Compliance Mistakes You Don’t Know You’re Making That Can Cost You Thousands

Taking the Fear of Compliance Mistakes out of Regulatory Compliance

The phrase “regulatory compliance” often strikes fear in even the most seasoned executives, but it doesn’t need to be that way.  Education and awareness are critical, so let’s look at the top two regulations that your company may need to think about – Payment Card Industry Data Security Standard (PCI-DSS) and Health Insurance Portability and Accountability Act of 1996 (HIPAA).

 

What is Regulatory Compliance?

Regulatory compliance refers to the steps put in place by an organization to comply with state, federal, and international laws and regulations that are relevant to its business operations. If regulatory compliance is violated,  there can be monetary and even criminal penalties that a company may incur.

 

Cards in pocket

Payment Card Industry Data Security Standard (PCI-DSS)

If your company directly accepts payments for goods or services through payment cards (VISA, AMEX, and Discover for example), you need to have a plan for PCI-DSS compliance.

PCI-DSS was established to prevent credit card fraud. This is accomplished by putting standardized controls (rules) in place at all merchants accepting cards. This is a good thing.  It increases your customer’s confidence because they know you are actively working to protect their card data.

 

There are six control objectives required under PCI-DSS:

1. Build and Maintain a Secure Network and Systems

2. Protect Cardholder Data

3. Maintain a Vulnerability Management Program

4. Implement Strong Access Control Measures

5. Regularly Monitor and Test Networks

6. Maintain an Information Security Policy

 

Let’s quickly break down each of the objectives:

1. Build and Maintain a Secure Network and Systems

Simply put, the company needs to have basic security in place. This means having a firewall and password-protected computers. Do not use default passwords on any systems or software.

 

2. Protect Cardholder Data

If you take orders over the phone, do not leave cardholder information on a notepad or sticky note. Preferably, the numbers would be directly entered into your terminal system or software and never stored, if possible.

 

3. Maintain a Vulnerability Management Program

Make sure you are using up-to-date anti-virus and anti-malware protection on all systems. 

All operating systems must be current and patched. Third-party software must be up to date.

 

4. Implement Strong Access Control Measures

Limit access to and protect equipment used to process transactions. If you must write down card data, make sure it is shredded. Any systems used to process transactions must have their drive destroyed when decommissioning.

 

5. Regularly Monitor and Test Networks

Regular network scans, both internal and external, need to be performed regularly or whenever there is a change to systems or software.

 

6. Maintain an Information Security Policy 

Establish and maintain an information security policy. Review this policy at least annually—train employees on security awareness and social engineering. Screen new employees to limit the incidence of internal breaches. Lastly, have an incident response plan in case of a data breach.

There are a lot of things to consider. If you need help understanding any of these controls, reach out to your IT Security Professional or Edge Networks.

 

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

HIPAA was passed into law to provide a framework to safeguard Protected Health Information (PHI). 

PHI is defined as any piece of information in an individual’s medical records that could be used to identify them personally. Basic examples include name, social security number and date of birth. Many other identifiers are included, and these continue to evolve as more technology is used in healthcare.

If your company is healthcare-focused, then you are very familiar with HIPAA. Your company falls into a group called “covered entities”.

 

People Signing HIPAA forms

There are three main categories of covered entities: Health plans, Clearinghouses and Providers.

  • Health plans include insurance companies, health maintenance organizations (HMOs) as well as employer-sponsored health plans.
  • Clearinghouses are organizations that process health information to conform to the prevailing standards for data content or format. Clearinghouses act on behalf of other organizations.
  • Providers include doctors, clinics, dentists, nursing homes, pharmacies and chiropractors, to name a few. Essentially any organization that submits healthcare-related claims to another covered entity.

You might feel a sense of relief when you notice that you are not on the list of covered entities. However, you may not be off the hook just yet. If you perform work for these organizations, you may be what is known as a business associate, and you must also be compliant. In this situation, you must enter into a contract called a Business Associate Agreement (BAA). 

The BAA details what information your company has a responsibility to protect. A few examples of service companies considered business associates are shredding services, attorneys, accountants, marketing services, and transportation services. This is not an exhaustive list. Please check with legal counsel if you are unsure.

