WEBVTT
00:00:00.080 --> 00:00:02.240
Hey there, welcome to Cumberland Conversations.
00:00:02.399 --> 00:00:07.679
This is the place where we talk about the issues that matter most to you, your patients, and your community.
00:00:07.839 --> 00:00:12.720
We're diving into real conversations with real people, sharing insights you can actually use.
00:00:12.880 --> 00:00:14.640
Let's get the conversation started.
00:00:14.960 --> 00:00:23.760
Hi everyone, it's Michael Hook, Director of Research and Education for Cumberland Pediatric Foundation, welcoming you to this episode of Cumberland Conversations.
00:00:24.079 --> 00:00:41.920
Today is an episode of the CPF Spotlight, where we discuss important business topics, highlight some of our community partners and clinics, and give you important takeaways that can help your practice stay at its peak performance.
00:00:42.560 --> 00:00:51.679
Today I'm joined by Jason Wheeler of Sipio Technologies to discuss cybersecurity and the inherent risks for small pediatric clinics.
00:00:51.920 --> 00:00:54.479
Jason, thank you so much for joining us today.
00:00:55.119 --> 00:00:56.399
Very important topic.
00:00:57.200 --> 00:01:00.799
And there's a lot of misconceptions around cybersecurity.
00:01:00.960 --> 00:01:08.560
So before we get into that, tell me a little bit about your role at SIPO, how you got into this, like cybersecurity, man.
00:01:08.719 --> 00:01:08.799
Yeah.
00:01:08.959 --> 00:01:10.319
Yeah, so thanks for having me.
00:01:10.879 --> 00:01:16.159
Jason Wheeler, Director of Client Engagement, also a partner of SIPO Technologies.
00:01:16.480 --> 00:01:24.239
You know, I got into IT by default, honestly, a lot of on-the-job training.
00:01:24.319 --> 00:01:28.879
Uh started off at 19 years old delivering toner for a copier company.
00:01:29.040 --> 00:01:32.640
At that time, the copier company was simply copiers.
00:01:33.359 --> 00:01:35.040
You pushed it in, they made copies.
00:01:35.120 --> 00:01:36.079
That's all it was.
00:01:36.560 --> 00:01:42.560
So I was fortunate enough during my time there to see copiers go from analog to digital.
00:01:42.719 --> 00:01:47.200
You know, I would push a copier in and say, hey, I need to set this up to scan or print.
00:01:47.280 --> 00:01:49.680
And people would be like, that can scan and print?
00:01:49.920 --> 00:01:52.239
I mean, they hadn't, you know, they were not accustomed to that.
00:01:52.480 --> 00:02:01.840
So I was those customers did not have anybody in staff, on staff, to to set up shared print uh file folders.
00:02:01.920 --> 00:02:07.040
Um they didn't have access to set up email accounts for scanning.
00:02:07.280 --> 00:02:10.719
So we started doing some of that service for them.
00:02:10.879 --> 00:02:25.680
Um and then it transitioned from that on into uh document management solutions, um, and then the workflow around those document management solutions as well as the security around who has access to these file folders, right?
00:02:25.919 --> 00:02:26.960
Now they're electronic.
00:02:27.120 --> 00:02:31.680
It's not just in a file folder and in a file cabinet locked, right?
00:02:31.759 --> 00:02:34.400
Now it's out on the network who can get to it.
00:02:34.560 --> 00:02:38.879
So then it built on into that IT uh security portion of it.
00:02:39.120 --> 00:02:45.599
And then we saw the need from our customers saying, Hey, um, you're doing all this other stuff for me.
00:02:45.680 --> 00:02:47.520
Can you do my desktop support?
00:02:47.680 --> 00:02:57.039
Um so I've been able and been fortunate to be involved in that technology change and trend and see how the landscape has changed over the years.
00:02:57.120 --> 00:03:07.120
Um to now where, as I am the director of client engagement, I get to be out still daily talking to every industry there is really.
00:03:07.199 --> 00:03:15.120
Um we don't have a focus on any specific industry because honestly, we believe that all industries have the same needs.
00:03:15.360 --> 00:03:21.919
Um while there may be some that have more compliance that they must meet, but they still have the same needs.
00:03:22.080 --> 00:03:22.240
Yeah.
00:03:22.400 --> 00:03:28.800
So I it's interesting you say just this going from analog to uh where we're at today.
00:03:28.960 --> 00:03:44.719
Uh I was just thinking going from old notebooks and daily planners to the BlackBerry to now our smartphones, and thinking through how cybersecurity kind of developed along that line and and how we didn't even think about cybersecurity years ago.
00:03:44.879 --> 00:03:50.159
Um I don't know, I had a Blackberry, and I don't know that I ever thought about cybersecurity about what the risk was.
00:03:50.560 --> 00:03:53.599
But inherently there wasn't anything at the time, right?
00:03:54.240 --> 00:03:55.680
You know, I'm sure that there was.
00:03:55.840 --> 00:04:07.759
Um I I think even I think it was, if I remember correctly, um President Obama, you know, wanted to keep his Blackberry because it was actually one of the most secure devices out there because of the way they transmitted.
00:04:07.919 --> 00:04:12.400
Um and Blackberry Enterprise at the time was like r really long gone.
00:04:12.560 --> 00:04:14.719
Um but they were adamant he wanted to keep it.
00:04:15.199 --> 00:04:17.759
It seems like it was um President Obama.
00:04:17.920 --> 00:04:21.759
But yeah, I mean I think there was because the data exchange, right?
