Interesting New Computer Technologies for your Practice. Steve McEvoy October 9 th, 2014 Paradise Island, Bahamas

Transcription

1 Interesting New Computer Technologies for your Practice Steve McEvoy October 9 th, 2014 Paradise Island, Bahamas

2 Goals

3 Just so you know

4 Stealing Your Data

5 Today s Challenge Office Network Firewall

6 IP Address Your Internet Phone Number Four numbers separated by periods Each number can range from 0 to to ~4.3 billion usable addresses We have run out already

7 The Monday from Hell

8 Cryptolocker Virus

9 What Started it All

10 Doggie Door

11 What was going on Brute Force Attack Attempting to login via RDP Guessing at well know user names Once Logged in Trashes the Server Deletes all the backups Disables all access Encrypts all files (forever) Displays message demanding money

12 Security Logs

13 Security Logs

14 Lookup the Phone Number

15 DecryptCryptoLocker Culprit was caught White Hat Hackers have built a tool to unlock the encrypted files for free

16 Buttoning Up

17 Security through Obscurity Don t answer the phone Set the firewall/router to NOT respond to pings

18 Restrict Remote Management Turn off the firewall/routers ability to be remotely managed from the Internet side Office Network Firewall Internet

19 Close the Doors Close ALL externally open firewall ports (like RDP) if possible Use alternate (smarter) solutions LogMeIn for remote access from a web browser Use a mobile VPN solution if sticking with RDP

20 Keep your Firewall in Top Shape Annual Review of Configuration Have things changed in your network? Annual Firmware Update Keeps the latest brains in place Password Use a really hard password for this device If really old - Consider Replacement I like the Watchguard XTM-25

21 Simple Workstation Security Make sure the built-in Windows Firewall is turned ON This could break stuff so adjust as needed Passwords No Wimpy Passwords Set the Local Administrator password Look for Rogue local accounts Disable Guest Login

22 Protect Your Data Offsite Backup Regular and Routine Enable Internal Application Passwords If access to the computer is compromised, access to the critical data still has another layer of protection Practice Management QuickBooks What else?

23 Other Weak Spots?

24

25 Guest WiFi Access

26 Disgruntled Employee

27 Hacker

28 Protect Your WiFi Turn off the Guest WiFi when closed Automatic or even pull the plug Have a password for the Guest zone Change it monthly Use best WiFi encryption WPA2 Change the Private WiFi password immediately if someone is fired

29 When someone is Fired Immediately Delete/Disable/Change any specific user accounts they had On the Network to Login Within your Practice Management App Anything else (QuickBooks, etc.) I d suggest doing this during the termination meeting Change any other password they MIGHT have known

30 Strangers in our Midst

31 Simple Workstation Security Train the Staff to lock the console as they walk away Windows + L Set the Screen Saver to kick in after 10 minutes and lock automatically Train the staff to close out of all their open applications and log off the computer at the end of the day

32 If I had Physical access.

33 What s Next?

34 HIPAA Health Insurance Portability & Accountability Act Hype Induced Panic And Apathy

35 Tales of HIPAA

36 Subject: HIPAA Violation To whom this may concern: I was appalled when I came across this on the internet while I'm searching for an upcoming RFP I recently posted for my job. I'm angered by your office's non-compliance with the HIPAA Privacy Rule. I demand that you look into this within the next 48 hours and take the necessary action to take this information down online. Here's the link: ftp://...pdf As Bad as it Gets Please call me upon receipt of this .

37 As Bad as it Gets To: MME Subject: URGENT : Fwd: HIPAA Violation HELP! Whats going on there? Can you look into this ASAP and let me know. I just called you all and you are closed. I have called the patient immediately to let her know that we will take care of this. Also how do we erase this info on the web? Also is this the only patient, or is everyones data out there on the web. How do we erase that info on the search engines? Please call me when you get this Please do not contact the patient directly. I am trying to help the situation on this end.

38 As Bad as it Gets Thanks, Dr. X Personal Data - Privacy Act of 1974 (PL ) This transmission is intended to be confidential to the individual(s) and/ or entity to whom addressed. It may contain information of a privileged and/or confidential nature, which may be subject to protection under the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act (HIPAA) of In the event you are not the intended recipient or the agent of the intended recipient, or you are unable to deliver this communication to the intended recipient, do not read, copy, or use this information contained within this transmission, or allow it to be read, copied or utilized in any manner, by any other person(s). Should this transmission be received in error or there is a problem with the transmission, please notify the above named sender immediately.

