Category: Blog

Can You Spot A Phishing Email?

“Phishing” attacks are mass emails that request confidential information or credentials under pretenses, link to malicious websites or include malware as an attachment.

The average phishing attack costs businesses $1.6 million. The problem with the ongoing increase in the occurrence of cybercrime incidents is that you get desensitized to the whole thing. The fact is that businesses aren’t learning to protect themselves, which is why the number of reported phishing attacks has gone up by 65% in the past few years.

Phishing Is Evolving

“Vishing” is one of the latest variants of phishing being tracked by cybersecurity professionals. Instead of attaching malware to an email and disguising it as say a PDF, cybercriminals specifically disguise it as an audio file, and make it so the email appears to be from an automated voicemail service.

These legitimate services are more and more common in the business world today. When a user receives a voicemail, they also get an accompanying email with a recording of the message for them to review without having to access their voicemail inbox.

What Does A Phishing Email Look Like?

Make sure that you and your staff are on the lookout for suspicious emails, as they are likely part of a phishing scam – but how can you know for sure?

• Watch For Overly Generic Content And Greetings: Cybercriminals will send a large batch of emails. Look for examples like “Dear valued customer.”

• Examine The Entire From Email Address: The first part of the email address may be legitimate, but the last part might be off by a letter or may include a number in the usual domain.

• Look For Urgency Or Demanding Actions: “You’ve won! Click here to redeem a prize,” or “We have your browser history pay now or we are telling your boss.”

• Carefully Check All Links: Mouse over the link and see if the link’s destination matches where the email implies you will be taken.

• Notice Misspellings, Incorrect Grammar, & Odd Phrasing: This might be a deliberate attempt to try and bypass spam filters.

• Don’t Click On Attachments Right Away: Virus containing attachments might have an intriguing message encouraging you to open them such as “Here is the Schedule I promised.”

When you’re not sure if you have the skills or knowledge to get the job done, what can you do? Work with an expert cybersecurity team – Elevate Services Group.

In honor of Cyber Security Awareness Month, Elevate Services Group is offering a free cybersecurity consultation – contact kyle@elevateservicesgroup.com to claim yours.

Like this article? Check out the following blogs to learn more:

The New Ways Cybercriminals Pose a Threat to Organizations

Are You Keeping Up With FINRA’s Cybersecurity Best Practices?

Using Managed IT Services to Save You Money

EHR Vendors Are Dying Out

The healthcare industry has undergone a number of fundamental changes over the past decade. The increased use of wearable medical devices, the now ongoing struggle to defend against ransomware and other cybercrime threats, and on and on.

One change you may not have noticed is how many Electronic Health Record (EHR) software vendors there are. There’s been a growing trend of vendor consolidation in the EHR market, one that’s gone relatively unnoticed when compared to high profile trends in the medical community.

But don’t let that fool you – vendor consolidation will have serious effects on your ambulatory health services practice. Do you know what they are?

The State Of EHR Vendors In 2019

There are less than half as many EHR vendors in operation as there were a decade ago.

According to KLAS Research, an Orem, Utah based IT Review Firm, EHR vendors have dropped from 1000 plus companies 10 years ago, to roughly 400 companies in total today.

“Not enough doctors pay attention to what’s happening with healthcare technology. But there are some who are worried, and they’re worried because they’re aware of the ramifications,” said Libby, president of the Virginia Pediatric Group and a board member of the Physicians Foundation, to Medical Economics.

How Will Vendor Consolidation Affect Your Practice?

As in any economic model, when you decrease competition, it’s often the consumer who suffers:

• Migration Concerns: To start, if your current EHR solution is phased out by a merger, then you’ll have to find a new one. While it’s likely that the vendor that’s consolidating with your current vendor will offer some form of incentive for moving to their solution, that’s not a given. And support for platform migration can vary greatly in quality.
• Lack of Technical` Support: Many physicians are already worried about what this consolidation will mean for levels and quality of available tech support. If you’ve gotten used to dealing with a niche, relatively small vendor, then moving to a much larger one may not result in the same level of service.
• Increased Fees: Again, based on a lack of competition, newly consolidated vendors that have gained a larger market share by acquiring your vendor will have the leverage to charge more in fees.

What Can You Do?

The best way to mitigate the effects that will come with vendor consolidation is to work with an IT company you can rely on. An IT company will be able to :

• Manage vendors, helping you find the most cost-effective option in your market after your current vendor is acquired.
• Provide technical support that you may not get from your next EHR vendor.
• Help to facilitate your migration to avoid any delays or errors.

Like this article? Check out the following blogs to learn more:

The New Ways Cybercriminals Pose a Threat to Organizations

Are You Keeping Up With FINRA’s Cybersecurity Best Practices?

Using Managed IT Services to Save You Money

Cybercrime Methods Accountants Need To Protect Against

The fact is that the cybercrime business has never been bigger – it’s estimated that the global cybercrime industry will cause up to $6 trillion in damages in just a few years.