00:04:21.920 --> 00:04:28.959
When you start incorporating email, um you start incorporating honestly, um, a lot of the FBI.
00:04:29.040 --> 00:04:40.079
I I knew some some agents that worked for the forestry service that they used BlackBerries, and they kept a lot of evidence uh pictures um on those phones.
00:04:40.319 --> 00:04:43.759
So it was it was it was trending that way, right?
00:04:43.920 --> 00:04:50.720
They might not have known the impact, but the data was there, and how was it accessible by the bad actors, right?
00:04:50.800 --> 00:04:50.959
Yeah.
00:04:51.600 --> 00:04:52.720
That's interesting.
00:04:53.120 --> 00:05:04.800
So most of our audience that listens to the podcast and really members of the foundation are small practice uh clinics, they are physicians, they're mid-level providers, they're practice managers.
00:05:04.959 --> 00:05:24.000
Um and they understand that cybersecurity matters, but when you're you're focused on being a busy practice manager, you're looking at, you know, busy schedule, you're trying to manage uh staff shortages, uh, you're looking at finances, have we seen enough patients?
00:05:24.160 --> 00:05:25.439
We've our patients coming in.
00:05:25.519 --> 00:05:27.120
You there's a lot going on.
00:05:27.519 --> 00:05:37.439
How do we make this make sense to us in that setting when it's kind of one of those things that kind of, yes, I gotta deal with it, but I don't really feel it's that important.
00:05:37.600 --> 00:05:39.040
How do I make it important?
00:05:39.759 --> 00:05:44.319
Yeah, I think um you you nail it is that they they have a job to do, right?
00:05:44.399 --> 00:05:45.759
And it's not IT.
00:05:46.000 --> 00:05:51.439
Um they they talk to other cohorts, uh they they understand, they hear it, right?
00:05:51.600 --> 00:05:54.560
In the news, they hear about all the big people, right?
00:05:54.720 --> 00:05:56.959
Um that's been compromised.
00:05:57.120 --> 00:06:06.879
And I heard somebody say one time, and it was a great analogy, they said, you know, you you might not be, you're not too small to be targeted.
00:06:07.360 --> 00:06:13.439
You might be too small to make the news when you've been compromised, but you're not too small to be targeted.
00:06:13.600 --> 00:06:16.399
Um and nowadays you're not really targeted.
00:06:16.560 --> 00:06:24.639
Um I mean, certainly there are bad actors that are going after big um spear phishing campaigns and big the big industries.
00:06:24.879 --> 00:06:36.079
But as a day-in, day-out business owner or of any industry, you're at risk because these bad actors are pushing out to the masses.
00:06:36.240 --> 00:06:39.920
You know, their goal is to hit as many people as possible.
00:06:40.079 --> 00:06:43.279
It doesn't matter where they are, that's where the money's at for them.
00:06:43.519 --> 00:07:12.560
Um and to step back with the practice administrators and and the practice owners and the physicians and say, let's talk through in a small common sense approach to what has to be done on your machines, uh, on your email accounts, on your network that will impact you positively to reduce your risk, but it has to be an ongoing thing.
00:07:12.720 --> 00:07:14.399
It's not a set it and forget it.
00:07:14.480 --> 00:07:14.720
Right.
00:07:14.879 --> 00:07:18.160
It's a proactive approach versus a reactive approach.
00:07:18.319 --> 00:07:27.439
And to sit down and talk to them about that and and just explain it in those sense, they I think really get a better understanding of it.
00:07:27.600 --> 00:07:35.120
It's sometimes it's very from an outsider looking in that really doesn't understand it, it's it's a lot of money, they think.
00:07:35.279 --> 00:07:40.560
Uh it's gonna be a lot more time, I'm gonna have to deal with it, even though you tell them we're we're taking it away.
00:07:40.639 --> 00:07:42.319
That's that first blush.
00:07:42.480 --> 00:07:42.639
Right.
00:07:42.800 --> 00:07:43.279
Right, right.
00:07:43.360 --> 00:07:48.160
Um so being able to sit there and talk to them about that and say, look, this is some common sense stuff.
00:07:48.319 --> 00:07:51.839
Um that's the best what the starting point, right?
00:07:52.399 --> 00:07:54.639
So common sense.
00:07:55.199 --> 00:08:01.680
Small clinics are targeted, or maybe not targeted, but are definitely an open access point to information.
00:08:01.920 --> 00:08:06.639
We were talking beforehand about information is really what they're going at.
00:08:06.959 --> 00:08:30.480
Um what what has changed in the last few years that you've seen that's that's trending that's different from what we knew, say pre-pandemic or even just coming out of the pandemic, that we focus on you know these phishing scams and they're really trying to just get baseline information on your business to try to capture your business, but that's not what is happening, right?
00:08:30.639 --> 00:08:30.800
Right.
00:08:31.040 --> 00:08:32.080
That's that misconception.
00:08:32.240 --> 00:08:37.919
We're we're looking at um access points to get a ton of other information.
00:08:38.240 --> 00:08:38.480
Yeah.
00:08:38.720 --> 00:08:48.720
Yeah, and and really um, you know, I as we talked about, I think that the trend now is it it's always been to some degree disruption, right?
00:08:48.960 --> 00:08:57.039
Um years ago, certainly the the thought was they're trying to get my stuff to, you know steal my credit, right?
00:08:57.279 --> 00:08:57.519
Right.
00:08:57.759 --> 00:09:00.960
That's that's yes, that happens still for sure.
00:09:01.039 --> 00:09:03.200
Um, but really it's disruption.
