Business Continuity, Cyber Security, Data Breach, Disaster Recovery, News Events, Tip of the Week, Uncategorized, Vulnerability Testing & Management

Breach exposed sensitive information about 143 million consumers

It’s been called the worst data breach in U.S. history. Attackers stole half the U.S. population’s social security numbers from Equifax in July, but the company only notified customers in September. The fallout has been devastating, with class action lawsuits being filed and consumers demanding free credit monitoring.

“Equifax has been hit with dozens of lawsuits from shareholders, consumers and now one filed by a small Wisconsin credit union that represents what could be the first by a financial institution attempting to preemptively recoup losses caused by alleged fraud the hack could cause” as reported by the Washington Post.

Equifax provided a website for customers to search if they were affected. However, on multiple occasions, the company’s official Tweeter account directed customers to a fake phishing site instead.  See imageNick Sweeting fake website small

The company’s stock price has fallen 25 percent since they announced the hack Sept. 7 according to ABC news. In the meantime, Equifax had a meeting with investors in New York in hopes to contain the fallout.

To receive information on how to prevent this type of breach visit VirtualAuditor.com

Virtual Auditor’s Virtual Security Officer Server (VSOS) is a unique, fully-managed, information security auditing assessment solution that helps you establish a formal information security program within your organization. VSOS is packed with powerful vulnerability, auditing and testing tools that can help identify security vulnerabilities within your environment, as well as gaps in your existing security program.

Quick tips on how consumers can protect themselves

  • Monitor your credit reports closely
  • Be aware that scammers can use your sensitive information at any time
  • Freeze your credit report to halt thieves from opening new credit cards or loans using your name

Equifax Cybersecurity Incident:

“To learn more about the cybersecurity incident, including whether your personal information was potentially impacted, or to sign up for complimentary identity theft protection and credit file monitoring”, please go directly to their site:

https://www.equifax.com/personal/

 

Advertisements
Business Continuity, Cyber Security, Data Breach, Disaster Recovery, Education, HIPAA / HITECH Enforcement, Risk Analysis/Risk Management, Social Media, Tip of the Week, Vulnerability Testing & Management

Get Involved and Do Your Part to Make the Internet Safer

Promote the National Cyber Security Awareness Month (NCSAM). Get involved and do your part! This is a job for everyone, make an effort to care! The theme for this year is “Our Shared Responsibility”. NCSAM will be observed in October, but make it part of your practice to start today.

Top 5 Reported Cyber Scams

 

 

Staff can do

 

For more information on keeping current on cybersecurity, vulnerabilities, data loss prevention, managing risks, and workforce members training, Contact RISC Management and Consulting, LLC at 800.648.4358 or visit www.RISCsecurity.com

To learn more about Cyber Security visit: https://www.staysafeonline.org/ncsam/landing-page/

 

Business Continuity, Cyber Security, Data Breach, Disaster Recovery, HIPAA / HITECH Enforcement, Meaningful Use, Upcoming Events, Vulnerability Testing & Management

Visit with Virtual Auditor and RISC at the Texas Chapters of HIMSS in Austin, Texas

VA and RISC for Texas HIMSS Feb 18 2015

 

Come visit with Virtual Auditor and RISC at the 7th Annual Regional Conference Texas Chapters of HIMSS in Austin! There will be over 400 healthcare IT professionals and optional preconference activities such as legislative visits at the State Capitol and Networking social. The focus will be on promoting the value of investing in Health Information Technology.

Wednesday, February 18, 2015 – Friday, February 20, 2015

Renaissance Austin Hotel

9721 Arboretum Blvd.

Virtual Auditor will be demonstrating an industry-leading Information Security Continuous Monitoring Solution (ISCMS). The ISCMS was specifically developed to help organizations including healthcare, banking, finance, and other heavily regulated industries, to meet their data privacy, information security, and compliance requirements. The ISCMS provides continuous monitoring, alerting, reporting, and event correlation, providing the data your techs want, your security folks wish they had, and your executives need! Visit www.VirtualAuditor.com for more information if you can’t see this amazing technology first hand.

Contact Sales@virtualauditor.com or 888-312-5151

For more information please visit: http://www.cvent.com/events/2015-texas-regional-himss-conference/event-summary-25f61ec35a2f482d99a39eb8605be861.aspx#

Business Continuity, Cyber Security, Data Breach, Disaster Recovery, Education, HIPAA / HITECH Enforcement, Tip of the Week, Vulnerability Testing & Management

Is Your Organization’s New Years Resolution to Be More Secure?

Is Your Organization’s New Years Resolution to Be More Secure? If not, it should be!

