SPF and DKIM: The State of Domain-based Email Authentication – Part 1
Friday, September 1st, 2017Recent reports on cyber-security threats in the healthcare sector by Verizon, Symantec and Ponemon consistently make several observations:
- Email-borne malware is on the rise, with such malware delivered via spam or phishing;
- Small-to-medium sized businesses (from all sectors) have the highest rate of email-delivered malware;
- Most breaches are caused by negligent employees or contractors.
These conclusions are hardly surprising as email is now an increasingly common part of communications with protected health information (PHI) frequently exchanged amongst employees and patients within a practice, between medical providers, and medical providers and their business associates. The concern for the healthcare industry is the potential violation of the HIPAA privacy rule caused by email-related (and other) breaches, leading to disruptions from loss of data, compliance audits and possibly hefty fines.
We wrote about obvious measures medical providers can take to avoid HIPAA non-compliance in email exchanges such as opt-out email security. That addresses only one aspect of the threat landscape, though – the protection of PHI in email exchanges. Another aspect is more sinister, as it deals with external, malignant actors. These actors use various spoofing techniques to trick patients or employees of a medical practice to react incautiously, often impulsively, to emails supposedly coming from valid sources. These often lead to identity theft, where the damage is more far-reaching as the information given up is more long-lived and more widely used and cannot just be erased like revoking a misused credit card.
Read the rest of this post »
Everyone always harps on the necessity of privacy when discussing health care, government, and banking communications. It is surprising how little attention is paid to email security with regards to accounting and tax preparation. There is a real danger of identity theft, unintended information disclosure, as well as invasion of privacy when using tax preparation services or organizations that do not use secure email. Why is this? 