00:09:03.440 --> 00:09:12.960
They want to be able to come in and say, I'm gonna lock you down from being able to do your business for the next ever how many days until you pay me.
00:09:13.200 --> 00:09:15.039
They they don't care what's in there.
00:09:15.360 --> 00:09:17.840
I mean th potentially, right?
00:09:18.000 --> 00:09:18.159
Right.
00:09:18.399 --> 00:09:31.679
Um, you know, when the Treasury Department was compromised, I would say a large majority of all of our Social Security number and information I mean the Treasury Department was compromised, um, was all relaked.
00:09:32.159 --> 00:09:46.399
Now the effort I think is as many people as I can touch, the more I can get my fingers into somebody's network, the more likelihood I am to cause a disruption in their business.
00:09:46.639 --> 00:09:46.960
Yeah.
00:09:47.200 --> 00:09:49.440
Um it's not about the patient.
00:09:49.600 --> 00:09:51.279
I'm not trying to get a patient's information.
00:09:51.440 --> 00:09:51.600
Yeah.
00:09:51.759 --> 00:09:52.240
I have that already.
00:09:52.559 --> 00:09:55.759
Yeah, I mean, if they're going to get the patient information, you know what they're gonna do with it.
00:09:55.840 --> 00:09:58.799
They're gonna hold it hostage to get money from you.
00:09:58.960 --> 00:10:03.519
Um they're gonna hold that it it's not really that they're wanting to sell it out there.
00:10:03.759 --> 00:10:06.879
I mean, the I I'm sure there are, right?
00:10:07.039 --> 00:10:07.279
Yeah.
00:10:07.519 --> 00:10:10.559
But it's it's business to these attackers.
00:10:10.720 --> 00:10:16.799
Um I I I dealt with and and worked with uh a um a school years ago.
00:10:16.960 --> 00:10:20.159
They called us up and said, Hey, we we need some help.
00:10:20.320 --> 00:10:22.159
We weren't doing business with them at the time.
00:10:22.399 --> 00:10:27.759
It was Christmas Eve, they had been compromised, um, took their whole network down.
00:10:28.080 --> 00:10:30.799
Um school started back in three weeks.
00:10:31.039 --> 00:10:40.240
Um and he told me, he said, Jason, this group I've dealt with uh he was uh IT director for many years.
00:10:40.399 --> 00:10:43.360
He said, I have dealt with a lot of vendors.
00:10:44.000 --> 00:10:48.159
He said, This has been the best customer service experience that I've ever dealt with.
00:10:48.879 --> 00:10:52.159
And he said, when I would call them, they would answer.
00:10:52.399 --> 00:11:04.799
When I would email them, they would he said they even said, you know, hey, you pay us our money, we'll get you back online by the end of the day, and we'll show you how we did it so you can protect yourself from doing it again.
00:11:05.120 --> 00:11:09.120
He said that's when I realized they this is a business for them.
00:11:09.360 --> 00:11:09.519
Yeah.
00:11:09.679 --> 00:11:11.600
You know, they are simply making money.
00:11:11.759 --> 00:11:12.000
Yeah.
00:11:12.159 --> 00:11:12.480
You know.
00:11:12.799 --> 00:11:27.200
I think I think you also said uh um uh a couple weeks ago when we were talking about this episode, there and this might be the same uh scenario of I will show you where your vulnerabilities were so that it doesn't happen again.
00:11:27.360 --> 00:11:27.679
Yeah.
00:11:27.919 --> 00:11:30.559
I was able to exploit it, anybody else can exploit it.
00:11:30.720 --> 00:11:31.759
What do we need to protect that?
00:11:32.080 --> 00:11:35.120
But that's kind of a a key thing that Scipio can do.
00:11:35.279 --> 00:11:41.519
Um so talk through that process real quick to just say like where does Scipio come in play?
00:11:41.759 --> 00:11:42.159
Sure.
00:11:42.399 --> 00:11:47.919
Yeah, so we we kind of take that layered approach to your network security.
00:11:48.159 --> 00:11:59.120
There's there's not one magic bullet out there that cures everything, and there's no MSP uh that can make you HIPAA compliant, that can make you 100% protected.
00:11:59.279 --> 00:12:02.000
There's not any uh in-house IT, right?
00:12:02.320 --> 00:12:05.600
You look out there, everybody's at risk.
00:12:05.840 --> 00:12:15.840
Um what we want to do is bring that common sense um solutions into the organizations that reduce your risk, all right?
00:12:17.279 --> 00:12:33.759
You we all know that you have budgets, we all know that they have to work in that budget front time frame, but we can put stuff in place that reduces it from the network layer down to the email layer down to the desktop protection layer.
00:12:33.919 --> 00:12:37.600
You know, those are the three really entry points into the network.
00:12:37.759 --> 00:12:45.759
And you have to focus on all three of those um simultaneously because one without the other two puts you at risk.
00:12:45.919 --> 00:12:46.159
Yeah.
00:12:46.399 --> 00:12:59.279
Um and so it's it's bringing in solid solutions that are cost-effective, um, budget-minded, and but reliable and monitorable solutions.
00:12:59.440 --> 00:12:59.840
Yeah.
00:13:00.159 --> 00:13:01.919
Proactive solutions, we could even say.
00:13:02.320 --> 00:13:02.480
Right.
00:13:02.559 --> 00:13:04.240
No, you definitely want to be more proactive.
00:13:04.480 --> 00:13:11.519
That's the idea of having this talk is to make sure that clinics have the opportunity to prevent something before it happens, right?