To ensure health data protection is taken seriously, there can be monetary penaltiess associated with unauthorized disclosure of PHI. Penalties are levied based upon severity and negligence of a given disclosure. 

 

There are four HIPAA violation penalty tiers and associated monetary penalties:

  • Tier 1 – A violation that the covered entity was unaware of and could not have realistically avoided, had someone take a reasonable amount of care to abide by HIPAA Rules. Minimum fine of $100 per violation up to $50,000.
  • Tier 2 – A violation that the covered entity should have been aware of but could not have avoided even with a reasonable amount of care. Minimum fine of $1,000 per violation up to $50,000.
  • Tier 3 – A violation suffered as a direct result of “willful neglect” of HIPAA Rules, in cases where an attempt has been made to correct the violation. Minimum fine of $10,000 per violation up to $50,000.
  • Tier 4 – A violation of HIPAA Rules constituting willful neglect, where no attempt has been made to correct the violation. Minimum fine of $50,000 per violation.

 

Money signifying HIPAA Violation Penalty

 

The penalties are adjusted for inflation annually.

Individuals involved in disclosures can also incur criminal penalties. These penalties are based on the severity and negligence involved in the disclosure. If an individual has profited from the theft, access or disclosure of personal health information (PHI), then those monies may also have to be forfeited in addition to the fine.

There are three tiers of criminal penalties for HIPAA violations:

  • Tier 1 – Reasonable cause or no knowledge of violation – Up to 1 year in jail.
  • Tier 2 – Obtaining PHI under false pretense – Up to 5 years in jail.
  • Tier 3 – Obtaining PHI for personal gain or malicious intent – Up to 10 years in jail.

The value of PHI on the black market continues to increase. This has been a big temptation for some individuals given recent economic conditions. Social engineering and malware attacks are on the rise to gain access to this valuable data. 

It is imperative that organizations subject to this Act take appropriate actions to reduce the risk of breaches.

 

Regulatory Compliance Matters

This is just a brief glimpse of the two main regulations that you may encounter in your business. It is best practice to review your compliance policies at least annually, and certainly when a change is made to the regulations.

If your company lacks in-house talent with the detailed knowledge needed to ensure compliance, we recommend that you consult with legal counsel. For the technical and operations aspects, you should reach out to a knowledgeable compliance and technology partner like Edge Networks to assist you with your journey into the compliance world. The investment will immediately begin to pay for itself because you just cannot put a price on your peace of mind. Contact us today for a free, 30-minute consultation.

The Five Critical Components Your Cybersecurity Incident Response Plan Must Have

What Is a Cyber Incident Response Plan?

According to the National Institute of Standards and Technology (NIST) , a government agency that supports and promotes the use of technology to solve human problems, a cyber incident response plan consists of “the documentation of a predetermined set of instructions or procedures to detect, respond to, and limit consequences of malicious attacks against an organization’s systems.”  More simply put, creating a cyber incident response plan means formalizing the exact steps you’ll take as soon as you discover that a cyber incident has taken place.

Having a robust cyber incident response plan in place can save your business time and money, and it can help preserve your business’s reputation if you’re victimized by cybercriminals. Advance planning can boost your organization’s cyber resilience, and increase your peace of mind in the face of today’s most formidable threats.

How can you create the cyber incident response plan that’s right for your business’s size and your IT infrastructure’s degree of complexity? Your plan doesn’t have to be elaborate; it just has to be solidly built so you’ll know what to do in a time of crisis.

 

Cyberattacks can happen to anyone. Be prepared by creating a solid Cybersecurity Incident Response Plan.

No matter whether your business is large or small, no matter what industry you’re in, or where your offices are located, cybercrime poses grave risks to your financial well-being today, and your chances of survival and healthy growth in the years to come. Global losses caused by cyberattacks are predicted to exceed $6 trillion by 2021, putting more money in criminals’ pockets than the trade of all major illegal drugs combined.

