How to be prepared for the current and coming threats

By BRETT JAFFEE

To first properly posture and prepare for the existing and future Cybersecurity threats, you must accept the following 5 statements as true.

Ransomware Is Big Business

Between 2016 and 2017, ransomware sales on the dark web grew from $249,287 to $6,237,248, a growth rate of just over 2,500 percent. According to the FBI, ransom payments extorted total about $1 billion in 2016, up from $24 million in 2015. The technique is locking or encrypting files and then demanding ransom. It has evolved from traditional cyber-crime business models of merely stealing data or taking down networks.

Rather than peddle stolen data on the black market, cyber-criminals have opted instead to go direct to the customer, so to speak, which significantly shortens the attack life cycle and overhead and delivers money more quickly.

Not All Hackers Are Created Equal

You can stop most of the bad guys, but not all of them. If China, Russia, or the like want your info, they are going to get it. This is a hard truth of the situation. In addition to having to deploy systems that prevent hackers from getting in, your organization has to be prepared in the event that they do get in.

It Matters to YOU

Your level of compliance to HIPAA requirements matters to your business. In addition to that, how you handle, protect and preserve your customers' non-HIPAA data matters. How you can and do interface with your patients matters. How you can and do interface with your employees matters.

Not All Threats Are External

Many times, hacks or breaches originate from inside an organization. Sometimes intentionally by a company employee with a personal agenda and sometimes unintentionally by a company employee who's simply made a mistake or just exercised poor judgment.

Mother Nature Is Unstoppable

A tornado, earthquake, flood, hurricane or sinkhole that collides with your place of business can be catastrophic to your business and, at best, incredibly disruptive.

After you accept the prior statements as truth, you can begin to adjust your own posture to prepare for what comes. Preparing your organization so well that it is a minor event instead of a major system shutdown, or a public relations nightmare and/or a very costly fix.

Understanding how to shore up your Cybersecurity posture and readiness begins by understanding all your vulnerabilities. Threats come from outside and inside your organization. Training should reflect this. External/internal threats can be both unintentional and intentional and either can be devastating to the organization.

In the event of a business disaster (natural, system, ransomware, grid or otherwise), how fast can your business get back up and running? What needs to be done if/when that happens? What needs to be done before that happens? A business should not be operating today without the answers to these questions. The sad truth for doctors today is that a physician does not have to wonder if they will be targeted. It's a matter of when and how bad it is. Fortunately, the solutions are not at all too difficult to implement.

8 Signs Your Business Is Vulnerable and Unprepared

• Your office does not have a mechanism in place to detect and alert in the event of any cyber breach.
• Your office employees have not been properly trained/instructed to recognize cyberattack/phishing attempts. (Your company has not, in an official way, communicated proper strategies and techniques to protect information assets.)
• Your office has extra levels of security for Privileged Roles (System administrators, HR, CFO, CEO etc.) but your office does not log and monitor privileged activities.
• Your office's backed-up data is stored at the company's central location.
• Your office does not have a tested disaster recovery and business continuity plan.
• Your office does not monitor changes to critical systems and data.
• Your office does not conduct periodic vulnerability assessments of its IT infrastructure, applications and endpoints.
• Your office has no advanced network defense and insider threat mitigation tools in place. (e.g. IDS/IPS, Proxy Servers, Content Filters, Mail Security, APT, DLP).

What should an office do first?

• Get Help! Your office is an expert in what your office does. Find an expert in Cybersecurity or Secure IT and let them map it out for you. Walk you through it. The business is too valuable, and most offices don't have the time and resources to keep up in an area that is not their central focus. Don't ask your electrician to educate themselves on auto repair and then fix your car. Go find a good mechanic first!
• Implement security to get the biggest bang for the buck. Studies show that over 90 percent of cyber incidents could have been prevented if organizations implemented 5 security controls. SANS institute's top 5 controls is a great start. Read here.
• Be realistic in your approach. No matter how knowledgeable and aware your staff is regarding cyber hygiene, and no matter how good your firewall or other security tools, have a good continuous monitoring program to timely detect any incidents you may have.

M Brett Jaffee is VP of Sales for NSG and has over 25 years of experience selling and marketing primarily to Fortune 1000 companies.? Brett began his career with Electronic Selection Systems in 1994. Helping grow their business from 5 employees and 1 million in revenue to 300 employees and 36 million in revenue. Acquired by Thompson Corporation in 1999 and changing their name to AlignMark, Brett opened many new markets, Midwest, West Coast, Southwest, and vertical markets in Retail and Real Estate. Working with General Motors, UPS, Dow Chemical, AT & T, Bank America, and many others, Brett has demonstrated a long history of providing customer solutions.??

After successful stints at HearFromMe.com and WelltalityHealth.com, where Brett was responsible for HIPPA and Data Compliance systems, Brett has brought his experience and protocols to NSG. Visit www.nsgi-hq.com ?