00:13:11.919 --> 00:13:18.159
Um but thinking through cybersecurity, there's a lot of misconceptions.
00:13:18.320 --> 00:13:28.080
So we talked about you know, small clinics uh thinking they're they're not necessarily the target, they're vulnerable, um, we're not necessarily going for information.
00:13:28.240 --> 00:13:33.200
What other misconceptions do you know or are most common with cybersecurity?
00:13:33.600 --> 00:13:40.080
I tell you one that I hear a lot of, specifically in clinics, is um that we're we're quote, good.
00:13:40.240 --> 00:13:41.279
We're covered, right?
00:13:41.440 --> 00:13:42.720
Because our EMR is in the cloud.
00:13:42.960 --> 00:13:43.840
Overconfidence.
00:13:44.080 --> 00:13:45.279
They're overconfidence.
00:13:45.519 --> 00:13:47.039
Because our EMR is in the cloud.
00:13:47.120 --> 00:13:47.279
Yeah.
00:13:47.519 --> 00:13:50.080
We don't have a server, we're good, right?
00:13:50.159 --> 00:13:52.240
They we hear that a lot.
00:13:52.399 --> 00:14:03.039
Um I don't store confidential information or or health information, but your devices access that information.
00:14:03.360 --> 00:14:11.120
And if I can act, as I'm a bad actor, if I can access your device, yes, I can access that information.
00:14:11.279 --> 00:14:23.919
Um so that is one that a lot of people think they put that onist on the EMR that's cloud and says, I don't even need cloud, I don't need cybersecurity insurance because they're handling it for me.
00:14:24.080 --> 00:14:24.240
Yeah.
00:14:24.320 --> 00:14:25.600
I'm not responsible for it.
00:14:26.159 --> 00:14:32.639
You're responsible for your due diligence to make sure your patient data is resp is uh uh protected.
00:14:32.799 --> 00:14:34.639
That's what your responsibility is.
00:14:34.799 --> 00:14:44.080
And meaning that means if somebody gets on your machine and they can do keyboard stroke logging and things of that, they can get into your cloud-hosted environment.
00:14:44.320 --> 00:14:50.399
Um that's a big misconception that we can wipe our hands of it because somebody else hosts it for us.
00:14:50.960 --> 00:14:53.519
So pretty much everybody is vulnerable.
00:14:53.679 --> 00:14:58.159
It doesn't matter what type of device you have, how you handle your information.
00:14:58.399 --> 00:15:02.480
Uh yes, you know, extenuating circumstances uh aside.
00:15:03.039 --> 00:15:11.919
Um so let's kind of reframe this then a little bit and think through what does a cybersecurity attack look like?
00:15:12.240 --> 00:15:19.519
So walk me through the the steps, like what's happening um from the start of when that attack comes in.
00:15:19.679 --> 00:15:20.559
What does that look like?
00:15:20.960 --> 00:15:21.600
What's happening?
00:15:22.240 --> 00:15:26.559
Typically what we see is through a phishing campaign, right?
00:15:26.879 --> 00:15:31.600
Um and the user receives an email.
00:15:31.840 --> 00:15:38.960
Um they uh either assume it is from, they they read the address and assume that it's legitimate.
00:15:39.200 --> 00:15:41.679
Um many times it is legitimate.
00:15:41.840 --> 00:15:57.600
Um many times an outside entity has been compromised and once they're compromised, let's say my email address is compromised, and you and I have been communicating about the podcast, right?
00:15:58.000 --> 00:16:08.799
And I now you start getting emails from me that are a little off topic from the but I say, hey, click on this document and see if it sounds good, right?
00:16:09.039 --> 00:16:16.320
And you click on it, it's a PDF, and it says, Hey Michael, I need you to put your credentials in to open this PDF.
00:16:16.399 --> 00:16:22.559
And you type your email and you type your password and you hit enter and it doesn't do anything.
00:16:22.720 --> 00:16:24.559
And you think, well, I must have done something wrong.
00:16:24.799 --> 00:16:25.440
Let me try it again.
00:16:25.759 --> 00:16:28.159
Double click it again, you do it again.
00:16:28.320 --> 00:16:31.279
Well, as soon as you did that, I've got your credentials, right?
00:16:31.360 --> 00:16:37.200
I'm able to now because what I've tail told that PDF to do is send me this.
00:16:37.679 --> 00:16:41.600
Open up a mirrored-looking uh login to Microsoft.
00:16:41.840 --> 00:16:45.759
When he types it, keystroke log it, and then send it back to me.
00:16:46.080 --> 00:16:49.600
So keystroke logging is essentially recording.
00:16:50.320 --> 00:16:52.159
Yeah, it's recording what you're typing in there.
00:16:52.639 --> 00:16:53.840
And then it's sending it out.
00:16:54.000 --> 00:17:01.519
When you hit enter to submit your credentials, that's saying, because the the programmers are writing it to do what they want it to do.
00:17:01.840 --> 00:17:07.279
And we can talk about, I think we talked about this years or from years ago, but they're writing it to do what they want it to do.
00:17:07.359 --> 00:17:10.079
And so it's sending them my credentials.
00:17:10.400 --> 00:17:24.640
Well, now, you know, I or um the bad actor can be anywhere in the world if you're using a you have a web-based enabled email account, whether it be Google, O365, Apple, whatever, right?
00:17:24.720 --> 00:17:25.920
It's they're all web-based.
00:17:26.000 --> 00:17:26.400
Yeah.
00:17:26.640 --> 00:17:32.160
Um and I can now log in to your email from anywhere in the world.
