Cyberattacks are continuing at an alarming rate, and we see practices being victimized regularly. Hackers are now encrypting and stealing data, forcing the practice to pay the ransom to avoid having their patient data made public.
In many cases, the owners or managers of a practice do not fully understand the significant operational, financial, emotional, and reputational impacts of a cyberattack. While it is easy to dismiss the potential threats or rely on an IT company, this is often insufficient. IT companies cannot provide the advanced security required to protect healthcare offices from sophisticated hackers.
The moment any staff member connects to the internet, there is an inherent risk. Practice managers often say, “I have multiple local and cloud backups, so if I get hit with ransomware, it will be easy to recover.”
Cybersecurity is not just about recovery. It is about protecting highly confidential practice and patient information. In most of the cyber-attacks we have worked on, the hackers have stolen most or all of the victim’s data and either threatened to release or actually released the data.
Can you afford to close your doors for 2-3 weeks while this is investigated and remediation is performed? Would your practice survive financially, reputationally, and operationally from this type of attack?
Let’s review the top 10 ways you can minimize the chance of attack against your practice.
10. STRONG, UNIQUE PASSWORDS AND PASSWORD MANAGERS
Utilize password management tools to create and manage strong passwords. If you opt not to use a password manager, make sure you create unique passwords for every website and application you use with a minimum of 14 characters, including a combination of numbers, letters, and special characters.
9. MULTI-FACTOR AUTHENTICATION
Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA) is a powerful tool that utilizes SMS text messaging or a security APP such as Google Authenticator to validate your login.
8. ENCRYPTING DATA AT REST
A tool such as Microsoft BitLocker can help protect data at rest from exploitation. BitLocker encrypts all the data on your hard drive so that if the device is lost or stolen, a criminal cannot access the contents.
7. ONLINE AND OFFLINE BACKUP PRACTICES SHOULD USE ONLINE AND OFFLINE BACKUPS.
You typically do online backups in the Cloud. Every week, you should copy all your data to an external hard drive and always physically disconnect the hard drive from the network.
6. SECURITY RISK ASSESSMENT
A Security Risk Assessment (SRA), conducted by a credentialed security expert, helps a practice identify and understand where it has operational risk.
5. CYBERSECURITY AWARENESS TRAINING
Cybersecurity awareness training empowers all employees to identify and mitigate attacks that occur through phishing, spear phishing, vishing, business email compromise, etc.
4. INTERNAL AND EXTERNAL VULNERABILITY MANAGEMENT
Devices, software, computers, and firewalls all have vulnerabilities (think of these as “unlocked doors and windows” on your network) that hackers can potentially exploit. Firewalls should be scanned at least monthly, and computers scanned daily.
3. PENETRATION TESTING
An ethical hacker, who assumes the role of a criminal, will perform a penetration test, and attempt to breach your network and/or data; this must be conducted at least annually.
2. EXTENDED DETECTION AND RESPONSE (XDR)
XDR software is the next generation of “anti-virus” technology that helps organizations minimize their exposure to cyber events. It typically utilizes Artificial Intelligence (AI) and is designed to act on its own by “killing” malicious code and isolating computers.
1. SEEK A SPECIALIST... NOT A GENERALIST
One of the most significant mistakes practices make is relying on a generalist like an IT company or Managed Service Provider (MSP) for security. Most IT companies and MSPs specialize in building and maintaining networks, not cybersecurity. It would be best if you worked with a cybersecurity specialist with advanced training, tools, and certifications to ensure that your network is properly secured.
*
Taking these steps and providing your doctors and staff with the knowledge to identify potential risks can significantly reduce the chances of your practice being the victim of ransomware or a cyberattack
About the Author
As the CEO and co-founder of Black Talon Security, Gary Salman is dedicated to data security and understanding the latest trends in the industry, particularly as they relate to healthcare. He has decades of experience in software development and computer IT and developed one of the very first Cloudbased healthcare systems.
As a sought-after speaker and writer, Gary also lectures nationally on cybersecurity threats and their impact on the healthcare industry. He has lectured and trained tens of thousands of practices across the U.S. on how to maintain “best practices” in cybersecurity and has been featured in over 70 national publications and news stories in the medical, dental, legal, and financial industries. In addition, Gary has over 17 years as an instructor at West Point and is involved in law enforcement. He is also a member of InfraGard.