of these programs can’t even be detected, much less removed. They incorporate themselves so deeply into your operating system that it takes a senior-level technician to detect, locate, and remove them. In extreme cases, even the best technician won’t succeed and will have to completely wipe your system clean to remove them.
“We Didn’t Cause The Infection”
Malware, spyware, and viruses infect your computers or network when you or one of your employees let them in. Common activities like downloading infected files or applications or visiting counterfeit websites with malicious viruses allow infections to occur. Emoticons (smiley faces and action characters that you see at the bottom of many people’s emails) can also come attached to viruses. Hackers are clever and are always looking for ways to trick you into downloading viruses. Plus, unless you have the most up-to-date security patches and virus definitions installed on your computer, hackers can gain access if you or an employee click on a malicious link.
“We Don’t Need Ongoing Computer Maintenance”
This is the biggest and most common misconception. There are certain maintenance checks that must be completed:
On a daily basis – virus updates and spam filtering.
On a weekly basis – system backups and spyware sweeps.
On a monthly or quarterly basis – checking for and installing security patches and updates, disk defragmentation, spyware detection, and removal, checking the surge suppressor and the integrity of the hard drive.
You probably don’t have the time nor the expertise to keep up with these things. Plus, with viruses evolving all the time, it’s best to refer to your IT Partner for these maintenance tasks.
“The Security Tools Provided In Our Operating System Are Enough”
They aren’t, and there’s no one vendor that provides all the security you need to keep your computers safe. Your dental practice requires a multi-layered approach to IT security that:
Remotely monitors your technology 24/7 to ensure the security of your data and EHRs.
Confirms that your data is always stored securely, protected, and private.
Includes Compliance and Security Audits to ensure your technology meets today’s stringent HIPAA and Meaningful Use Requirements.
Leverages Mobile Device Management, so your data is safe anywhere it goes.
Provides Backup and Disaster-Recovery Services so your systems and data are securely accessible, no matter what.
Your dental practice requires the expertise of a managed services and security provider who can remove the vulnerabilities in your IT processes, applications, and hardware that open the door to intruders. They should be capable of deploying remote software and hardware-based network security services to provide complete enterprise-based information security.
How To Secure Your IT System From Malicious Attacks In 6 Simple Ways
As mentioned above, the computers and network you use in your dental practice must be proactively and remotely monitored and maintained. In addition, you must do the following:
Back Up Your Files To A Reliable Source Every Day.
This means using an enterprise-based onsite backup. With local backup (usually an external hard drive), the data is just as protected as your network. However, once it’s stored and the drive is disconnected, it’s safe from any malicious attacks that might affect your infrastructure. Backing up all of your data to an external hard drive is typically quick, and after your initial backup, daily updating can be done in just a few minutes.
Test Your Backups On A Regular Basis To Ensure They’re Recoverable.
Testing that files are recoverable is the missing step in making backups. Too many dental practices make substantial investments and spend a lot of time backing up their data only to find their backups don’t work when they need them. There are many things that can go wrong to corrupt backups. That is why it’s not enough to simply back up your system; you have to check it on a regular basis to make sure the data is recoverable in the event of an emergency.
Keep An Offsite Copy Of Your Backups.
In addition to your enterprise-based onsite backup, you need a secure cloud backup where your data is safely replicated to a data center. To do this, your IT Partner will use technologies like virtualization where they provide a cloud-based version of your servers, workstations, file storage, and applications in a secure data center. This way, if a fire or flood destroys your onsite backup, you’ll still have everything you need to get your practice back up and running.
Ensure You Use Reliable Virus Protection, Keep It On And Up To Date.
The right anti-virus software will detect, prevent, and remove viruses, worms, and other malware from your computer. Most include an auto-update feature that permits the program to download profiles if new viruses appear to check for threats. Antivirus programs are essential, but one program might find certain viruses while another can’t. You should consult with your IT Partner to ensure your dental practice chooses the right software for your needs.
Firewalls Are A Must.
No matter how small your practice, you need a quality firewall. A firewall is the first line of defense to secure your sensitive information. It blocks unauthorized access to or from your network and prevents unauthorized users or illicit software from gaining access. A firewall may be used as hardware, software, or a combination of both.