00:17:32.319 --> 00:17:37.359
Um as long as I don't have if I don't have MFA turned on, right?
00:17:37.440 --> 00:17:37.599
Right.
00:17:37.920 --> 00:17:40.960
There's my stop gap for the first start, right?
00:17:41.039 --> 00:17:41.279
Yeah.
00:17:41.440 --> 00:17:45.039
All right, I've got his credentials, I got his email, I'm gonna log in.
00:17:45.279 --> 00:17:59.119
What we want it is the free furt um feature of MFA to be enabled, doesn't cost anything, so that when I do log in or the bad actor logs in, it then send me the code, that the next code, right?
00:17:59.200 --> 00:18:02.160
And that should be on your cell phone or another device.
00:18:02.319 --> 00:18:09.200
And so unless they have that physical device or they've you know done some very high-tech hashing, um, typically it stops them.
00:18:09.279 --> 00:18:09.440
Yeah.
00:18:09.680 --> 00:18:12.480
You know, that's again, it's a free solution.
00:18:12.640 --> 00:18:16.960
Um but you know, we've seen this from years ago.
00:18:17.200 --> 00:18:33.279
Um I think the biggest one of the one of the first really um viruses I saw that I thought was really, really sophisticated but so simple was what we all dealt with years ago was the old pop-up ad.
00:18:33.440 --> 00:18:40.319
It would be a big pop-up ad from Microsoft and say, hey, your machine is at risk and needs to be scanned for viruses.
00:18:41.039 --> 00:18:44.000
Hit yes to scan now or no to scan later.
00:18:44.400 --> 00:18:44.960
And everyone.
00:18:45.359 --> 00:18:46.960
You didn't have Norton virus on there.
00:18:47.039 --> 00:18:47.119
Yeah.
00:18:47.359 --> 00:18:48.880
Or McAfee, whatever, you know.
00:18:49.119 --> 00:18:49.279
Yeah.
00:18:49.359 --> 00:18:51.440
And people would hit yes or no, right?
00:18:52.000 --> 00:18:54.880
Well, if they'd say no, it'd really install.
00:18:55.039 --> 00:18:56.960
If you said yes, it would install the virus.
00:18:57.119 --> 00:18:59.119
If you said no, it would install the virus.
00:18:59.279 --> 00:19:02.079
Because the bad actors wrote it to do what they want it to do.
00:19:02.400 --> 00:19:12.160
Well, then if you remember, they said, hey, if you have this pop-up, don't click on anything, go up to the X and X out of it.
00:19:12.960 --> 00:19:19.759
Well, this is how this is just, in my opinion, this is proof that they are always working to be one step ahead of us.
00:19:20.799 --> 00:19:26.880
Well, all of a sudden, that pop-up, now when you click the X, it installed it too.
00:19:27.119 --> 00:19:28.720
They rewrote the program.
00:19:28.960 --> 00:19:46.720
They heard what IT managers and directors and staff were telling the end users, they then rewrote that pop-up, so when you hit X, that's why you will probably remember that people said if it pops up, don't click yes or no or X out of it, do Control Alt Delete and End Task.
00:19:46.880 --> 00:19:52.880
That's where many people had never even heard of Control Alt Delete and what Task Manager did until that happened.
00:19:53.039 --> 00:19:56.079
Um, and that started clicking, you know, people started doing that.
00:19:56.240 --> 00:20:08.960
But that was where we really I feel like I first witnessed the bad actors looking at what we're doing and writing to you know, socially engineer their solutions.
00:20:09.359 --> 00:20:35.920
I I think this this speaks to also why it's so important to do training with your staff, because I've even seen where these bad actors are pulling out some of those antiquated processes or those approaches to to try to trick you because you're expecting the new and improved approach and they pull out one of these, hey, your device needs to be restarted or your device needs this.
00:20:36.079 --> 00:20:41.440
I I mean, I get them on my phone, I get them on my personal email, uh, personal computer, everything.
00:20:41.680 --> 00:20:51.279
So it's important to do training, but it's also important to make sure that culturally as a clinic that your staff understands, don't freak out.
00:20:51.759 --> 00:21:12.000
Yes, you're busy, you have a lot to do, but just pause, make sure that you understand what it is, and ask for help or or you know, use the recommended, you know, if you're a CPO uh client, using what you guys recommend as here's what we do when this pops up on our computer.
00:21:12.319 --> 00:21:12.559
Yeah.
00:21:12.720 --> 00:21:18.960
And I think having you know, having a a group that you can, or whether it be in-house or outsourced, right?
00:21:19.200 --> 00:21:26.079
Having a group that you can leverage that says, hey, I need somebody to validate this email for me, right?
00:21:26.240 --> 00:21:30.960
Um, or honestly, I I messed up.
00:21:31.119 --> 00:21:31.440
Yeah.
00:21:31.599 --> 00:21:33.279
I need somebody to look at this.
00:21:33.440 --> 00:21:35.599
I I clicked on something and I think I messed up.
00:21:35.680 --> 00:21:35.839
Yeah.
00:21:36.000 --> 00:21:49.759
It doesn't take long for once you've done that, because many times we have seen that companies that don't have that individual, they don't want to self report to their boss that they clicked on something.
00:21:50.000 --> 00:21:54.000
And I mean they're they're scared that that their job's at jeopardy.
00:21:54.160 --> 00:22:09.359
Um especially in a clinic where you're dealing with PHI, it becomes uh a potential reportable Or almost always is reportable on uh HIPAA reports that there was a violation, and then you go through the process of notifying patients.
