News

Companies should get ready as crime rings plan to take their data hostage when employees slip up

By Jack Skinner

President and Founder

Oversee My IT

Small healthcare companies need to rethink their network security as criminal groups use new tactics to take their sensitive data

Ransomware, which was already a problem, is getting worse because technology tools that health businesses are adding, such as remote work, create new places to attack their systems.

In a study of 127 ransomware attacks against healthcare companies between 2016 and 2019, 70 percent were directed at shops with fewer than 500 employees, according to a report from security provider RiskIQ.

That’s because small providers typically have limited safety measures for their data.

Direct patient care facilities like hospitals “are more likely to pay (ransoms) to prevent disruption to patient care,” RiskIQ reported.

Mistakes a growing problem

As Covid-19 makes smaller shops put more data on the Internet, criminals are stealing credentials to break into their web applications.

And while internal actors account for many healthcare breaches, employee error is increasingly how bad guys get their hands on key information.

Some 31 percent of healthcare breaches this year are due to staff mistakes, compared with 22 percent across all industries, according to a Verizon study.

Covid is partly to blame because of stress and fatigue it is causing for people in the field.

But like industries such as finance, security glitches in healthcare often start with problems in workflow, communication, judgment, corporate culture – things that can’t be solved by buying a new technology tool.

How hackers get in

Employees are often unaware of miscues they have made that expose sensitive data to law breakers.

The most common oversight in 2020 is sending emails or paper documents to the wrong people, according to Verizon.

Some 14 percent of cybersecurity professionals say attacks that exploit short-staffed tech and security departments are the elements of the Covid-19 crisis that are most likely to increase risk to their enterprises.

Another is losing track of where key data is stored, such as putting medical records in a file and forgetting where it is.

Technology staffers since 2017 have increasingly left data-storage devices vulnerable on the Internet, according to Verizon.

Researchers forecast a rise phishing emails aimed at stealing credentials from overworked information-technology professionals.

The U.S. Secret Service has warned of emails from criminals posing as officials of the Centers for Disease Control and the World Health Organization.

Ransoms may replace inside jobs

Ransomware will likely rise as organizations add more connections to their networks, whether mobile devices, patient portals and other ways to interact with those they do business with.

As errors open more doors to intruders, healthcare may be seeing a decline in thefts caused by insiders like executives or doctors.

Privilege misuse accounted for 23 percent of attacks on healthcare organizations in 2019, versus 8.7 percent this year.

That may be partly because some companies are getting better at detecting breaches.

This year, organizations with fewer than 1,000 employees have been more likely to discover breaches in days, where big companies more often have taken months or years, according to Verizon data.

How to protect your company

Addressing security gaps on a network requires understanding:

• Devices and technology connected to it
• What data is located where within it
• Protective measures it needs
• Changes or upgrades necessary for regulatory compliance

Even at businesses with fewer than 10 employees, managers are often surprised what security evaluations find in their information systems.

Technology improvements should coincide with updated training for both lay and IT staffers on recognizing criminal behavior and what to do about it.

Audits on how information moves from one employee to another can help spot gaps that hoodlums may target.

These steps should extend to cloud services that providers may use going forward.

Contact Jack Skinner at Info@OverseeMyIT.com.

About Jack:

• President and Founder of Oversee My IT, an Irving-based company that works with small and mid-sized businesses to make their technology trains run on time.
• Launched in 2007, Oversee helps organizations with 10 to 200 employees to run their computers, secure their data and handle compliance.

A trio of power outages in June produced the proof: Firms must plan ahead to keep key information available when nothing else will work

By Jack Skinner

President and Founder

Oversee My IT

• It’s tougher than it sounds to get back in business fast when calamity forces a halt — which is why prior planning can pay off big time.
• Business owners assume that all will be fine in disaster if they back up their data nightly.
• Yet a dentist, say, who needs to reschedule patients can learn that finding his or her contact information may not be as easy as trading in an iPhone for an upgrade.
• Back-ups of that person’s business information can help get their practice back on its feet – something called “disaster recovery.”
• But those back-ups may not give the dentist quick access to people’s phone numbers – creating a reason for customers to go elsewhere if they have toothaches.
• Operating a business as it recovers from misfortune is called “business continuity.”

Why data gets lost

• The issue in small businesses is typically determining what information and software are stored where among a hodge-podge of gadgets, some on-site and some elsewhere.
• Doctors, lawyers and other entrepreneurs may add or change technologies as they go, leaving them unaware of everything they have and where it’s located.
• An earthquake, tornado, flood or even a virus can destroy in-house computers, forcing proprietors to hope that they have copies somewhere of what was on those machines.
• While businesses can reduce risk by storing data in a vendor’s off-site computers – called “the cloud” – this can also create a host of issues.
• For instance, the cloud vendors’ technology may not work with the small fry’s software or in-house computers.
• Large cloud companies may not support technologies the entrepreneur has already purchased from other vendors.
• Doctors, dentists and lawyers may find services they use for sharing large files, such as Dropbox, do not meet security requirements that regulators require.