Update Your Software And System With Security Patches As Soon As They’re Released.
Software updates are important because they often include critical security patches for vulnerabilities. Many of the more harmful malware attacks take advantage of software vulnerabilities in common applications, like operating systems and browsers. Think about this – hackers will know that security patches have been released. They know that Microsoft, Apple, or another software provider has detected a vulnerability. Hackers will be on the lookout for those who haven’t patched their system. If you wait to update, your IT system and data will be exposed.
Your files and patient data are important to your dental practice. Isn’t it time you got serious about protecting them? We’ll take the guesswork out of securing your computers and network. Contact us for a complimentary consultation to learn more.
by Felicien | May 30, 2018 | Education
Earlier this month, two San Francisco hospitals reported that 900 patient records had been compromised. The two hospitals involved were San Francisco General and Laguna Honda. The San Francisco Public Health Department was notified and began their investigation at once. They found that a former employee of Nuance Communications was at fault. Nuance is a third-party vendor to both hospitals providing voice recognition software for medical transcription.
The Public Health Department is partnering with Nuance Communications to get to the bottom of the breach and mitigate the damage as quickly as possible. The former employee at Nuance illegally accessed the patient records of about 900 patients from the two San Francisco hospitals. The lost data included names, dates of birth, details about patient’s conditions and diagnoses. It did not include any social security numbers, financial information, or driver’s license numbers.
The patient records were accessed between November 20th and December 9th of 2017. The health department confirmed that all patients affected had been notified.
Improvements needed in healthcare networks
In a statement, Roland Pickens, the director of the San Francisco Health Network said, “We sincerely apologize for any inconvenience or concern that this situation may cause. All of our vendors are required to attest to the protection of patient privacy, as part of their contract, and we continue to audit and improve upon that process.”
After an investigation by the U.S. Department of Justice, authorities said they believed the stolen information had not been offered for sale online. They also stated that all personal data from patients had been safely recovered from the former Nuance employee.
A Health Department spokeswoman said that the investigation was still ongoing and that all parties were working together in harmony to resolve these issues as quickly as possible. They assured the affected patients that their personal medical information had been recovered and that the risk of damage from the breach was minimal.
Medical data a valuable target for cyber thieves
Patient medical data has become a hot target for cyber thieves because it usually contains a great deal of information about the patient. Hospitals collect many types of personal information from patients including names, addresses, phone numbers, social security numbers, driver’s license numbers and detailed information about the patient’s medical condition. This type of information is considered high-value by cyber thieves because it has so many different uses. For instance, knowing the medical condition of a person would give criminals an arsenal of tools with which to defraud the patient. In many cases, patients who lose this type of information feel vulnerable. Patients often already feel as if they’ve lost control due to their compromised health condition. But then, a cyber-criminal steals their personal data and they feel as if they’ve been attacked again.
For these and other reasons, hospitals and healthcare organizations must be especially careful when dealing with patient records. HIPAA guidelines provide doctors and hospitals with a full set of standards regarding the processing of patient data. The agency seeks to reduce fraud, waste, and abuse while delivering better health care to individuals.
Other big healthcare breaches
In 2014, 56,000 medical records were stolen from patients at San Francisco General, along with a few city-run clinics. In this case, as in the last one, a third party vendor was responsible for the breach. An employee of Sutherland Healthcare Solutions, a billing company doing business with the hospital, stole the records in order to sell them on the Dark Web, where they might have brought thousands of dollars.
In February of 2015, Anthem Health Insurance experienced a data breach where 80 million company records were breached. To date, this has been the largest attack on hospitals, insurance providers, and healthcare. Investigators said that cybercriminals were able to break into the insurance company’s servers and steal the records.
Officials say that they expect data breaches at healthcare organizations to rise over the next few years. The reason? The information that cyber thieves can collect is so thorough that it allows thieves to assume the identity of the person. Once they do this, they can set up new accounts, access the patient’s bank account, or use their credit cards.