00:22:09.599 --> 00:22:16.319
Like there's a lot that I think scares staff into not reporting rather than just being safe.
00:22:16.640 --> 00:22:24.559
Yeah, and and I mean and so that right, the fact that you do nothing is the worst thing you know when you don't report it, because then it just grows.
00:22:26.079 --> 00:22:28.720
It can be very quickly out of hand.
00:22:28.799 --> 00:22:41.519
Um whereas if you're using someone and they're able to jump on the machine very quickly, um, log out all the sessions, reset the password, validate that something was sent.
00:22:41.680 --> 00:22:44.240
If it was, can what can we do about it?
00:22:44.400 --> 00:22:47.519
Um and then do scans of the machines and things of that nature.
00:22:48.079 --> 00:22:49.759
Just the worst thing to do is nothing.
00:22:49.920 --> 00:22:50.240
Yeah.
00:22:50.480 --> 00:22:57.759
Um so yeah, it's um having that uh resource available for you is huge, in my opinion.
00:22:57.920 --> 00:23:01.039
Um and the sc the training, right?
00:23:01.279 --> 00:23:04.960
It is um because it is very sophisticated now.
00:23:05.119 --> 00:23:13.839
I mean, they uh again, um many times you will be fished from legitimate emails that you are corresponding with.
00:23:14.319 --> 00:23:20.000
The reason you are being fished from me is because they see my sent items.
00:23:20.079 --> 00:23:28.640
Yeah, they see you and I are communicating, so they are targeting people that they and then they're also targeting your whole contact list.
00:23:28.880 --> 00:23:38.799
Oh, yeah, it's not always that you are getting uh anything unknown sender sending you something that's like here you that happens occasionally, yeah.
00:23:39.039 --> 00:23:44.319
But likely it's into somebody else's email and then going through there, the old chain letters.
00:23:44.400 --> 00:23:44.559
Yes.
00:23:44.880 --> 00:23:51.519
Um getting in there, then the pervasiveness of that creeps through their contacts, they it comes to you.
00:23:51.759 --> 00:24:04.160
It looks exactly like their email, and in most cases it can be their exact email, controlling their uh emails going out and then send you something, and now that all of a sudden they have it.
00:24:04.240 --> 00:24:04.400
Yeah.
00:24:04.720 --> 00:24:16.559
Um I know when at one point there was a change in the approach to send you an image of something, or they drop a uh an image in there and then there'd be a link.
00:24:16.799 --> 00:24:21.759
If the the button doesn't work on here, if it doesn't work, copy and paste this.
00:24:22.000 --> 00:24:22.640
Well, there you go.
00:24:22.799 --> 00:24:23.680
Now you have a virus.
00:24:23.839 --> 00:24:31.680
Like all those attempts thinking through that, has AI made this any worse?
00:24:32.000 --> 00:24:34.160
Uh you know, and it's made it better?
00:24:34.400 --> 00:24:35.599
Or what are we dealing with here?
00:24:35.839 --> 00:24:36.319
Uh oh man.
00:24:36.640 --> 00:24:38.240
Is AI part of the problem here?
00:24:38.400 --> 00:24:38.559
No.
00:24:39.039 --> 00:24:49.119
I mean, but seriously, is AI complicating this idea of cybersecurity and what do we need to do as clinics to try to manage now that aspect?
00:24:49.680 --> 00:24:53.200
I think certainly user awareness training.
00:24:53.680 --> 00:24:58.000
Um but use user awareness training can only go so far.
00:24:58.240 --> 00:24:59.200
We are human.
00:25:00.000 --> 00:25:06.319
If any if you look up any statistic, what is the biggest com uh risk of your organization?
00:25:06.559 --> 00:25:11.680
Doesn't matter what organization you are, when related to IT, your biggest risk is your employees.
00:25:12.000 --> 00:25:16.960
No matter how much you have put on there, how much security you have, because we're human, right?
00:25:17.119 --> 00:25:50.000
So AI right now has made it even more sophisticated in how they can target and approach because they can also get more information and be even more not predictable but more genuine in their email writings, where that they can go in and and script out an email based off other emails you and I have had and write it in a matter of seconds where it might see that you know, maybe I had I call you, hey Mikey, right?
00:25:50.480 --> 00:25:52.799
And you know I only call you Mikey.
00:25:52.880 --> 00:25:53.200
Yeah.
00:25:53.359 --> 00:25:57.039
Um and it starts using that, and it's like, oh, that's Jason.
00:25:57.200 --> 00:25:58.720
Nobody else calls me Mikey.
00:25:59.119 --> 00:26:00.640
You know, so very familiar.
00:26:01.039 --> 00:26:01.680
Very familiar.
00:26:01.759 --> 00:26:03.839
It's that's has to be Jason.
00:26:04.079 --> 00:26:39.680
Um, you know, I saw several months ago, I saw I think we talked about it, a 60 Minutes article where a woman who had a very big um you know Facebook following did social media, but also was a news reporter, and they did a little test, and they went out, it was I think with NBC or somebody, but she went out to the said she was out on the West Coast shooting a a bit and called um, supposedly called corporate office and said, Hey, I'm out here, and I left my credit card uh back at the office.
00:26:39.839 --> 00:26:43.119
Can you know, hey Sue, can you get me your credit card?
00:26:43.599 --> 00:26:45.279
And Sue said, I'm so sorry, yes.
00:26:45.359 --> 00:26:49.920
And she's like, hey, if you'll just give me that uh credit card, I'll get you reimbursed when I get back.