Leaders of small and medium-sized businesses may be tempted to believe that they face fewer risks from cybercrime than large enterprises because their profiles—and revenues—are lower, but the latest research shows that they are in fact more likely to be targeted for attack. According to the 2019 Verizon Data Breach Investigations Report, nearly half of all breach victims were categorized as small businesses. The Better Business Bureau reports that as many as 20 percent of smaller organizations will fall victim to cyberattacks in any given year, with average losses totaling nearly $80,000 per incident.

To help you get prepared, we have created a FREE Cybersecurity Incident Response Plan template that you can implement in to your business, which you can find at the end of this post.

Given these nerve-wracking statistics, which remind us that cyberattacks aren’t just possible but are almost inevitable, it’s important to make a plan. Drawing up a comprehensive risk assessment, laying out the specific steps you’ll take in the moment of crisis, and delineating key responsibilities can help you feel more prepared, but it’ll also enable a speedier response. And the faster you can contain the incident and manage its consequences, the lower your overall costs are likely to be.

 

The Five Essential Ingredients

#1: Formalize and Document the Policies and Procedures

In case of disaster, you can’t just wing it. Every aspect of your cyber incident response plan should be concrete, written, and well-tested. Though you’ll want to include detailed steps and procedures to follow, you’ll also want to spell them out simply.

Keep in mind that stakeholders across the entire organization may have roles to play in identifying, containing, and responding to the incident, even those whose typical job responsibilities don’t have anything to do with IT, and that incident response team members are likely to be under a great deal of stress. Documentation should be clear, brief, and very specific, so that steps are easy to follow, even when the pressure is on.

 

#2: Build a Rock-Solid Team

You’ll want to establish a computer security incident response team (CISRT) within your organization.

Team members will be responsible for technical incident response procedures (identifying that an incident has occurred, analyzing logs to figure out exactly what happened, repairing systems, and removing the means by which the attack was accomplished) as well as internal and external communications (exchanging information with employees, law enforcement, affected customers, and senior management, for instance), so you’ll want to include IT security staff and draw on resources in other departments as well.

Some team members should be skilled in marketing/public relations, human resource management, and providing legal counsel. A managed service provider can supplement your in-house expertise if your technical security team isn’t large enough to meet your incident response needs.

 

#3: Establish Communications Guidelines

One team member should be charged with the responsibility for authorizing when and how details about the incident are to be disclosed. It’s also a good idea to have legal counsel review any notification letters or other disclosures before they’re made public. Have a plan in place for how you’ll accomplish this, as well as a set of guidelines for what you’ll say.

Be sure you have recorded the contact information for anyone you might need to communicate in a place that’s separate from any systems that might be affected by a breach. This could include contacts at regulatory bodies whose requirements you must meet, as well as all members—both internal and external—of your incident response team.

 

#4: Outline Concrete Technical Steps

From incident discovery and classification to containment and recovery, you’ll need a playbook detailing specific steps within incident response protocols that you expect your security team members to follow.

You’ll want to collect all relevant log data so that it can be audited, and review all alerts generated by the security tools in your network environment. You’ll also need to elaborate the testing and validation procedures you’ll rely on after forensic analysis is complete to certify that all systems have been restored to secure operational status.

 

#5: Practice Makes Perfect

Technologies are constantly changing, as are attackers’ strategies and techniques. At a bare minimum, your team should revisit your cyber incident response plan once a year. Update it to reflect your current IT environment, the current threat landscape, and your current risk profile. Any incidents that do take place should be examined at length. Afterwards, make technology updates or policy changes to safeguard against similar attacks in the future.

It’s also a good idea to conduct scenario-based testing exercises to make sure that your incident response plan can be relied on in times of need. These can be simple or elaborate, and offer team members the opportunity to evaluate—and improve—their preparedness without facing an actual incident or attack.

Developing a cyber incident response plan doesn’t have to be complicated. Having one can make a dramatic difference in your level of preparedness, your overall vulnerability, and your peace of mind. A managed IT service provider with cybersecurity-specific experience will have a great deal of practical knowledge in cyber incident response procedures, and can guide you in building the very best plan to meet your business’s needs, from the ground up.