However, that is too easy to say, and very hard to accomplish. The current threat environment is expanding far faster than the controls can hope to keep up with. A CISOs / CSOs job has never been harder; a trend that will continue this year and on into the future. If you don’t believe that call up organization’s like SONY, ebay (one of the least talked-about giant data breaches of the year), Target, JPMorgan Chase, Home Depot, Community Health Systems, or the 321 other healthcare organizations reporting breaches affecting over 83 million individuals! In fact, healthcare breaches accounted for a whopping 42.3% of data breaches included in the just-published Identity Theft Resource Center 2014 Data Breach Report(1).

Threat vectors include all of the usual suspects that we have been talking about for years. But the massive proliferation of data, accelerating migration to remote and teleworkers, and huge increase in activity of nation-states, organized crime, and hacktivists all make the CISOs / CSOs job next to impossible. It’s not a matter of whether an incident will happen to a modern connected company, but when.

Data breach incident handling must be a part of your data privacy and information security program. Balancing the need for speed of response, especially prompted by state-level data breach rules, with accuracy and responsible forensic activities is a tough challenge. It becomes tougher when interested parties such as the CEO, who suddenly realized that information security is important, compliance, legal, IT Management, public relations, the cyber security insurance carrier and their forensic experts, and the press all want constant feedback and a complete understanding of what happened, who did it, and how much is this going to cost us? from the word, “Go!”

Hopefully all of these parties were interested when the CISO / CSO asked to run a data breach incident drill last year in order to test the capabilities, response time, and training of all relevant parties to respond to such an incident. From our experience performing risk assessments, they were not, and a drill has never been completed.

Don’t let a real incident be the first time you test your data privacy and information security incident response plan. Remember a successful program is built on statements of policy, supporting procedures, tools, checklists, logs, forms, and training. If a real incident is your first test, chances are you are looking at a poor result, and a poor result is more likely to lead to fines and firings.

Since an incident is a matter of When Not If, testing your incident response plan should not be seen as optional or subject to perpetual procrastination!

Lastly, remember that while Information Technology (I.T.) is the system owner and the primary source of information in the event of an incident or breach, the problem is a business issue, not an I.T. issue! Consider addressing requirements and response in your Business Continuity Plan (BCP). BCP procrastination is a topic for another article!

Happy New Year and we’ll secure you in 2015

The team at RISC Management

(1) http://www.idtheftcenter.org/images/breach/DataBreachReports_2014.pdf

Cyber Security, Data Breach, Education, Tip of the Week, Vulnerability Testing & Management

“Band-Aids Before Blood”

“Band-Aids Before Blood”

 John T. Schelewitz- Director of Sales, Virtual Auditor, LLC

As a salesperson accountable for the positioning of compliance and security solutions to the Healthcare and Financial verticals, I often find myself in a unique position.  This position being, how to digest the following; “We have quite a few other projects on the table”, “We have not budgeted for that”, “We performed an audit/assessment a few years ago”, “We are content with our current status” and related.

VA appliance

Before I get ahead of myself, there is success had in simply gaining a response.  Well, that may solely be of value to me and not those interested in my quota attainment so, I digress….  My concern is this, if there is not a plan to have band-aids on hand, how do you plan to address the inevitable blood?  According to a recent analysis by a leading IT security firm, of the small portions of IT budgeting set aside for security, corporations often spend as little as 10 percent on incident response, 30 percent on detection and the rest on prevention.  That is, if there is any spending.  And all of that only if there is concern that results in the establishment of defined needs, requirements and initiatives.

More often than not, action, or should I say reaction, is brought about by the sight of blood.

“Instead of merely blocking threats at the perimeter of a network, a multilayer cyber response that protects every critical component inside the network as well as external connection points is a more effective, proactive approach” (CardVault, 2014, para. 3).  This statement reflects the sentiment of a leading cyber security attorney. With external and internal threats both on the rise and inevitable, can your organization afford to be in a reactive position?  The thought of “This won’t happen to my network” is about as realistic as a unicorn monitoring USB usage.

My advice is this; Put a fluid security plan in place to address devices, systems, applications, and users.  This plan must address the enterprise from the firewall to the desktop.  Processes, controls and accountability are critical in this planning.  This plan will include human and appliance elements.  Ultimately, you must understand that your network is exposed 24x7x365.  At any point during this time, there may be blood.  Do you have band-aids?  VA logo

References

CardVault. (2014). Expect a cyber-breach: It will happen. Are you Ready? Retrieved from http://cardvault.com/expect-a-cyber-breach-it-will-happen-are-you-ready/

Tips from the RISC and VA team

Don’t let the fear of a data breach keep you awake at night: Schedule a vulnerability assessment and learn ways you can protect your systems.

  • Run a data breach response drill to practice on a scenario so there is less panic when responding to the real thing.
  • Spend a few minutes learning how to improve privacy protections and security safeguards.
  • Visit  VirtualAuditor.com and www.RISCsecurity.com to learn a great deal more about the various tools we offer to enable healthcare organizations, financial institutions, universities, and business of any size, to effectively monitor, enforce, and audit your confidential information.