00:26:50.079 --> 00:26:54.960
Sue gave her a credit card, and every bit of it was done over AI.
00:26:55.599 --> 00:27:11.279
They went online, took all of her Facebook posts that had all of her audio and everything, downloaded it into a database, typed out exactly what they wanted it to say as she spoke on the phone over the computer, and it was a perfect match.
00:27:11.519 --> 00:27:13.839
And I was like, you know what?
00:27:14.079 --> 00:27:14.720
That's sophistication.
00:27:15.119 --> 00:27:16.079
That's sophistication.
00:27:16.240 --> 00:27:24.720
But also what it is, in my opinion, is it goes back to where I said they are always trying to stay one step ahead of us.
00:27:25.519 --> 00:27:30.640
You know, we had always said we want a good strong password.
00:27:31.200 --> 00:27:36.720
Then that strong password started becoming all right, people can it they can decrypt it, they can pa you know break it.
00:27:36.880 --> 00:27:39.200
So we need to do multi-factor authentication.
00:27:39.440 --> 00:27:43.279
Well, now banks and things require voice approval as well, right?
00:27:43.440 --> 00:27:43.599
Right.
00:27:44.160 --> 00:27:55.839
Well, to me, that's what they've just done, is said now if I can get their voice, and I think we've even heard this before that you know, people will make phone calls and they'll say, Hey, is this Jason?
00:27:56.240 --> 00:28:04.000
And they want you to say yes, because if they record you saying yes, then they can say Jason attested and agreed to this something, something.
00:28:04.559 --> 00:28:07.519
And so that's been going on for a couple years.
00:28:08.079 --> 00:28:10.880
Um now it's I think it's just gonna go deeper.
00:28:11.039 --> 00:28:20.720
Um so we have to be more diligent and more diligent and more diligent with our training and unfortunately our skepticism about what's legitimate and not.
00:28:21.039 --> 00:28:28.240
And I mean that's that's a world we live in, but there are tools that we can reduce our risk.
00:28:28.400 --> 00:28:28.559
Yeah.
00:28:28.720 --> 00:28:30.240
And that's that's the name of the game.
00:28:30.720 --> 00:28:34.559
Reduce the risk and I think maintain confidence in the approach.
00:28:34.720 --> 00:28:43.200
You know, we don't we're not trying to fear monger, we're not trying to create a sense of we can't do any of this kind of stuff because there's there's just no chance of winning.
00:28:43.440 --> 00:28:46.240
There's not is there it's not about trying to win.
00:28:46.400 --> 00:28:51.680
It's just trying to do the appropriate proactive step to try to prevent what we can, right?
00:28:51.920 --> 00:28:53.039
Lessen the damage.
00:28:54.400 --> 00:28:57.119
Not much unlike taking care of patients, right?
00:28:57.440 --> 00:29:03.279
We try to lessen lessen that as much as we can and triage um their their problems and so forth.
00:29:03.440 --> 00:29:07.039
Um not at all trying to get into a medical talk there at all.
00:29:07.279 --> 00:29:09.599
But um a lot of similarities.
00:29:09.680 --> 00:29:10.000
It really is.
00:29:10.400 --> 00:29:11.200
A lot of similarities.
00:29:11.440 --> 00:29:15.440
Um so we you mentioned uh multi-factor authentication.
00:29:15.680 --> 00:29:23.839
We talk about phishing and and this idea that clinics are are just as vulnerable as large hospitals.
00:29:23.920 --> 00:29:41.599
But I think uh another piece that is important to understand is the hyper-realistic scenarios that are presented, as what you're just suggesting with uh poor Sue, who now owns probably uh a new wardrobe and tons of stuff that she doesn't get to use, right?
00:29:42.160 --> 00:29:54.319
Um there are instances in relatively recent where even individuals who have seemingly top-of-the-line protection still fall prey to some of the stuff.
00:29:54.480 --> 00:30:00.160
So Mark Cuban uh had an issue where he was a victim of phish.
00:30:00.319 --> 00:30:04.880
Um I think um Mark Zuckerberg, a lot of marks apparently.
00:30:05.039 --> 00:30:11.119
Um Mark Zuckerberg had an issue uh where his password was hacked.
00:30:11.680 --> 00:30:34.960
Um and then others where they're especially healthcare executives, and really I think executives anywhere are getting spearfished or this idea of whaling where let's go for the big one, then they can kind of uh uh act as the decoy that we as the backed actor use to disseminate emails down to staff.
00:30:36.079 --> 00:30:38.720
I'm gonna click on something that my boss sends me.
00:30:38.880 --> 00:30:39.519
Why would I not?
00:30:39.680 --> 00:30:40.240
Yeah, right?
00:30:40.960 --> 00:30:49.279
Well, now there's an even greater impact by sending this stuff from the top all the way down to the bottom.
00:30:49.359 --> 00:30:50.000
Yeah.
00:30:50.480 --> 00:30:53.519
And and of course, too, the the the bad actors, right?
00:30:53.680 --> 00:30:59.519
That's a uh that's a gold medal for them, uh, to be able to say, I I hacked Zuckerberg.
00:30:59.599 --> 00:30:59.759
Yeah.
00:30:59.920 --> 00:31:01.039
Or I hacked Mark Hughes.
00:31:01.200 --> 00:31:04.079
Oh no, and it was and those those people were all over the news.
00:31:04.240 --> 00:31:04.960
They were proud of it.
00:31:05.200 --> 00:31:05.440
Yes.