What Cybercrime Methods Do You Need To Know About?

1. Corporate Account Takeover

Corporate Account Takeover has reportedly caused more than $5 billion in damage in just one year alone. All a hacker has to do is get someone’s login info, impersonate them, and then transfer funds that they’re given control over.

Cybercriminals acquire the log-in credentials through social engineering:

• Phishing: Phishing emails are sent to large numbers of users simultaneously in an attempt to “fish” sensitive information by posing as reputable sources.
• Spear Phishing: This is a much more focused form of phishing. The cybercriminal has either studied up on the group or has gleaned data from social media sites to con users.

2. Identity Theft

Identity Theft complaints rank among the highest logged every to year by the FTC. After gaining your personal information the cybercriminal can then use that info for financial gain:

• Opening a line of credit
• Rent products or property
• Extorting you directly

3. Data Theft

Instead of trying to access your funds, cybercriminals may also opt just to steal your data and sell it directly.

Recently, cyber thieves released a huge list of compromised emails and passwords that contained 773 million records. If your information has ever been breached, it’s most likely on this new list – and that list is for sale on the Dark Web.

4. Ransomware

Ransomware infects the target system with malware that encrypts the data and holds it for ransom. Ransomware penetrates systems either through phishing or through vulnerabilities in many web browsers. Hackers spam users with pop-ups informing them of an “infection” or “security alert” prompting them to click a link, which infects them with the ransomware.

How Can You Protect Against Cybercrime?

Be sure to follow these tips, which are applicable to organizations, employees and individual computer users:

1. Implement Security Solutions

• Email filtering
• Two-factor authentication
• Password management
• Patch/update all IT and security systems
• Manage access and permission levels for all employees.

2. Set A Security Policy

Every organization should set a security policy, including things such as:

• Not opening attachments or clicking on links from an unknown source.
• Not using USB drives on office computers.
• Required security training for all employees.

3. Training For All Users

User education plays a big part in minimizing the danger, so start here:

• Train users on the basics of cyber and email security.
• Train users on how to identify and deal with phishing attacks with New-School Security Awareness Training.
• Implement a reporting system for suspected phishing emails.
• Frequently phish your users to keep awareness in mind.

Like this article? Check out the following blogs to learn more:

The New Ways Cybercriminals Pose a Threat to Organizations

Are You Keeping Up With FINRA’s Cybersecurity Best Practices?

Using Managed IT Services to Save You Money

Key Things to Look for in Your Managed Services SLA

When you hire an MSP, you must sign a service level agreement. Here’s how to evaluate your SLA and ensure you’re getting what you expect from this relationship.  

As if choosing the right managed service provider wasn’t enough, it’s also crucial to make sure that the SLA (service level agreement) you develop between your company and your managed service provider is sound and satisfactory.

Below, we’ll go over what you should expect to see within your managed services contract (SLA). We’ll also discuss how you should review this document with your lawyer to ensure you’re getting the proper value out of this relationship and doing what’s best for your business.

What does an SLA set out to do?

The core goal of a service level agreement between a company and the managed service provider they are hiring is this:

To outline the payment structure and service responsibilities of both parties and to specifically define and document exactly what services the MSP will offer, including what hardware and software is covered, daily monitoring services, troubleshooting services in emergency situations, response times, and more.

Of course, all service level agreements will be slightly different. Some will offer more or less information. Certain SLAs will include information about items such as liability protection for the managed services company. Still others will go into detail about expected performance standards.

What should you look for in your managed services SLA?

Your managed service provider will draw up the service level agreement. Ostensibly, this is a service level agreement they use and have used with all of their clients. It will, of course, be modified to fit the parameters and needs of your business and the unique relationship the MSP has with your business.

However, it should follow a general format. When your MSP shows you the service level agreement they have drawn up, you should expect to see the following:

Services Provided by the MSP

This section will outline exactly what services the MSP will be providing to you on a regular basis. This will often be based on the specific level of service that you have agreed to pay for.

For example, if you own a medium-sized business and the MSP you are working with has three levels of service, you may choose the mid-level of service as you don’t need the extent of services offered to larger businesses.

How Problems Are Managed

The overall services your MSP will provide will be based on daily, monthly, quarterly, etc. services. These are systematic tasks that will be undertaken regularly (such as monitoring security or providing software updates).

On the other hand, your SLA also needs to outline how troubleshooting and problems will be handled by your managed service provider. If you have an issue, for example, you’ll need a protocol for managing:

• Responsibility: What areas of your company’s IT are they (your MSP) managing and monitoring?
• Emergencies: What constitutes an emergency?
• Response Time: If and when you report an emergency, what is the minimum timeframe that your managed service provider will respond within?
• Reporting Method: How do you report an emergency? Will this vary based on the time of day or week? What information do you need to provide?

