CRC can now backup your G Suite (formally Google Apps) mailboxes. We would recommend this to our clients that are using gsuite for their email needs. Please email help@crctechs.com for pricing information.

Educate new employees: We have assisted twice in the last month with infections that hit the server that were due to new employees downloading infected email attachment. You may have drilled in your security policy with your current employees but new employees might be too trusting and open attachments from people they don’t know or afraid to ask the questions. Continue cyber security education in your office meetings and have your employees review and sign your security policy on their first day.

Credit card machines: At Def Con we saw a talk on how to hack into a credit card machine. It takes about 15 minutes. Ideally your credit card machine would be on a phone line in your office and put in a safe inaccessible location when it’s not being monitored. If it’s plugged into the internet, it should be segmented from the network. If your practice management requires you to have it attached to your network for integration with your software, extra security controls and policy need to be put in place to be PCI compliant and secure. Contact us at help@crctechs.com for recommendations.

Email: Most data breaches continue to start with emails that look unsuspecting. These emails can look like they are from people you may recognize but whose accounts have been compromised by the bad guys. They can come in as a resume for a position you have open but it’s really a Microsoft Word document with a virus imbedded. They can also come from what looks like companies you trust like google asking for your account information for a add-on or to open a “encrypted” email from someone you supposedly know. They also come as fake emails from delivery companies like FedEx and UPS. How do you combat this threat?
– Check non-PHI attachments on virustotal.com. This site will scan attachments with over 40 different virus scanners.
– Call to verify the sender did indeed attach something for you to open. If you weren’t expecting a email with an attachment from a known contact, double check that it’s legit. A phone call is quick… restoring your data form a virus attack is not.
-Use your Spidey senses. If it doesn’t look right, feel free to contact CRC to take a look!

Misleading tech support: Fake tech support continues to trick people into letting them onto their computer remotely. They will try to get you to give them your credit card number and install software on your computer. If you have a screen that pops up on your computer telling you your computer is infected and to call a phone number to resolve the issue, contact CRC immediately. We can confirm it’s not a virus and get you back up and going quickly.

Feel free to contact CRC if you have any questions on how to further lock down your network. We can schedule a call with you and one of our techs.

If it looks odd.. it might very well be.. call us right away and we can help verify its legitimacy

CRC also recycles your hardware through two different electronics recyclers. Interconnection, for example, destroys the data on the hard drives with a high level of destruction and then reuses the computer hardware for low-income families and students, schools & libraries, nonprofit organizations, disaster relief or computer grants. HIPAA sensitive hard drives are shredded and the certificate of destruction is kept at CRC and documented in your client files.

Antivirus on your router has become a necessary layer of protection for your office. Our techs can configure AV on your router as well as block the ransomware virus from reaching outside your network as part of the encryption process. Antivirus for the router can be purchased directly from DELL with the assistance from a CRC tech. Please email us at help@crctechs.com to ask about pricing and to get this configured for you. *Please note, CRC does not mark this up for resell. We feel this is an important addition to your security and will assist with the purchase.

Ransomware could be considered a breach and require HIPAA breach notification under some circumstances. If you do become infected with ransomware you may need to prove that the patient data was not acquired or viewed in reference to HIPAA CFR 164.402(2). CRC offers advanced web filtering that would help satisfy this need. It can log large amounts of data from specific workstations being uploaded to the internet. As a bonus, it can just allow certain websites to be accessed on the network so you have more control over staff internet browsing. This has a cost of $2 per workstation a month.

Aggressive spam filtering can be turned on for your Google Apps account. If you are using Google Apps for your email, please request this feature to be enabled. This will require a dedicated person from your office to check the admin quarantine for filtered email but it totally blocks spam and potentially infected email from reaching your office computers.

Non-PHI Email attachments that you are leery of opening can be checked at https://www.virustotal.com. This is a great site that scans a file with over 60 different popular virus scanners.

Lock down your remote access! If you are using LogMeIn for remote access to your office computers, make sure you have 2-Factor authentication enabled. This means along with your password to logon to your LogMeIn account, LogMeIn emails or texts you a secondary pass code or you have a app on your phone that generates a secondary passcode for you also.

If you have any questions or need assistance with any of the above recommendations, please email us at help@crctechs.com

We have all heard about the sophisticated malware responsible for the wave of data breaches that began last year with Target and recently included Home Depot and JPMorgan Chase, but the question that many people fail to ask is how did the malware necessary to perpetrate these major data breaches get downloaded into the seemingly secure computers of major companies and government agencies?

The answer in almost every instance is the same. It is done through a technique called phishing. Phishing occurs when someone receives an e-mail that lures the person receiving the e-mail into downloading an attachment with malware or clicking on a link within the e-mail that automatically downloads keystroke-logging malware that enables the hacker to steal all of the information from the computer of the unwitting receiver of the e-mail. Generally among the information in the victim’s computers are the passwords and other keys required to open the company’s or agency’s data banks. Often in major data breaches, the phishing is aimed, as it was with Target, at a third-party vendor that works with and has computer access to the real intended victim.