39 As Bad as it Gets 1. We have confirmed that a device on your computer network was exposed to the internet. It contained a backup of your Server s data. 2. The device was the Buffalo Network Attached Storage (NAS) on internal IP Address of xxx.xxx.xxx.6. I believe this in the closet above the X-ray PC. 3. This NAS was configured to allow anonymous connections via the FTP protocol. 4. The NAS had a default username and password configured. 5. The Comcast Business Gateway Router was ALSO configured to this device to allow for FTP communications. 6. Google bots automatically discovered the FTP Site and crawled the NAS for information. 7. This information was published to Google through their normal searching methods.

40 As Bad as it Gets 28,000+ files were exposed Of those: 464 files were Adobe PDFs 7 were Microsoft Word format 698 were Rich Text Format (RTF) The information had been on the web for over a year!

41 Maybe there is Hope. Sutter Hospital had a computer with 3.3 million patients information on it stolen Lawsuit wanted ~$4 Billion!!! The court decided it has not been shown. that any unauthorized persons have actually viewed the contents of the hard drive, a fact that deprives the patients of grounds to seek civil damages

42 AAO CTech

43 Best Practices Good Idea to Safeguard Patient Data Reasonable Precautions Policy Consider what you need to do Decide on what you are going to do Write it down Do it! Document its done (periodically) Watch for my 2015 Lectures and Blogs

44 Floppy s are Dead

45 CD s are Dead

46 DVD s are Mostly Dead

47 Thumb Drives are Mostly Dead

48 Personal Online Storage is Alive

49 Dropbox Add-on to Windows Mac istuff (ipad, iphone, itouch) Android (Droid, etc) Accessible from the Dropbox Website You are always near your files, even without your device

50 Dropbox Great way to shuffle data between diverse platforms (like PC and ipad) Great way to sync files between multiple devices (Images at home and work) Acting a bit like an Internet Backup Each of your devices has a copy too!

51 Dropbox Laptop Home PC Web Browser Internet Office PC iphone, ipad, Android Data File

52 Dropbox Costs 2GB Account is Free! Enough for most peoples basic needs Pro Account 1TB (1000 GB)!! $10 per month, or $100 per year

53 How can I get Pictures off My Phone?

54 Windows XP is Dead!

55 Windows XP is Dead Microsoft ended Product support on April 8 th, 2014 No more Security Patches HIPAA says No un-patched OS s Thus, XP is no longer HIPAA compliant

56 My Opinion Load of Crap There are 1,000 s of unpatched Windows 7 and 8 systems out there because they have Windows Updates turned off. Vendors are taking advantage of this

57 Taking Advantage Software Vendors An opportunity to push you off old slow PCs Their software will run better on faster stuff IT Vendors Scaring you into replacing those PCs to generate new work for themselves

58 My Recommendations XP Laptop used in Public Don t do it. Upgrade or Replace Run your existing XP boxes to the normal end of life 5 to 7 years old max. Run the same OS everywhere if possible Your staff will appreciate this

59 Windows Server 2003 is Mostly Dead!

60 Server 2003 is Mostly Dead Microsoft will be ending Product support in July 2015 No more Security Patches HIPAA says No un-patched OS s Thus it is no longer HIPAA compliant

61 My Opinion The HIPAA premise is a Load of Crap You should have replaced this system LONG ago! This is your SERVER!

62 My Recommendations Talk to your IT person and plan to replace the Server with one running Windows Server 2012 R2 ASAP.

63 Best way to make a computer FAST?

64 Solid State Hard Drive

65 SSD Facts Old fashioned hard drives have spinning parts Usually 5400 or 7200 rpm They wear out Typically transfer at 70 MB per sec SSD drives No moving parts Great for battery life (laptops) Good ones Transfer at nearly 500 MB per sec

66 SSD Choices Not all SSDs are the Same Look for OPAL (helps with Encryption) Samsung and Intel make great drives Samsung 840/850 Pro Series Pro Series means OPAL (EVO series does not) 120GB ~$ GB ~$179 ($140 on sale!) Buy any new PCs with an SSD!

67 blog.mmeconsulting.com

68 AAO Technology Blog AAOTechBlog.com

69 Thank You! Presentation online at