In past breaches, hospitals and health care providers have lost patient records via numerous ways. The top four methods used were:
Theft of laptops
Breaking into hospital servers
Third party vendors
Angry ex-employees
In some cases, personal patient info is exposed due to technological glitches in the software or hardware that a healthcare provider uses.
In response to the two latest breaches at San Francisco General and Laguna Honda, hospital officials said they were strengthening their security practices. Many security experts believe that every organization, whether private or public, should treat cyber security as a boardroom topic instead of an IT issue. The rise in healthcare breaches confirms that.
by Felicien | May 30, 2018 | Education
Cybercrime is no longer a new phenomenon. The zeal with which cybercriminals have committed these offenses in the past has led to an outcry from businesses and organizations. Cybercriminals are constantly on the prowl for new sites to attack. They are continuously improving their methods of attack. To make matter worse, this type of crime is very difficult to solve. The attacks themselves become more sophisticated as the days go by. Many experts are searching for real solutions; permanent solutions.
The threat to small businesses
While many organizations have put in place various measures to prevent this crime, a look at the statistics reveals that only large organizations are really doing everything they need to do. Smaller companies either think they can’t afford good protection or don’t need it. The best protection from cyber breaches is expensive. It requires training for employees, risk assessment, and the installation of a good array of programs that can detect and prevent intrusion. There are ways that small businesses can get the same top-notch protection as a large organization. And, it is imperative that they do so. A big data breach could cost your company millions of dollars. Most experts say that it’s not a matter of IF you get attacked; it’s just a matter of WHEN.
How real is the threat?
The threat of a cyberattack is a lingering one despite the amount of protection that one invests in. That’s because the nature of this crime is to evolve with each new attack. This is why most business owners prefer to invest in protection services with the ability to detect cybercrime before it occurs. The Verizon Data Breach Investigation Report shows that the threat of cyberattacks on small businesses is much greater than small business owners anticipate. This group states that up to 61% of cyber security breaches were experienced by small businesses last year. This was an 8% rise from 53% in the previous year.[1]
Cost of cyber-attacks on small businesses
While small businesses fail to invest in protection systems because of the costs, it is noteworthy that the amount of money lost as a result of cyberattacks is considerably higher. The ransomware attack is a great example of this fact. One ransomware attack can stop your workforce in its tracks. Your data will be locked until you pay. Some thieves threaten to release your internal documents to the public. This caused a huge amount of embarrassment for Sony Pictures after their 2014 data breach.[2] The North Koreans took responsibility for this breach, claiming that they did not like a movie that Sony was about to release where the North Korean dictator was to be made fun of.
In the end, the damage to Sony was more about being embarrassed before the whole world. Sony’s reputation was severely damaged. Though large companies like Sony can survive an attack like this, small companies cannot. A new study shows that cyberattacks cost on average, $38,000 per attack.[3] Below are a few other stats pertaining to small businesses and data breaches:
23 percent lost business opportunities after an attack.
29 percent lost revenue; 38 percent of those lost more than 20 percent.
22 percent of businesses lost customers; 40 percent lost more than 20 percent of their customer base.
In some cases, small businesses must close their doors within a few months of the attack. Small business owners are only just realizing how vulnerable they are. This is due to the fact that most small businesses are an easy target for hackers. They simply don’t have sophisticated enough data protection programs in place.
What can you do about it?
The first step for any small business is to invest in effective cyber security software. These should be installed on all computers and mobile devices. The second step is to install a remote computer backup. Always have recent copies of your database stored somewhere offsite. A remote computer backup makes recovery of data much simpler.
A third step is to test your data security systems and procedures regularly. This can be easily done through a gap analysis. A gap analysis will enable the business owner to know how effective the data protection system really is. It takes into consideration the detected threats and compares these with the protection system. It is also sensible to develop a data breach response plan. This should include a communications response plan.
Proper response in cases of data breach can save a company millions of dollars and protect customers. A good response plan can let everyone including stakeholders know what’s going on. The sooner your employees know what’s happening, the sooner they can shut down their computers and mobile devices so that the virus can’t spread. All computers and devices with company data should be disconnected from the network until the issues are resolved.