 

Download Your Free Incident Response Plan

How Do I Create a Security Awareness Program – Employee Security Awareness Training

Reducing threats better than a firewall, intrusion detection system, or endpoint protection platform with Security Awareness Training

Why should Security Awareness Training be on your radar? Year after year, leading industry surveys continue to reveal that cybersecurity attacks are on the rise. And the latest 2018 Verizon Data Breach Investigations Report, which details more than 53,000 incidents and 2,216 confirmed data breaches, is no exception. Though enterprises are spending more than ever before on technological solutions, and though more robust software and more recent updates are available, criminals are continuing to breach our networks at an unprecedented rate. Why are attackers successful as often—or more often—than they were in the past, despite advances in security technology? 

According to Verizon’s research, the most common action taken in breaches was the use of stolen credentials. In another recent survey, 65 percent of organizations had been victims of a major security incident within the past year, and among these, more than half (52.9 percent) reported that their systems had been infected through a phishing or targeted email-based attack. Human error is what has allowed these attacks to succeed.

 

Phishing Statistic

No firewall, intrusion detection system, or endpoint protection platform can help reduce these threats. They’ll be just as prevalent no matter how much technologies improve. 

But there are steps you can take to secure your organization against threats seeking to take advantage of human error. Implementing security awareness training is relatively simple, cost-effective, and, according to research, highly effective at lessening these risks.

 

What is Security Awareness Training?

Security awareness training is a formal educational program designed to help employees be more mindful of information security best practices as they go about their daily activities. Its primary objective is to strengthen the overall security culture throughout the organization. 

Various types of security awareness training exist, from the “break room approach,” in which employees are gathered for lunch-and-learns or special meetings, to training conducted via videos or webinars, all the way through comprehensive programs that include practice with simulated phishing attacks and testing.

 

People in Security Awareness Training Meeting

How Do I Train My Employees for Cybersecurity?

Numerous cybersecurity awareness programs are available today, but not all are equally effective. Many security leaders struggle to gain support for this training from upper management, and some have difficulty getting employees across the business to take all its aspects seriously. Training that’s poorly designed, that’s conducted too infrequently to be memorable, or that has become outdated (which can happen very quickly in today’s ever-changing cybersecurity landscape) won’t give the hoped-for results.

Look for a program designed to engage your users, to hold their interest, and to provide ongoing training, assessments, and refreshers to ensure that they retain what they’ve learned. Programs that deliver information in a wide variety of media types and formats (ranging from posters to video, webinars to email newsletters) will cater to a broad array of learning styles. Programs that include gamification build a sense of mastery and autonomy among users, improve their recall of information, and boost their willingness to participate. And programs that offer testing and assessments and display the results in a visually appealing dashboard make it easy to identify the individuals who pose the greatest risks.

 

Importance of Security Awareness Programs

Because the human tendency to make mistakes remains the same while cybersecurity technologies grow more sophisticated, cybercriminals are focusing increasing amounts of attention and effort on people instead of technical defenses. 

Email continues to be the most common attack vector. Despite this, an alarmingly high percentage of users in one recent international survey were unable to correctly define—let alone accurately identify—a phishing or ransomware attack. In this cultural climate, security awareness training has the potential to make an enormous difference.

 

Benefits of Security Awareness Training

No matter which technical cybersecurity solutions your organization has in place, implementing a security awareness training program can enhance their effectiveness. Because of this, security awareness training continues to be among the most cost effective ways to reduce the overall information security risks faced by your organization.

An effective security awareness training program will significantly decrease your chances of suffering a data breach, and thus of incurring resulting direct and indirect costs—for remediation and repair, revenue loss, reputation damage, and fines and penalties. Forrester Research estimates that a mid-size organization would experience a $124,219 risk-adjusted benefit value over the course of three years after implementing a highly effective security awareness training program.

The “soft” benefits that such organizations would experience are more difficult to quantify but no less important. These include an increase in employee motivation and ability to respond effectively to phishing attempts or other cyberthreats. Employees who are confident in their ability to identify risks are far more likely to participate in a “speak up” and “safety first” workplace culture, and less likely to ignore threats when busy or stressed.

 

Security Awareness Training Companies

Demand for cybersecurity awareness training is on the rise. Cybersecurity Ventures predicts that the market for security awareness training, which was roughly $1 billion per year in 2014, will increase to $10 billion annually by 2027. To help employers navigate this rapidly growing market, they’ve assembled a comprehensive directory of companies that offer products, services, and platforms within it.

