remote work Archives

Posts Tagged ‘remote work’

2021 Year in Review

Tuesday, December 21st, 2021

As the year draws to a close, it’s a good time to take a look back. In this 2021 Year in Review, we analyze the most important developments in cybersecurity, as well as the major information security threats.

2021 Year In Review: The Impact Of Coronavirus

As we entered year two of the coronavirus pandemic, we are still dealing with the fallout. The work-from-home model spurred on by COVID-19 presented a significant shift for the workplace and the way we use technology. The emergence of the Delta and Omicron variants wreaked havoc with plans to return to the office. As a result, many roles permanently shifted to full-time remote work. Still, other companies returned to the office and are managing a hybrid model. There are far more work-from-home opportunities than were available in the pre-pandemic world.

This has significantly altered the threat landscape. Organizations need to acknowledge that remote work is here to stay. As a result, they should update their security plans and invest in the equipment needed to enable secure remote work.

In addition, there have been a host of COVID-19-related threats that we have had to remain vigilant against. These have ranged from fake COVID-19 medication websites that suck up sensitive data, to malware loaders that use pandemic-related topics as a smokescreen. The most effective threats often utilize social engineering and the anxiety caused by COVID-19 is a benefit to cybercriminals.

The good news is that these threats seem to be going down, with Trend Micro finding about half the number of COVID-19-related threats in the first half of 2021 as they did in the beginning of 2020. However, this does not mean that overall cyberthreat levels are decreasing. Instead, it’s likely that attackers are simply moving on to other deception techniques.

2021 Year In Review: Ransomware

Trend Micro reported that ransomware detections have halved from 14 million in the first 6 months of 2020, to 7 million between January and June in 2021. However, it doesn’t mean that the threat is going away. The company’s report finds that attackers are adopting a targeted approach that aims for high rewards, as opposed to pursuing as many victims as possible. Indeed, we saw attacks on critical infrastructure this year that garnered national attention. The Colonial Pipeline, JBS Foods, and the Kayesa ransomware attacks were just a few that made headlines in 2021.

Figures from Palo Alto N etworks show that ransomware payouts are rising. The average ransomware payment rose from $312,000 in the first six months of 2020 to $570,000 in the first half of 2021. The FBI was able to recover some ransomware payments from cryptocurrency wallets this year, but only in a small fraction of cases.

Trend Micro also noticed an increase in modern ransomware attacks that involve more sophisticated methods of infection. As ransomware threats get more sophisticated, make sure your cybersecurity program is keeping up. Annual reviews, training, and investment in cybersecurity are crucial to keep your business protected.

2021 Year In Review: Zero Trust Architecture

One of the more positive developments in cybersecurity has been the move to Zero Trust Architecture. This approach was spurred on by a government initiative that aimed to boost America’s cyberthreat resilience. The initiative also included plans to modernize the federal cybersecurity environment.

Under the plan, each agency head was required to develop plans for implementing Zero Trust Architecture according to guidelines set out by the National Institute of Standards and Technology (NIST). The government is continuing to invest more in cybersecurity as a part of America’s national defense. It’s likely we will see increased funding for such initiatives in 2022.

Zero Trust Architecture quickly caught on across all industries. It is an approach that assumes an organization’s own network is not safe from cyberthreats. This security model accepts that attackers may already be inside the network and involves creating trust zones of access which are as small as possible. The approach reduces the potential impacts of an attack. Limited trust zones prevent bad actors from accessing all of a network’s systems and data.

Stay Safe in the Future With LuxSci

The last 12 months have brought a lot of changes to the cyber landscape. One thing that always stays consistent is the tenacity of attackers in coming up with new ways to circumvent cyberdefenses.

Amid our ever-changing tech environment and the constant wave of novel attacks, the only way for companies to effectively defend themselves is with a cybersecurity partner like LuxSci. Contact us now to find out how our services can help to protect your organization from threats in 2022 and beyond.

Tags: coronavirus, cybersecurity, ransomware, remote work, security, zero trust
Posted in LuxSci Library: Security and Privacy
Comments Off on 2021 Year in Review

30th National HIPAA Summit Recap

Tuesday, March 30th, 2021

Last week, the LuxSci team attended the Virtual 30^th National HIPAA Summit. The conference featured government and industry leaders who led sessions on updates to HIPAA rules, ongoing threats to cybersecurity, the impacts of remote work, and many other topics.