Cyber liability insurance can also come in handy in case of attacks. As we have noted, up to 60% of small businesses which experience cyber-attacks are forced out of business within six months of the attack. Cyber liability insurance will protect your assets.
Final thoughts
Small businesses are currently attractive to cybercriminals because of their lack of protection. When it comes to cyber security, it should be noted that prevention is definitely the best route. Though many prevention measures appear costly, it can save your company from going through a nightmare that will be expensive and damage your reputation.
[1] https://www.verizonenterprise.com/verizon-insights-lab/dbir/
[2] https://en.wikipedia.org/wiki/Sony_Pictures_hack
[3] https://www.score.org/blog/cyberattacks-cost-small-businesses-more-money
by Felicien | May 30, 2018 | Education
Cybercriminals are getting more fearless by the day and their crimes are getting more and more sophisticated. Cybercrimes are costing businesses and organizations billions of dollars each year. This has spawned a new generation of cybercrime fighters who search for ways to end this threat once and for all. With each new attack, the crimes get more sophisticated. Hackers are learning from their mistakes and tweaking their methods to make them even more effective.
While most attempts to end hacking seem futile, it is an industry that will continue to require experts in managed threat detection. Stopping thieves before they can get into your database is the preferred method and this has now become possible. The latest technology can assess your network’s weaknesses and your IT professional can recommend various ways to shut down those weak areas.
Why the rise in popularity of managed threat detection?
Investments in technologies that prevent cybercrimes are currently on the rise. There are now a number of solutions that prevent intrusion into your computers. But many companies feel they just don’t have the money to install the latest threat detection equipment. Though there is an initial expense involved, business owners with these new threat detection systems do enjoy greater peace of mind. One cyber-attack is now estimated to cost approximately $1.3 million on average. In addition, customer trust is eroded once the public learns of the breach and overall sales can go down. The expenses for a breach can often linger for years.
What is Managed Detection and Response?
MDR is a combination of technologies and skills that provide global threat intelligence, deep threat analytics, and earlier incident mitigation. The most effective response to a breach requires a collaborative, far-reaching effort.
Managed Detection and Response works well because it is set up to function every minute of every day. It provides more thorough protection from the viruses, worms, ransomware, and malware that exist on the World Wide Web.
MDR is commonly used together with traditional managed security services (MSS) to ensure complete protection. These services can be provided by specialized vendors who focus mainly on threat management. They can also be provided by specialists who have MDR capabilities. Managed detection is chiefly distinguished by the fact that it works even in circumstances where the traditional methods of protection, which are focused on limited log collection and rules-based analysis, do not work.
How is MDR delivered?
Today, businesses will find a few cybersecurity experts who understand the ever-changing landscape in the world of cybercrime. Thieves utilize a number of methods that evolve with each new attack. The only truly effective response to these attacks is to develop a system of crushing cyber-attacks that also evolves with each new event.
New technology focuses on a series of effective approaches to threat detection and elimination. The initial step is known as threat anticipation, which measures the level of a company’s preparedness. This determines how high a company’s chances are of being targeted by cyber thieves. MDR also includes threat hunting. Instead of waiting for an event to occur, this technology actively hunts for threats and eliminates them.
Third, security monitoring is essential. This service is basically exactly what it says. A system is put in place that constantly monitors all hardware, software, and networking equipment, looking for loopholes that thieves might exploit. Security monitoring should include alert response, incident response, and breach management.
Why is Managed Detection and Response popular?
For most business owners, there just isn’t time each day to worry about cyber breaches and data leaks. Though the costs to address them can be enormous, a business person needs to focus on running his company. Your business can suffer if you must constantly be pulled away to address potential security threats. That’s the major reason why business owners are opting for a greater level of protection for all their computers and networking equipment.
Threat detection and prevention is a full-time job and most business people just don’t have the time or skills to deal with it. Your company needs the finest protection available so you can get back to work without the stress of knowing that a breach could occur at any moment.
MDR service providers are able to collect data from various sources on the threats that your organization may face. This enables them to know exactly which threats are more pronounced. Once an organization knows where their weaknesses lie, they are in a better position to respond, repair those flaws, and move forward with more confidence.
