Few things are as frightening to an IT professional as seeing some variation of a ransomware message on a computer they manage. A recent U.S. Government interagency report indicates that, on average, there have been 4,000 ransomware attacks daily since early 2016 (a 300% increase over attacks reported in 2015). And when your network is host to protected patient health information, the consequences of a compromised system affect more than just normal system administration. HIPAA mandates entities must notify affected individuals in written form. And for breaches affecting 500 or more individuals, that organization is required to "provide notice to prominent media outlets" in the state or jurisdiction where the breach occurred.
The outbreak of WannaCrypt2 and Nyetya ransomware has caused security policies to fall under scrutiny, showing the importance of taking a proactive approach to IT security. For all the damage WannaCrypt caused, it does not leverage an unknown, 0-day exploit never seen in the wild. On the contrary, it uses a vulnerability that was released and patched 2 months prior to its release.
This should drive home the need for a proactive approach to security. A proactive policy should:
When IMS is given the opportunity to manage and maintain a Hugs (Infant Security) system, we put great effort into implementing a proactive approach by keeping you informed of current security threats and prevention. We strive to keep the systems we maintain secure through a policy of regular patching, maintaining secure configuration policies, and minimizing the vulnerable surface for exploitation. While maintaining security is challenging enough when working with systems within our organization, maintaining outside systems requires additional consideration. Whether it's remote access, policies outside of our control, or achieving effective communication with the end users, we take pride in providing the highest level of security possible within the organizations we service.
At IMS, we take these challenges head on and have implemented a fully HIPAA-compliant, secure remote access solution. This solution allows us each month to safely connect to our customers and perform necessary maintenance while backing up critical data. Throughout the process, we put a strong emphasis on remaining in communication with the end users and keeping them aware of any impact our activity will have on their systems. We are very conscious of the need to maintain uptime and, when necessary, make sure the customers are prepared for downtime. Using these policies and goals as guide posts we are able to effectively work with our customers and achieve a secure environment.