 

People pointing at laptop

With so many options to choose from, it can be challenging to determine which cybersecurity awareness training program will best meet your organization’s unique needs. Seek out a training provider with extensive experience, and choose one that knows your industry well—including its culture and history as well as the threat profile and compliance requirements you face.

Several organizations, including the SANS institute and the U.S. government , offer free resources that can help you evaluate vendors or lay the groundwork for your training program. Many reputable vendors also provide tools and resources that are free to the public.

 

IT Security Awareness Training for Employees PPT

A common method for delivering security awareness training is by showing PowerPoint slides on best practices to assembled employee groups. Though this is undoubtedly better than no training at all, such presentations, which security experts and weary employees alike dub “ death by PowerPoint ,” are among the least engaging ways to present this vitally important material.

 

Security Awareness Training Program Template

In contrast, the most effective security awareness training programs for today’s complex and ever-changing threat landscape are those that engage your users’ attention and awareness by presenting highly relevant, personalized and individualized material in a variety of formats. 

Look for a program that includes:

  • Baseline testing. It’s key to assess your users’ strengths and vulnerabilities before you begin training.
  • A comprehensive training library. Interactive modules and games will challenge and engage your users. Automated reminders can provide an incentive for them to continue progressing through the program.
  • Tests and simulations. These should be sophisticated and varied to mimic the real-world threats that users encounter daily.
  • Clear and actionable reporting. Statistical reports allow you to see the results of your security awareness mitigation plan, and to modify it to maximize effectiveness.

 

Security Awareness Program Ideas

If you create a security awareness program that employees find enjoyable and engaging, they’re far more likely to remember its lessons and apply them at the right times.

Include games among the educational materials and consider providing incentives or awarding prizes to employees who succeed in the training or are able to apply its lessons to real-world attacks.

 

Man and woman talking in office

It’s also important to customize your messaging for different employee groups. Senior executives may not need or benefit from the same training as IT staffers, and industrial equipment operators will have different needs still. If you can make the training relatable and relevant, employees are more likely to appreciate its value.

 

Data Security Practices for HR Professionals

HR professionals have a vital role to play in protecting organizations’ information assets. Because HR traditionally oversees employee development and training, they’re in an excellent position to advocate that strong employee cybersecurity training programs be implemented throughout the entire organization. An effective HR department can go a long way towards developing a resilient cybersecurity culture across disparate departments and divisions. 

HR departments can also ensure that security awareness training be incorporated into employee on-boarding procedures.

 

Clean Desk Policy

It’s easy, straightforward, and the opposite of technically complex. But many employees forget that simply straightening up their desks can help protect the security and integrity of business data.

Though we often think of data security as an IT problem, sensitive information can also be found on printouts or paper forms. Be sure to file away all paperwork that needs to be saved, and shred paper documents before discarding them. Putting everything where it belongs is a habit that will keep all types of data safer. It also makes it easier to see if laptops, mobile devices or USB drives have been stolen or tampered with.

Finally, never store written down passwords on sticky notes to store on your desktop or attach to your computer monitor.

 

Clean desk policy image

Conclusion

Some information security best practices are simple, but choosing a security awareness training provider that will understand your business, industry, and company culture can be complex. It’s an important decision, however, since highly effective security awareness training can have a major impact on your resilience in the face of today’s most prevalent cybersecurity threats.

A managed service provider with extensive experience partnering with companies just like yours can guide you in evaluating the options. If you’d like to learn more about security awareness training, contact Edge Networks today to schedule a free, zero-obligation IT assessment.

Top 3 Tips for Rock-Solid Microsoft Office 365 Security

Microsoft Office 365 Security – Best Practices

Microsoft Office 365 is among the world’s most widely used software suites, and its popularity continues to grow. Organizations large and small can benefit from Office 365’s always-on convenience, which enables employees to be productive anywhere and everywhere, reliability, and predictable monthly cost. But will your data, intellectual property, and other valuable information assets truly be safe in the cloud? How can you be sure you have rock-solid Microsoft Office 365 Security?