We can’t touch on every session that took place over the four days of the conference, but some of the most interesting updates came from the Office of Civil Rights (OCR) at Department of Health and Human Services. OCR is responsible for enforcing HIPAA, so as you would expect their sessions were of high interest to anyone responsible for compliance.

OCR UPDATES

At the start of the pandemic, OCR adopted enforcement discretion to allow health care organizations to quickly transition to virtual health care and remote work without fear of penalties. In January, OCR announced that enforcement discretion would also apply to Covid-19 vaccine scheduling. OCR will not impose penalties on those acting in “good faith” to create online or web-based scheduling applications for Covid-19 vaccine appointments. Nevertheless, this does not mean that covered entities are off the hook when it comes to HIPAA. It is recommended that they implement “reasonable safeguards” to protect PHI.

The Office of Civil Rights has also continued to penalize organizations for right of access violations. When most people think of HIPAA, they think of protecting private information through strict security policies. However, HIPAA stands for the Health Insurance Portability and Accountability Act. Portability means that patients have a right to access and transmit their information to other insurance or health care providers as they see fit. In recent years, OCR has increasingly penalized organizations for failing to respond to patient information requests in a timely manner. It is important for health care organizations to have secure offsite back-ups of patient information to prevent enforcement actions. It is challenging to find the right balance of security and patient access, but it is so important!

CYBERSECURITY THREATS

Unsurprisingly, Covid-19 exposed organizations to new security risks as employees rapidly transitioned to remote work. Although the pandemic changed practically every aspect of our lives, phishing and ransomware remained two of the biggest security threats to health care providers. At the outset of the pandemic, many ransomware hackers voluntarily stopped targeting hospitals systems in a show of solidarity. However, the respite was temporary. As the value of health care data on the black market has continued to rise, ransomware attacks have surged.

Phishing also remains a primary attack vector for intruders. OCR reported that in the first two months of 2021, hacking/IT accounted for 71% of large health care breaches. According to OCR, most large breaches have occurred via email (39%) or network servers (32%). Phishing attacks increased so much over the last year that one conference speaker noted his organization considered turning off external emails. Though it is true that the only way to completely avoid hackers is to disable your systems, it is an unrealistic option for most businesses. To combat phishing, organizations need to train staff and have technology controls in place to prevent human error. If you have the right email filtering in place, you can prevent phishing emails from even reaching your employees’ inboxes.

REMOTE WORK- LEARNING FROM THE PANDEMIC

Shifting to remote work in early 2020 left organizations scrambling to create security policies and protect patient information. Not only did providers need to worry about preventing telehealth conversations from being overheard by their families, but they also needed to be conscious of a wide array of security issues including:

Securing their physical workspace and devices
Preventing data loss
Protecting notes from patient conversations
Using secure network connections
Letting children or partners use work devices

The number of security risks that remote work introduced were almost immeasurable. Organizations needed to act quickly to create new policies to protect patient data, while maintaining excellent standards of patient care. Time and time again, health care organizations that lacked basic cyber hygiene like unique logins, complex passwords, and device usage policies were the most at risk of a cyberattack or breach.

One year later, organizations are continuing to adapt their policies as much of the workforce remains remote. Many presenters expect at least some of their workforce to remain remote once the pandemic ends. Some organizations were surprised to discover the benefits of having a remote workforce. Rural hospitals are better able to attract talent when remote work is an option. Patients also benefitted from increased access to health care when telehealth was an option.

The HIPAA Summit was a wonderful reminder that if you don’t have procedures and policies in place to protect your patient data and communications, it’s only a matter of time before a breach occurs. Did you attend the HIPAA Summit? We would love to learn more about your challenges with Covid-19 and secure patient communications.

