IT Adviser

Accessible Ways to Thwart Hackers

You don’t have to spend a bundle to secure your practice data

By Joe Dysart

Regularly making chump meat of the most sophisticated computer defenses, hackers will be unleashing a new wave of malware on unsuspecting ophthalmologists and other small businesses in the coming year – many of whom will be completely unprepared, according to Sophos, a computer security firm.

“Cybercriminals tend to focus where the weak spots are,” says Gerhard Eschelbeck, chief technology officer at Sophos. “Protecting data in a world where systems are changing rapidly and information flows freely requires a coordinated ecosystem of security technologies.”

Perhaps even more disturbing: Hackers will be increasingly targeting even the smallest of businesses, says Mark Brophy, director of information technology at Rogers Townsend & Thomas. Hackers know the defenses of smaller business are generally weaker, he says. Plus, hackers see these less-protected systems as easy back doors to the much larger clients those businesses trade with, such as third-party payers. Essentially, once hackers penetrate a small business, they can plunder the data on its network to go after their bigger game clients, Mr. Brophy says.

The New and Brutal

Many giant and multinational corporations have responded by performing tough security audits of their smaller trading partners. If they find a security risk, many decide to simply pull work from the offending business rather than risk a “breakin by association,” according to Mr. Brophy.

Small and medium-sized businesses looking to pass these hard-nosed audits, or reassure business partners that their mutual data is safe, will need to prove they have a hard IT perimeter. And they’ll need to show defenses against some of the newest threats looming in the coming year.

High on the list of “the new and the brutal” is cloud-server-snapshot software. An insidious intruder, snapshot software can infect a cloud server where an ophthalmology practice stores its data and take a complete snapshot of all the data there, including passwords, Mr. Eschelbeck says.

Hackers use snapshot malware to penetrate systems like this IBM cloud server.

New Threats to Security

Meanwhile, growing numbers of hackers are using text-messaging theft software, which is surreptitiously added to the phone of unsuspecting users. Once activated, the software forwards all text messages to that phone to a hacker, Mr. Eschelbeck says. “The potential exists for attacks like these to target Internet banking services,” he says. “Many banks send authentication codes to your phone. Malware on your phone is capable of intercepting those messages.”

Sophos has also detected increasing use of “ransomware” against small and medium-sized businesses. This app can infect both phones and computers, and render the devices inoperable. Hackers inflicting the software on businesses often demand major dollars for its removal. Not surprisingly, they rarely remove the ransomware even when a business ponies up the ransom, says Mr. Eschelbeck.

Computer users with average skills also pose a new threat. They can become formidable hackers with superkit software, according to Mr. Eschelbeck. These do-it-yourself packages offer multiple ways to infiltrate even the most sophisticated cyber-defenses, he says. Criminals buying the software on the black market don’t really need to know how the apps work. They simply need to know how to point and click.

Protecting the Weakest link

Granted, ophthalmology practices of all sizes should be using firewalls and other network protections to help neutralize hacker break-ins. And most ophthalmologists realize that even the most sterling of computer security defenses can be thwarted without similar vigilance at the individual device level. “End-user computers are the weakest spot,” says Shane Sims, director, investigations and forensic services, PriceWaterhouseCoopers. “Typically, these computers are protected only by antivirus software, and the most sophisticated hackers attack at that point.”

But dollar for dollar, the best return on an investment in computer security is employee education, according to Mr. Brophy. Take the time to educate new employees about the critical need for computer security, he says. And continually reinforce top-of-mind security with regular e-mail tips, tricks and news about IT security.

The most fastidious and determined hacker can permeate almost any defense system, but these steps and those listed in the box above can be like a locked car to a car thief; he’ll move along to an easier target. OM

Joe Dysart is an Internet speaker and business consultant based in Manhattan. His Web address is www.joedysart.com; His e-mail is joe@joedysart.com.