At one time, phishing e-mails appealed to standard subjects that interest people at work with roaming minds, such as free video games, music or pornography. According to The Washington Post, the 2005 massive data breach of information broker LexisNexis was caused by a Florida police officer at work who clicked on a link in an e-mail promising pornography and ended up downloading malware that enabled the hackers to steal the police department’s password and login information to provide access to LexisNexis’ data banks.

Today, although those techniques are still used and still work, phishing has gotten more sophisticated. Often the e-mails are made to appear as if they come from upper-level management of the targeted company. LinkedIn, the popular social networking service site, is a source of information that can be manipulated to aid hackers in creating special phishing e-mails using the names of specific people within the company.

When phishing e-mails are done with this extra level of specificity of having the exact names of intended victims as well as precise names of people trusted by the victims, it is called spear phishing. Hackers will look up a company on LinkedIn and find profiles for individual employees of the company. Many of these listings include the employee’s e-mail address.

After viewing a few employee profiles a hacker can determine the protocol used for e-mails within the company, such as the initial of the first name, last name and company name, such as jsmith@companyname.com. Using this information, the hacker can send a legitimate-appearing e-mail to a company employee that looks like it comes from within the company, luring the real employee to either click on a tainted link or enter a username and password. This can be used to either directly install malware on to the company’s computers through the tainted link or get access through the user name and password of the victimized employee. From there it is an easy task to install malware to steal information from the company.

Phishing e-mails can be easily be made to appear as if they are coming from legitimate sources, such as banks, government agencies, insurance companies or myriad companies with which you do business. It takes little talent to create a counterfeit logo on an e-mail to make the e-mail look official. Identity thieves and hackers have a knowledge of psychology that would have made Freud envious and they know how to lure us into linking on malware infected links and download malware infected attachments. Although sometimes the target of these hackers is access to bigger fish, such as the company for which you work, sometimes the target is you personally.

One of the biggest fallouts from the recent hacking of JPMorgan Chase was the theft of e-mail addresses and names of JPMorgan Chase customers thus making those customers prime targets for spear phishing. JPMorgan Chase customers can well expect to receive e-mails that very much appear to come from JPMorgan Chase directed to them personally by name.

These e-mails may even appear to be sent in response to the recent hacking and warn the customer of new problems that require the customer to either click on a link for protection or provide information to receive personal assistance in protecting their account. Unfortunately, people clicking on these links or providing the requested information will end up becoming victims of identity theft.

The rule to follow is to never click on links in e-mails or download attachments unless you are absolutely sure that they are legitimate. The risk is too great. Also, never provide personal information in response to an e-mail that you receive. You cannot be sure that the e-mail is legitimate. Trust me, you can’t trust anyone. If you think that possibly the e-mail may be legitimate, call the company or agency at a telephone number that you know is correct to inquire about the e-mail. It may seem paranoid, but remember, even paranoids have enemies.

Steve Weisman is a lawyer, a professor at Bentley University and one of the country’s leading experts in scams and identity theft. He writes the blog www.scamicide.com and his new book is Identity Theft Alert.

NEW YORK/BOSTON (Reuters) – Your medical information is worth 10 times more than your credit card number on the black market.

Last month, the FBI warned healthcare providers to guard against cyber attacks after one of the largest U.S. hospital operators, Community Health Systems Inc, said Chinese hackers had broken into its computer network and stolen the personal information of 4.5 million patients.

Security experts say cyber criminals are increasingly targeting the $3 trillion U.S. healthcare industry, which has many companies still reliant on aging computer systems that do not use the latest security features.

“As attackers discover new methods to make money, the healthcare industry is becoming a much riper target because of the ability to sell large batches of personal data for profit,” said Dave Kennedy, an expert on healthcare security and CEO of TrustedSEC LLC. “Hospitals have low security, so it’s relatively easy for these hackers to get a large amount of personal data for medical fraud.”

Interviews with nearly a dozen healthcare executives, cybersecurity investigators and fraud experts provide a detailed account of the underground market for stolen patient data.

The data for sale includes names, birth dates, policy numbers, diagnosis codes and billing information. Fraudsters use this data to create fake IDs to buy medical equipment or drugs that can be resold, or they combine a patient number with a false provider number and file made-up claims with insurers, according to experts who have investigated cyber attacks on healthcare organizations.

Medical identity theft is often not immediately identified by a patient or their provider, giving criminals years to milk such credentials. That makes medical data more valuable than credit cards, which tend to be quickly canceled by banks once fraud is detected.

Stolen health credentials can go for $10 each, about 10 or 20 times the value of a U.S. credit card number, according to Don Jackson, director of threat intelligence at PhishLabs, a cyber crime protection company. He obtained the data by monitoring underground exchanges where hackers sell the information.

Read More