Here at Edge Networks, we’ve seen firsthand how devastating the effects of an Office 365 breach can be. We’re also highly familiar with the world-class enterprise grade security-hardened infrastructure that Microsoft maintains, and we understand the strength of their commitment to physical, logical, and data security. 

We believe that your data can be at least as safe—if not safer—in Microsoft’s Office 365 cloud environment than it is when stored on premises. But we also know that the Microsoft Office 365 environment is highly customizable and configurable.

 

Man looking at green numbers

In the vast majority of cases, Office 365 breaches occur not because of vulnerabilities in Microsoft Office 365’s physical and network infrastructure—which is among the safest in the world—but because users or administrators have not properly configured their Office 365 tenant for security and threat management. Often, making a few small changes can go a long way when it comes to reducing the cybersecurity risks your business faces.

Here are a few quick-to-implement tips that can dramatically improve your safety and security while you continue to enjoy Office 365’s many benefits:

 

Tip #1: Notify users in the subject line of emails that come from outside the company

Email spoofing, which involves forging message header information to mislead the recipient about where it comes from, is more common than ever before. According to Verizon, email fraud accounts for more than 90% of cyberattacks targeting enterprises, and the FBI reports a 136% increase in business losses due to email fraud between 2016 and mid-2018. 

Email spoofing statistic

 

Anything you do to make it easier for users to spot a forged or fraudulent message will make your organization safer. In Microsoft Exchange Online or Office 365, you can add a prepend like [EXT] or [EXTERNAL] to the subject of all incoming messages that originate outside your organization. This makes it easy for team members to identify those that don’t come from the person who is said to have sent them—so that attempts at email spoofing will be glaringly obvious to their intended targets.

Adding a prepend to incoming messages from senders outside the company is easy to implement. It’s a low-cost, low-effort way to boost security, and thus it’s a very good idea.

 

Tip #2: Enable multi-factor authentication (MFA) for your organization’s Office 365 users.

This is probably the most important step you can take to protect all the accounts throughout your business from the consequences of password loss or theft. It adds a second layer of security to all user sign-ins and other system interactions. Microsoft makes it simple to set up MFA centrally for all users, though it can also be done individually.

Most people are familiar with multi-factor authentication because it’s widely used for consumer applications like online banking. They understand that they’ll need to check a secondary device, like their phone, for a code that enables them to access their sensitive personal or financial information. Office 365 supports authentication via mobile app, phone call, or SMS messaging.

Global surveys indicate that only about 20% of enterprise Office 365 users have set up MFA, despite the fact that password-based attacks are the most common reason for Office 365 account compromise. But the prevalence of these types of attacks means that enabling MFA is very much worthwhile. It’s a powerful means of protecting your account, your data, and the security of your entire organization.

 

Laptop displaying Authentication Failed

Tip #3: Enable mailbox audit logging within your tenant

Business email compromise is a serious and ongoing threat. Even the best-informed and most careful employees can fall victim to spear-phishing or other social engineering tactics. Cybercriminals have used everything from fake invoices to keylogging software that steals users’ credentials to trick their targets into transferring funds to their bank accounts. 

By enabling mailbox audit logging, you’re essentially transforming your Office 365 tenant into recording device that will track hackers’ every attempt at tricking, misleading, or deceiving your users via email. It’s a critically important forensic tool that will allow investigators to look back at all the login events and suspicious activities that occurred within mailboxes in your tenant. 

The capacity to maintain these logs is built into Office 365, but audit logging has not always been enabled by default. Turning it on is a simple process, but it must be done ahead of time—you can’t search data from before the time you enabled audit logging capabilities. This is another area where thinking proactively about Office 365 configuration settings can make your business far more secure.

 

Conclusion

At Edge Networks, we’ve made many of our clients’ transition to the cloud easier and more secure. We have the know-how to help you prevent an Office 365 breach from devastating your business. To learn more about how to configure your Office 365 tenant to maximize productivity and security, contact us today for a free, 30-minute consultation.

 

While you’re here, check out our video to hear advice from our former CIO, Josh McKinney, on how to stay safe in Office 365. 