When Your MSP Is Available

Lastly, your SLA should outline when your MSP will be available on a daily, weekly, and yearly basis. What if you have problems in the evening after business hours? On the weekend? On a holiday? All availability times and any applicable extra charges should be documented.

Going over your SLA with your lawyer

Once you are satisfied with the service level agreement you have been provided with by your MSP, make sure to go over it with your lawyer. They’re on your side and will, therefore, be able to determine if any aspect of the SLA is unfair to you legally or could present potential problems.

Taking your time when reviewing your service level agreement will put your mind at ease and increase the likelihood that you and your managed service provider will enjoy a strong working relationship.

Boost Business with the Cloud

Using the cloud offers a variety of benefits for your business. Find out more about how you can use cloud technology to boost business.  

The cloud has grown in popularity among businesses in all industries. However, if you have not already transferred your business’s data and operations to the cloud, you may wonder if this technology is really in your best interest to expend the time and energy you will need to invest in order to implement cloud computing.

Below are some of the ways the cloud can boost business for your company, making it well worth the investment.

1. The cloud saves you money.

2. The cloud boosts productivity.

3. The cloud improves collaboration.

With the cloud, it is easier to connect with colleagues, share information and work on projects with others. These improvements lead to more collaboration within your company, which in turn improves outcomes.

4. The cloud grows with your company.

Is Your Patient Portal A Security Risk?

As convenient as patient portals are for communication with those you care for, they can also pose serious risks to you and your healthcare organization. Are you sure your patient portal is secure?

A key priority in any effective healthcare organization is keeping in touch with patients. No matter what type of medicine you practice, communicating with patients and allowing them to access their data is a must.

That’s why patient portals are so valuable in the healthcare industry. However, as with any technology that offers access and convenience, it’s vital that you make sure there’s no accompanying security risk.

What Is A Patient Portal?

The patient portal is a secure website through which patients can access their electronic health record (EHR). Additionally, depending on the type of medical practice and software involved, the patient portal may also allow for a range of different associated tasks to be carried out, such as requests for prescription refills, appointment scheduling, and direct messaging.

Why Do Patient Portals Put You At Risk?

This is the case with any technology that provides access in a convenient manner. A fundamental ongoing battle in consumer technology is between security and convenience.

The fact is that greater security often means less convenience – albeit, in small ways. Regardless, when it comes to something like a patient portal, the priority is usually to enhance the user experience, rather than configure the best security settings possible.

Here’s a basic example – when it comes to Wi-Fi connectivity settings, would you prioritize security or convenience? On one hand, it’s much more convenient to users if the device in question is configured to automatically connect to open and available Wi-Fi hot spots.

But that’s not very secure, is it?

Are Patient Portals Actually Exposing Patient Data?

In a word? Yes.

2019 is a landmark year for the lack of security around patient data, with more than 25 million patient records breached in the last 6 months alone. This is more than a 66% increase when compared just to 2018.

What Does HIPAA Say About Patient Portal Security?

HIPAA, as you likely know, is not often as specific in its stipulations as you might like. If you’re subject to HIPAA, then you’re expected to employ security measures that reasonably and appropriately meet the HIPAA Security Rule standards and implementation specifications.

What does that mean?

Due to the statistics stated above, these portals have been neither reasonable nor appropriate – in other words, just having a portal with a login isn’t enough. How do you beef up that security to become ‘reasonable and appropriate’? Keep reading.

In the report, “The State of Patient Identity Management”, the surveyed healthcare organizations reported using the following security measures in patient portal authentication processes:

• Username and password (93%)
• Knowledge-based authentication questions and answers (39%)
• Email verification (38%)

While that could be considered the standard when it comes to protecting access to patient portal data, if one of these surveyed organizations were to experience a breach, it would be proven otherwise.

The good news is, you can do more to protect your patients’ data.

What Can I Do To Secure Patient Portal Access?

One of the best ways to add security to user authentication processes is with Multi-factor Authentication (MFA). MFA requires the user to utilize two methods to confirm that they are the rightful account owner.

There are three categories of information that can be used in this process:

• Something you have: Includes a mobile phone, app, or generated code
• Something you know: A family member’s name, city of birth, pin, or phrase
• Something you are: Includes fingerprints and facial recognition

How Does A Multi-Factor Authentication Solution Work?

1. User logs into the session with primary credentials.
2. The session host validates credentials with Active Directory.
3. Then, it sends credential validation to the cloud via the login app.
4. The MFA client sends its secondary authentication to the user. User approves.
5. The MFA client sends approval back to the session host via the login app.
6. The user accesses their session very securely.

Though MFA does make it harder for the account owner to access the account, it also makes it difficult for cybercriminals to gain access to patient data. Their job becomes much tougher because they now need to do more than just hack the user’s password. They’ll need personal information about the account owner as well.

With so many accounts being too easy to break into, hackers are more likely to just move on instead of trying to break through the multiple factor authentication process.

Like this article? Check out the following blogs to learn more:

A World of Possibilities for Law Students and Young Lawyers