Of course, a good managed detection and response program should also include all the measures to respond should a breach occur. In spite of all the advances in technology, if just one of your employees clicks on a malicious link, they could download ransomware or other harmful malware into your system. You can mitigate the damage though, by knowing exactly what to do.
Final Thoughts
Managed Detection and Response (MDR) is designed to handle anything that cyber-thieves can throw at you. It initially seeks to find and close any weaknesses, but it also includes a sound response plan should a breach occur. It utilizes today’s best detection tools, threat intelligence, forensic investigation tools, and human analysts. It can give business owners the peace of mind they need to get back to running their companies without the constant worry of an expensive data breach.
by Felicien | May 29, 2018 | Education
It’s one thing for a business to have installed Wi-Fi networks, but it’s another thing to ensure that the equipment is and will continue to work properly. This means the network should be able to continue supporting the growing demands of a business. It should be able to upgrade automatically whenever necessary to provide the latest and most convenient improvements available. This may sound simple and manageable by the IT staff, but it can be challenging.
Having in-house IT staff means that you have to get in line with other departments and wait your turn before you get help. They already have enough work each day so your Help Desk request may get pushed to the back. This is just one reason why it can be beneficial to have a trusted partner manage your Networks and computers.
The Right Fit
So many managed IT providers say that they’ll be there when you need them. How can you find the right fit for your business? It can be challenging in this day and time, simply because of all the many great choices. But, it can be helpful to sit down with your supervisors and talk to them about the ideal IT provider – someone who will take the time to listen to you, show concern about getting it right for you, someone who really will become a trusted partner.
A good IT partner will stay on top of daily maintenance for your hardware and software. They’ll keep the Wi-Fi equipment running smoothly. They will make recommendations about new products your company could benefit from. If you could find an IT service provider who stands by their promises, imagine how much easier your life would be. Your company would stop demanding so much of your time. You might actually get a vacation this year.
How to find your IT Managed Services Provider
Talk to other businesses owners in your area. Ask them to recommend someone. Check all names, credentials, and reputations online. You can find out quickly whether someone has a good strong reputation in the business world. Visit the company and meet some of their staff members. Do they seem capable, knowledgeable and skilled? If you walk in and find a young receptionist on the phone with her boyfriend and two of the techs in the back flirting, then get out of there quickly! That’s not the right place for you.
You’re serious about your business. You want it to succeed for yourself and especially for your family. So don’t settle for lame vendors that never show up and don’t do good work when they do meander by your place. Take as much time as you need finding a professional team of IT techs who know their jobs exceptionally well and love to come to work each day. These guys will know what’s going on when you get the Blue Screen of Death. They can fix it remotely in just a few minutes and you’re back to work.
Communicate your needs
When you find the right IT managed support team, sit them down at your office and make it clear that you want the very best they can give. You’re in this to win it and if they want to go along for the ride, they’re welcome. But they will have to pull their weight.
When you set down some guidelines right at the beginning of any relationship, you’ll find that the relationship is much more rewarding for both people. Of course, there will be contracts to sign that will state and include everything you talk about. A good contract is clear about what your responsibilities are and what the IT provider will provide. The cost should be included and can be a monthly charge or a fixed price you pay several times a year. Most vendors will work with you because they want your business.
Below, are just a few of the more important IT and networking services/products that your business needs:
Cloud storage and backup
Remote monitoring/management of servers, desktops, mobile devices
Business continuity plan in case of disaster
Cybersecurity for all computers and devices
Regular preventative maintenance
Scalability
24/7 tech support
There are many other services you could opt for and you should discuss this with your IT professional.
The best managed wireless is all about handling many different services well. Every phone and computer should be secure even those of remote workers. Communications should be up and running 99 percent of the time. If you run a hospital or medical office, then you understand the importance of a good communication system. Most providers will suggest VoIP. It’s cloud-based and dependable, plus it can fit nicely in any budget.
With managed services, an organization should not have to worry about maintaining their Wi-Fi networks. Work with someone you have confidence in; someone who will exceed your expectations. You need a good, trusted IT service provider who is willing to get to know your business and work right alongside you to see it grow. Don’t settle for less than the best!
