Orthotown September 2021 - 62

Take action
What do you do to defend your vulnerable
assets from these threats? Implement
controls, which are actions, devices, procedures
or techniques that remove or reduce
a vulnerability. The keys to cybersecurity,
controls can make vulnerabilities difficult
for attackers to exploit when used in depth.
In the orthodontic world, an asset would
be your patient's tooth. A vulnerability would
be the weakening of the tooth's enamel,
making it susceptible to cavities. A threat
would be a diet filled with sugary foods and
drinks. Protection controls would be regular
checkups and cleanings, reducing sugar
consumption, brushing, flossing and using
mouthwash. You don't expect your patients
to only receive regular checkups and skip
the rest. To protect from cavities and gum
disease, there's not just one silver bullet your
patients use. Good hygiene defense consists
of overlapping protection. In cyber defense,
it's similar-but on steroids.
Get control
There are three types of cybersecurity
controls: physical, administrative and
technical.
Most office managers understand the
basics of physical security; things like
locking the front door at night and not letting
patients in the back office are commonly
done without thinking. However, have you
also considered securing computers with a
cable if left out overnight? Who has access
to your server room? Is it even locked?
We have a saying in the cyber world:
" Physical access trumps everything. " With
physical access to any computing device, a
hacker can break into and access your data,
regardless of other control categories you
may have implemented. A lost or stolen
computer is more than the loss of an $800
laptop; if that laptop contains protected
health information, it's a reportable breach.
Because all dental offices fall under
HIPAA, protecting patient information
begins with physical controls, such as adding
privacy screens to staff monitors and not
leaving passwords out in the open. (In one
instance, in a health care office, the front
62 SEPTEMBER 2021 // orthotown.com
desk computer had a sticky note attached
to the screen in plain sight with its login
username and password, leading to easy
access to all patient health information!)
Check these areas
* Many offices allow patients to log in
to a free Wi-Fi network. If you do,
have your IT department separate
and secure the guest network. Wi-Fi
in general is unsecure, but allowing
anyone onto the same network as the
administration is outright dangerous.
* Most people don't consider the network
printer, which has many default
settings that make it easily hackable.
Restrict printer access to only known
office devices or require a password
for printer usage to reduce the risk.
Administrative efforts
Even when technical controls are strong,
sometimes the easiest avenue into your data
is through your employees. Can everyone
on your staff identify a phishing email?
Do they understand the social engineering
involved with wire fraud? Are they familiar
with basic password hygiene, the dangers
of short passwords and password reuse?
What would they do if they found a USB
device in the lobby? Administrative security,
one often-neglected control category, consists
of documented policies.
* Every employee should read and sign
a computer acceptable-use agreement
that sets guidelines and expectations
of what's allowed on the office
network.
* Password policies should allow for
strong, unique passwords.
* Each office should have a
documented backup policy to
preserve important data, which sets
the frequency and type of the backup.
An alternative location for local
backups, like a cloud backup, should
be included. This prevents losing all
your data because of flood or fire at
the office. Yes, these things may be
inconvenient, but ransomware is even
more inconvenient.
Doing the most with the least
You should implement a " least privilege "
policy, which gives people access to only
the resources they need to accomplish their
tasks. Only certain employees should have
administrative access to their computers,
for example.
Here's how to see if users have the proper
permissions: In a Windows search bar, type
" cmd, " which pulls up a suggested application
called Command Tool. Right-click over the
app and choose " Run as administrator. " If
a command tool window pops up without
asking for the administrator password, then
you are not running with least privilege.
This is one of the biggest problems we see
with a new client.
Other administrative controls are policies
that are in place to protect your business:
* Your office should have a contingency
plan, a disaster recovery plan and an
emergency operations plan.
* An incident response plan-the
documented actions to implement
should your office be hit with
malware-should also be required.
Creating these plans may seem like a
waste of time, but if there are ever major
problems, these policies will prepare your
office to swim rather than sink under the
flood of adversity.
Tools to have
Technical security controls-what most
people consider to be cybersecurity-are just
one leg of the stool. Antivirus software is
the most well-known control.
People often ask which antivirus software
we recommend and believe it or not, we
think Microsoft Defender is usually all most
practices need. Defender has become one
of the best, and it integrates well with other
tools. For those watching the bottom line,
it's free, so you can use that extra money
to implement the technical controls you
are missing.
Firewalls are probably the second-most
well-known technical control. All ports
not actively being used should be closed.
Cybercriminals regularly scan the internet
for open ports used by unsecure protocols.
http://www.orthotown.com
Orthotown September 2021

Table of Contents for the Digital Edition of Orthotown September 2021
