Published: October 17th, 2017
We have written posts (see here and here) describing WordPress vulnerabilities and the methods hackers use to exploit these. In this post, we describe steps by which a web site owner can mitigate the risks of using WordPress as a content management system. After all, it cannot be denied that WordPress remains the most user-friendly tool for creating and managing both large and small websites, as shown by its enormous adoption rate.
There is a very rich literature describing WordPress vulnerabilities and ways to harden a system against exploits. Here we distill some of these learnings into a practical guide for WordPress-based web site owners. We specifically have in mind small to medium-sized medical practices that wish to use WordPress to create (or maintain) their online portal for patients. In a future post, we’ll describe how such steps can meet HIPAA-HITECH guidelines for safeguarding electronic protected health information (ePHI).
We describe these steps in a layered way – starting at the bottom with the hosting server infrastructure, before moving to the WordPress platform itself and other applications. Read the rest of this post.
Published: October 16th, 2017
See how LuxSci SecureText works from the sender and recipient perspectives.
Published: October 13th, 2017
Encrypted flash drives offer a convenient way to carry digital information. What are your options if you don’t want to carry one?
A small portable storage device that fits your pocket and budget is surely a treat. But what about security threats? How would you ensure the data is safe? These are a few critical questions that you should answer before you decide to carry sensitive information on the flash drives. One good (not great!) way to safeguard your data is to use an encrypted flash drive.
The reason why use of an encrypted flash drive (also called encrypted USB drive) is not a really great security measure is that no single measure is enough to prevent increasingly sophisticated cyber attacks.
In this article, you will learn the risks of non-encrypted drives, how you can encrypt a drive and what are the other security alternatives are available. Read the rest of this post.
Published: October 11th, 2017
Published: October 9th, 2017
How does HIPAA law apply to health information technology? Know the role of risk analysis to maintain privacy and security of electronic health information.
The term “health information technology” (health IT) is a broad concept that encompasses an array of technologies to store, share, and analyze health information. With an increasing number of providers plunging into the vast pool of HIT, it becomes imperative that you have a clear vision of the association between HIT and HIPAA, along with the need to perform risk analyses.
Related: A Complete Guide To HIPAA Law: How It Keeps Your Privacy Protected
Read the rest of this post.
Published: October 5th, 2017
SMBs need security policy template and security risk assessment more than ever before. Learn what steps you have to take.
A security policy template is a must for any organization, irrespective of its size and the nature of its business. Small and medium businesses (SMBs), just like large organizations, need to have a clear policy on how they are going to face a cyber attack. A security policy template works as a starting framework that your practice can customize in a way that meets your organizational and legal requirements.
The first step in formulating a security policy template is to assess your needs and regulatory requirements. Second comes the critical security risk assessment (SRA) process. In this article, you will get insight into SRA, its goals and common mistakes to avoid. Read the rest of this post.
Published: October 4th, 2017
In our previous post, we described various techniques used to attack WordPress-based sites. In this post, we’ll give some examples of what happens after the vulnerabilities have been exploited to hack into a website. The purpose is to continue to reiterate the lessons that blogs such as ours (see here, here and here) provide to alert the medical industry, specifically, and business, in general, to security issues that can lead to breaches and loss of business, reputation, and income.
It is worth recalling that WordPress is the world’s most popular content management system (CMS) powering ~60% of websites worldwide (that are known to use a CMS), and ~29% of all web sites. While it is hard to find the statistics on how many websites related to the medical industry use WordPress, it is likely that these could well be a substantial percentage of the total given the ease of setup and use associated with WordPress. The fact that many of these are smaller sites, often without much IT support (much less security support) makes them all the more vulnerable. This makes education about the security aspects of WordPress all the more necessary.
Despite the valiant efforts of the WordPress organization, vulnerabilities continue to exist and most exploits take advantage of the simplest techniques – infrequent updates of critical software, poor web site hygiene (easily broken passwords, retaining default options, turning off auto updates, etc.) and the use of vulnerable WordPress plugins and themes. (Hereafter, we also include plugins and themes when we talk of WordPress vulnerabilities, unless we need to specifically distinguish between these.) Sucuri.net, a website security company, noted that of the 11,485 infected websites that they analyzed in 1Q2016, 78% of these were built on WordPress of which ~56% were out-of-date (i.e., not running the latest version). The vulnerabilities were primarily in the plugins and themes. Read the rest of this post.
Published: October 2nd, 2017
Many patients are apparently wary of embracing patient portals due to security concerns. Learn how you can reassure them about the safety.
No doubt, patient portals are highly effective in increasing patient engagement and optimizing treatment outcomes. But many patients tend to be reluctant in adopting this “new” tool as they are concerned about the security and privacy issues.
The safety concerns make a lot of sense considering how hackers are increasingly attacking health data. If your practice uses patient portals, it’s your responsibility to convince the patients that their sensitive information is in safe hands. How will you do that? Read the rest of this post.
Published: October 2nd, 2017
TLS stands for “Transport Layer Security” and is the successor of “SSL” (Secure Socket Layer). TLS is one of the standard ways that computers on the Internet transmit information over an encrypted channel. In general, when one computer connects to another computer and uses TLS, the following happens:
- Computer A connects to Computer B (no security)
- Computer B says “Hello” (no security)
- Computer A says “Lets talk securely over TLS” (no security)
- Computer A and B agree on how to do this (secure)
- The rest of the conversation is encrypted (secure)
- The meat of the conversation is encrypted
- Computer A can verify the identity of Computer B (by examining its SSL certificate, which is required for this dialog)
- The conversation cannot be eavesdropped upon (without Computer A knowing)
- The conversation cannot be modified by a third party
- Other information cannot be injected into the conversation by third parties.
TLS (and SSL) is used for many different reasons on the Internet and helps make the Internet a more secure place, when used. One of the popular uses of TLS is with SMTP for transmitting email messages between servers in a secure manner. See also:
Read the rest of this post.
Published: September 27th, 2017
WordPress is the world’s most popular publishing platform, with a strong emphasis on usability and support of open web standards. It powers most of the largest content providers as well as millions of personal blogs. Its open source software, available at WordPress.org, can be downloaded to a suitable server and run as a standalone publishing platform, while ordinary users can quickly create personal sites as sub-domains of WordPress.com.
There’s no doubt that the statistics about WordPress are impressive: ~30% of the million most visited sites on the Internet run WordPress; at 52%, it far surpasses its nearest competitor (at a measly 6.3%) for the largest market share of content management systems; it powers 96% of blogging websites worldwide – we could go on and on, but we refer the reader to other sources for more numbers.
But with such numbers come vulnerabilities. Its popularity makes it a conspicuous target for hackers. Not all hacking is in search of personal data or immediate financial gain. WordPress attacks serve as a fertile finishing school for hackers-to-be as well as provide access to resources that can be used for launching other types of attacks, such as search engine optimizations, ad injections, affiliate links, botnet attacks, etc. Consider some examples: Read the rest of this post.