Heat Up Your Human Firewall With Security Awareness

You may have already had a network firewall to fend off malicious entry. How well-trained are your gatekeepers; i.e., your human firewall?

This article highlights some things you can do to make sure your system users can understand intrusion risks from other sources like email and malicious links.

Whether your organization is a covered entity or business associate, the HIPAA umbrella casts a long shadow. Information breaches bring strong sanctions, even in the “Unknowing” category–with a maximum of $50,000 per violation up to $1.5 million annually. The fines and administrative penalties following a hack or unauthorized discloser are somewhat akin to receiving a traffic ticket following an accident that totals your vehicle after you have loaned it to an inexperienced driver.

Security measures are only the beginning

Your personal health record data is undoubtedly protected in secure servers. You employ malware and virus protection, because you know just how valuable medical records are to the cyber underworld. So the protection may be in the engine, but what about the users at the wheel?

Cyber attacks don’t always depend on backdoor intrusions through vulnerable websites or Internet browsers. For example, this LA Times online story chronicles how 108 county employees opened a phishing email and provided user names and password to their accounts, “some of which contained confidential patient or client information…”

Yes, county officials said “they have strengthened security measures…and enhanced employee training…” but that is scant consolation to the 756,000 people whose names, addresses, dates of birth, Social Security numbers, financial information and medical records ended up in the hands of a Nigerian scammer.

User Training is essential…

So protecting files is not the same thing as protecting access to them. The LA County incident illustrates several points made in this Health IT Security.com online article by Bill Kleyman:

End-user awareness of underlying security is no more complicated than learning how to identify the threats. Kleyman advises educating employees in what they should not do, i.e.:

• Don’t open attachments on emails from strangers. If the email is from someone they know, check with the send before opening the attachment. (Even then, the “friend” could be passing along something infected.)

• Don’t–that is, never–click on embedded link in emails from strangers. Check the link out by hovering your cursor over the link. If it looks suspicious, leave it alone and look online for suspicious cyber threat indicators.

• Don’t plug in USB peripheral devices that have not been scanned. Hackers have been known to place infected USB thumb drives in parking lots, relying on the natural curiosity of those who would foolishly plug them into their network computer.

• Don’t log into health care accounts from unsecured mobile wireless locations. Hackers hang out at coffee shops and other public areas with Wifi access and can glean usernames and passwords from mobile devices.

In the do category, Kleyman recommends:

• Do pay attention to regular data backups and do them offline. In the case of ransomware, backups might be the only way to restore blocked data.
• Do use anti-malware software that downloads periodic updates to keep up with the emerging threats.

• Do hold security workshops “with different user-focused themes.” This, according to Kleyman promotes positive interaction with the end-user community and keeps security awareness at the forefront.

Curious to learn more? Contact your local managed IT service provider?