Tags: compliance, covid-19, cybersecurity, events, hipaa, hipaa compliance, phishing, ransomware, remote work
Posted in Industry News, LuxSci Library: HIPAA, LuxSci Library: Security and Privacy
Comments Off on 30th National HIPAA Summit Recap

Remote Work & Its Cybersecurity Implications

Tuesday, June 4th, 2019

Remote work has become a hot topic in recent years, with the rise of digital nomads as well as those who just want to sleep in, skip traffic and avoid their bosses. The increased flexibility can be great for workers, while organizations can save on office costs and even boost employee morale.

Despite the potential benefits, remote work can complicate an organization’s cybersecurity. Instead of having everything centrally controlled in the office, businesses with remote workers also have to account for people accessing their resources in other locations over potentially insecure connections and equipment.

It’s not an insurmountable problem, and all it requires is some basic analysis, planning and policy, as well as a few simple security tools.

What Kind of Data Does the Employee Need to Access?

Before you dive into the technology requirements and write up a detailed policy framework, it’s important to perform an analysis to see what kind of access remote employees will need in the course of their work, and to determine whether they process any data that needs to be protected.

Some employees may not require any access to company systems and don’t need to deal with sensitive data. Others may need to log in to company tools and databases, while certain remote workers may need to deal with sensitive business data or ePHI. Each of these situations will require a different approach to maintain an appropriate security level within your organization.

Low-risk Employees

If it’s just a graphic designer updating your flyers or a similar type of low-risk work, you probably don’t need to worry too much. The graphic designer could directly email the drafts to hackers and it wouldn’t have any serious ramifications for your company (unless the hackers have some kind of absurd hatred for spam and target your business in an over-the-top revenge plot).

For employees that don’t access company systems or its data, you really don’t need to take any major security precautions. If the employees only deal with information that you could post on a billboard without repercussions, there’s no real point in developing special systems.

The only policy that you would need in place is to ensure that the rest of your employees keep their communications on a strict need-to-know basis with remote employees. While these remote workers don’t need any sensitive information in the course of their work, it’s important to prevent any gossipers from divulging company secrets. It’s also important to segregate their computer systems from those of sensitive employees if and when they happen to be in the same location, so as to avoid the spread of malware.

If your organization already has secure systems in place, it may be worthwhile to use them with remote employees that fall into this category. It could prevent such rare slip ups at a low cost, since the infrastructure is already available.

Employees that Access Company Resources, Sensitive Data or ePHI

If remote workers need to access company systems, sensitive data or ePHI in the course of their work, then your organization will need to take a number of precautions to secure itself and the data.

Again, you first need to analyze what the employees actually need and come up with policies and technologies that allow them to safely use it, without opening up any doors to unauthorized parties.

This policy should include rudimentary security processes like enforcing strong passwords and requiring two-factor authentication.

Access Control

Follow the principle of least privilege and only allow employees to access what they strictly need in order to accomplish their tasks. Opening up all of your company’s systems and its data to employees only adds unnecessary risk.

Over time, an employee’s access needs may change. If this occurs, simply adjust their privileges as necessary, whether this involves increasing or decreasing them.

Secure Employee Devices

Ideally, companies should be supplying the devices that their employees use so that they have strict control over them. These devices should have full-disk encryption with remote wipe capabilities, firewalls and antivirus software at a minimum. Your organization should also have strict rules about what employees can and cannot use company devices for.

VPN Access

VPNs offer one of the best ways to safely allow remote access to company resources. They fully encrypt the pathway between an employee’s device and the company server, preventing outside access.

Monitor Your Remote Workers

As part of your organization’s overall security policy, it should be monitoring and taking logs whenever employees access company resources. Not only does this deter employees from acting inappropriately, but it also makes it much easier to find the culprit if the company has been breached.

Obviously, this policy should be extended to remote workers who access company systems and data, as well as internal employees.

Encrypt Everything

Sensitive data needs to be encrypted whenever it is being collected, processed, transmitted or stored. LuxSci offers a range of services that can help your organization keep this data safe, from our secure forms and hosting, to our HIPAA-compliant email.

Encrypting all of your organization’s sensitive data is a crucial part of keeping it safe when dealing with remote employees. Between this and the steps mentioned above, you can offer your employees the freedom of working from anywhere without putting your organization at risk.

Tags: covid-19, cybersecurity, passwords, remote work, security, vpn
Posted in New Feature Announcements
No comments »