 

Don’t Be the Next Company Sending Out a Notice of Data Breach Letter

Don’t Be the Next Company Sending Out a Notice of Data Breach Letter

Why do so many companies fail to take data security seriously? From what we have seen, companies fail to take data cybersecurity seriously enough for the following reasons:

 

  • They believe that ensuring compliance with a security framework, such as FISMA or NIST, is enough.
  • They haven’t experienced a security breach in the past, so they don’t believe they’ll deal with a security breach in the future.
  • They don’t want to deal with the hassle and/or don’t have the knowledge to find and implement the right security solutions.

 

Does anything listed above sound familiar? Most businesses are surprised when reality strikes them and they must write their clients, consumers or patients a letter with the subject line: Notice of Data Breach.

To help you get prepared for if disaster strikes, we have created a FREE Cybersecurity Incident Response Plan template that you can implement in to your business, which you can find at the end of this post.  

 

Yet another example of a company’s failure to take preventive measures against computer security breaches

Today that “Notice of Data Security Incident” letter came to me from The Oregon Clinic , and alarms went off in my head. For the past 2 ½ weeks, I have lived, breathed and dreamt about cybersecurity and what the implications are to a business who does not take the steps necessary to prevent these “incidents” from occurring in the first place. And now I am seeing it not only as it pertains to The Oregon Clinic, but to their patients.

Their letter starts like this: “I am writing to inform you of a data security incident that may have involved your personal information. At The Oregon Clinic, we take the privacy and security of your information very seriously. This is why I am contacting you, offering you identity monitoring services, and informing you about steps that can be taken to protect your personal information.”

 

Person doing paperwork for notice of data breach

It goes on to outline the when, what, and how they plan to resolve this “incident”.

  1. On March 9, 2018, The Oregon Clinic learned that an unauthorized third-party accessed an email account.
  2. The Oregon Clinic immediately disabled the account and began an investigation to determine what had occurred and whether protected health information (PHI) may have been affected.
  3. Cybersecurity experts were engaged, including a digital forensics firm, to determine the nature and extent of the incident.
  4. On April 19, 2018, the investigation determined that PHI may have been affected. This information included patient’s name, date of birth, and certain medical information (that may include medical record numbers, diagnosis information, medical condition, diagnostic tests performed, prescription information and/or health insurance information).
  5. They determined that the incident was restricted to one email account and did not affect any other aspect of The Oregon Clinic’s network.
  6. In addition to their investigation, they are offering additional steps patients can take to protect personal information. This is an identity monitoring service for 12 months at no cost through Experian.
  7. And, lastly, they give recommendations to protect your personal information, (which is a long and arduous task as anyone that has had their personal information/identity put at risk knows). 

 

In an article by Scot Gudger, CEO at The Oregon Clinic, he issues the following statement to Health Data Management:

“We are very sorry this happened and apologize to the patients who have been affected by this incident. We value our patients and will continue to work closely with cybersecurity experts to remediate this situation, and, most importantly, are taking steps to help prevent similar incidents from happening in the future.”

 

This mindset of “Oh we’re sorry, and NOW we will take steps to prevent this” is becoming less and less acceptable in a world where hackers are always looking for that one company with an out of date AV or Firewall, or no IDS/IPS, or the plain and simple mindset of “it won’t happen to us”.

Don’t let yourself become another number in the world of cyber-attack statistics. Your staff and customers deserve the best from you. 

If you’re looking to be more proactive in your cybersecurity incident response plan, we’ve created an outline of five critical components yours should have. Read more about it below.

If you’re unsure of whether or not your network is secure, take our free, self-guided IT Security Risk Assessment, or contact us today for a free, 30-minute consultation.

 

Download a Free Cybersecurity Incident Response Plan Template

Bulk configure handheld scanners Intermec CK3 via CloneNGo

Josh McKinney, chief technology officer with Edge Networks with a tip of the week. 

What I have in my hands here is an Intermec CK3. It is a bar code scanner that one of our clients uses to scan inventory and to also process orders for customers. 

One of the cool things that Edge Networks did, is this device uses what’s called CloneNGo an application that allows you to configure a master device with certain settings like wifi connectivity applications and other configuration settings…