In order to further improve and simplify our lives and our businesses, we are going all out to incorporate as many technological innovations to improve our operations and processes. By trying to incorporate new technology without fully understanding the potential consequences of our decision, we are left vulnerable to issues such as compromised security and safety of our operations and processes. Threats from cybersecurity are continuously on the rise with new and sophisticated techniques being employed to breach the security of your systems and access restricted data not for public consumption.
Nearly every healthcare organization has moved towards EHRs, which has revolutionized patient care. With all the patient data available in an EHR, it has greatly helped physicians in delivering improved healthcare services especially tailored to a particular patient’s needs.
With the integration of technology having helped improve the quality of healthcare, it has also made the healthcare organizations increasingly vulnerable to the risk of compromising sensitive patient data stored on EHRs through both external and internal threats.
Business Email Compromise (BEC) is one of the most pressing threats to the healthcare industry. This threat has the potential to provide the one initiating it with an opportunity to significantly damage the company by embezzling money from either the employees of the company, its customers, or its partners. If the attackers are successful in their endeavor it will cause irreparable damage to company’s reputation. The most common example of initiating this kind of attack is by creating an email id closely matching/resembling that of your company’s corporate network, which is then used to get access to sensitive data. Here are a few other examples:
- By gaining access to an employee account, it can then be used to call for changes in the way payments are made by the payee all in an effort to transferring official funds to the attackers account. These invoicing scams are commonly used to siphon company funds to the attacker’s personal account.
- The other commonly used technique is to impersonate the CEO of the company and request employees from either the HR or finance department to do attacker’s bidding which would in the normal course of business be considered illegal.
- If the account of one of the employees is compromised it can then be used for sending fictitious invoices to business partners.
- Once the attacker has access to an attorney’s email identity he/she might use it to extort money for sensitive matters crucial for the company’s future or its operations.
Compromised accounts are generally used to gain more personally-identifiable information (PII) of personnel who are in-charge of key roles related to the operations of the company. Once these crucial members’ personal information is on hand, it can be used to defraud the company or its clients, all the while causing significant damage to the company’s reputation.
Companies can protect themselves from this menace by:
- Ensuring appropriate educational programs are in place to properly educate employees and relevant stake holders of how to handle sensitive business operations.
- Make sure that any suspicious email requests are confirmed via a telephone in order to ascertain its legitimacy.
- Make sure that every financial transaction is thoroughly checked.
- By ensuring that attackers are prevented from impersonating your domain and detect and block emails sent to your organization via forged domains.
- Avoid clicking on links or open attachments in unsolicited emails.
- Keeping the latest anti-malware software to avoid any compromises to the security of your systems.
In order to safeguard your company from the treats of cybersecurity it is crucial that the management and employees all are on the same page in order to ensure the best possible measures are in place to avoid security breaches which could compromise data integrity and tarnish the reputation of your company.
If you’re in need of cybersecurity staffing or consulting, find out how we can help.