First step in planning for problems: Learn what’s where

• Getting ready for Murphy’s Law starts with a review of all the hardware and software a business uses, where it’s located and who controls it.
• Whether it’s done by a vendor or an in-house technology chieftain, the assessment must determine:
• All information the business has.
• The hardware and software on which it’s stored.
• What it takes to:
• Operate that hardware and software.
• Retrieve data from it.
• If, say, corporate email is on Gmail accounts, the review may find that no business-continuity planning is necessary for that part
• That’s because Google’s email offering is accessible from most any device and wireless service.

Next, set expectations and budget

• Once the entrepreneur has a clear view of the technologies and data they rely on, the next question becomes what the person expects when given disruptions happen.
• If our dentist loses power for a day, they may not expect to treat patients – but their staffers will need to reach those folks to re-schedule appointments.
• The dentist must also decide how much they’re willing to spend for how much peace of mind.
• For instance, storing off-site data in another state may cost more.
• But it reduces risk because catastrophe is less likely to happen simultaneously in two divergent locations.
• Though planning may involve an up-front expense for help from technology vendors and upgrading tech, the good news is maintaining the finished product can be inexpensive.
• After creating and implementing business-continuity plans, small and mid-sized businesses may pay as little as a few hundred dollars a month to keep it ready.

One bite at a time

• In DFW, tornadoes can wipe out an entrepreneur’s headquarters. Extended power outages, while problematic, usually end in a few days.
• To avoid being overwhelmed with everything that can go wrong, entrepreneurs should start by forging plans for the most likely interruptions.
• Once every quarter after that, they can determine contingencies for problems that may be less likely or that pose fewer business-continuity challenges.
• It’s also important to regularly review the company’s technology set-up to ensure its both cost-effective and will meet business needs as new devices along.
• This check-up should cover:
• Prices its vendors are charging.
• Services they’re delivering.
• Changes in the corporate technology budget.
• Tweaks to accommodate forthcoming changes in hardware, software and connectivity.

The hazards of procrastination

• The silver lining of June’s blackouts is they may teach entrepreneurs the need for business-continuity plans – but without losing their businesses as part of the lesson.
• In addition to natural disasters to which a given geographic region is prone, small firms can be forced into bankruptcy by computer viruses.
• Whether they spring from an employee unknowingly clicking on a malicious link or something deliberate, it’s no fun trying to improvise one’s way through such a crisis.
• Especially for professionals in highly-regulated fields, one’s business, and career, can be at stake.

Contact Jack Skinner at Info@OverseeMyIT.com.

About Jack:

• President and Founder of Oversee My IT, an Irving-based company that works with small and mid-sized businesses make their technology trains run on time.
• Launched in 2007, Oversee helps organizations with 10 to 200 employees to run their computers, secure their data and handle compliance.

By Jack Skinner

President and Founder

Oversee My IT

The problem

• Small companies can avoid negative publicity from digital break-ins by using technology and procedures to ensure the right people in their organizations have access to the right information.
• Quest Diagnostics, a clinical laboratory chain, is one of many large companies to suffer a breach because of security issues at small vendor.
• Details on Quest breach:
• Digital intruders at American Medical Collection Agency, a Quest debt collector, had access to info on 11.9 million Quest patients, such as:
• Social Security numbers
• Certain financial data
• Medical information (but not laboratory tests)
• Though details aren’t yet available on how hackers got into American Medical, breaches typically happen because employees click on innocent-looking links that are actually malicious software.
• Other examples of large hack victims:
• Target
• Home Depot
• Jimmy John’s
• To avoid fines, lawsuits and other expenses that can wipe out small companies, entrepreneurs are well-advised to establish measures like two-factor authentication to help prevent the bad guys from getting in to begin with.

What identity management is, why it’s helpful

• By having employees verify their identities several ways, identity management helps prevent problems from lost passwords.
• Building in multiple layers of security like this allows easy implementation of the management system without interfering with workflows.
• It also helps in detecting breaches and minimizing the impacts those intrusions can cause.

Spend a little now, or a lot later

• As health care regulations do not provide strict guidelines on data security, a number of small health care organizations have little to none.
• Entrepreneurs often believe their companies are too small for hackers to target them. In truth, they can be steppingstones to their large partners.
• Breaches are inevitable and can cost $1.5 million to $5 million or more – a toll small businesses can survive.
• Fortunately, spending a relatively small amount up-front can prevent intrusions – and keep a business happily off the front page.

Contact Jack Skinner at Info@OverseeMyIT.com.

About Jack:

• President and Founder of Oversee My IT, an Irving-based company that works with small and mid-sized businesses make their technology trains run on time.
• Launched in 2007, Oversee helps organizations with 10 to 200 employees to run their computers, secure their data and handle compliance.