00:31:05.680 --> 00:31:14.720
But the impact that that had, and as easy as it was for them to get into to those individuals' accounts and stuff, it's it's just amazing.
00:31:14.960 --> 00:31:15.200
Yeah.
00:31:15.519 --> 00:31:22.319
But so training, but how do we make that training against that kind of evolving situation?
00:31:22.480 --> 00:31:28.480
How do we make that training not seem scary and and create fear, but also not be boring?
00:31:28.799 --> 00:31:32.799
Like annual compliance is already all the time, somewhat boring.
00:31:32.960 --> 00:31:38.880
Like this is such an important and rapidly evolving risk.
00:31:39.200 --> 00:31:45.440
How do I train and make sure that my staff aren't just clicking through and actually able to pay attention?
00:31:45.680 --> 00:31:45.839
Right.
00:31:46.319 --> 00:31:49.119
I like to SIPIO, what does SIPIO suggest in terms of?
00:31:49.759 --> 00:31:52.720
So I think being being interactive with it is great.
00:31:52.880 --> 00:32:01.680
Um not the frequency of it is important, but sometimes too much frequency can make it just become dull and um you know forgettable.
00:32:01.920 --> 00:32:08.000
But small short-term um tests and and training is what I feel like does the best.
00:32:08.079 --> 00:32:12.400
Um, even making it into kind of some competition level stuff, right?
00:32:12.480 --> 00:32:18.640
Where, hey, you're you're people who scored 100% for the first three quarters or whatever, you know, get a little reward.
00:32:18.799 --> 00:32:20.880
I I think making it fun like that.
00:32:21.039 --> 00:32:24.720
It should not be something that is seen as a chore.
00:32:25.039 --> 00:32:35.519
Um I think it should be something that is seen as, hey, this should be five minutes and done, and it was enough information that I learned something new every time in a five-minute section.
00:32:35.759 --> 00:32:44.559
And it might be the smallest little tidbit, but if you can get your employees to buy in on it, they're gonna be take that away from you.
00:32:44.720 --> 00:32:52.400
And honestly, what we see a lot of times is the employees don't buy into it until the owners buy into it.
00:32:52.799 --> 00:32:56.240
And we up it has to come from upper management.
00:32:56.480 --> 00:33:08.000
Upper management has to be reiterating this and stressing the importance of it and never making it sound to them like we gotta do this again, right?
00:33:08.480 --> 00:33:11.920
Your employees hear you doing that, they're gonna take the same stance.
00:33:12.079 --> 00:33:12.319
Yeah.
00:33:12.559 --> 00:33:20.079
If upper management's not gonna be show the importance of protecting patient data, what do you think the lower you know employees are gonna do?
00:33:20.240 --> 00:33:21.359
They're gonna be in the same boat.
00:33:21.680 --> 00:33:26.799
Well, and and I think this even goes beyond just the idea of protecting patient data.
00:33:26.960 --> 00:33:29.519
It's protecting even their own information.
00:33:29.839 --> 00:33:32.880
Because they're accessing your personnel files, they're accessing everything.
00:33:33.359 --> 00:33:35.200
HR files for their employees, everything.
00:33:35.440 --> 00:33:35.759
Sure.
00:33:36.160 --> 00:33:50.160
Um and I think that's the the, in my opinion, the biggest misconception on cybersecurity is really just the the extent of what they're trying to do or get access to and then what they're trying to do with it, you know.
00:33:50.720 --> 00:33:55.839
But all of that said, everybody's vulnerable.
00:33:56.079 --> 00:33:58.319
We live in this this dire world, right?
00:33:58.480 --> 00:33:58.720
No.
00:33:59.200 --> 00:34:05.440
There's just some very real situations, um but there's ways to to prevent it, right?
00:34:06.000 --> 00:34:10.320
So how do we actually stop that?
00:34:10.960 --> 00:34:12.320
What do we do?
00:34:12.559 --> 00:34:17.360
What steps can be taken to prevent the attack that has already happened?
00:34:17.599 --> 00:34:23.679
And then I want to talk about what do we do to prevent it from starting completely.
00:34:24.400 --> 00:34:40.400
So certainly active in process attack is having someone who's overseeing the uh the accounts, uh, whether it be the machine itself, uh, whether it be the network or even the email hosting service, right?
00:34:40.559 --> 00:34:42.400
Whether it be 0365.
00:34:42.960 --> 00:34:58.480
You have to have someone there who understands, you know, let's do how to do trace route of emails and things of that nature for say, let's see, has have because a typical user would look in their sent items and say, nothing's been sent.
00:34:58.880 --> 00:35:00.320
I I'm good, right?
00:35:00.559 --> 00:35:14.559
Well, we have to dig deeper than that because we have found and see time and time again that the bad actor gets into your email, they send emails out, and then delete the sent items, and then delete it out of the deleted items.
00:35:14.639 --> 00:35:16.000
So you think there's nothing happened.
00:35:16.320 --> 00:35:21.840
So you have to have that expertise to go in and and really dig into it to see what's been done.
00:35:22.079 --> 00:35:33.679
And then to immediately have good software, antivirus, EDR, endpoint detect and respond uh solutions on there to ensure that the machine is clean.
00:35:34.320 --> 00:35:37.360
Is there concerns that maybe that machine is not clean?
00:35:37.440 --> 00:35:48.239
We need to decommission it, we need to bring it out of the network, we need to accept segregate it off of the network so that it's not potentially jumping to somebody else's machine.
00:35:48.320 --> 00:35:52.480
Uh and then what access did that user have to the network shares?
00:35:52.719 --> 00:35:58.880
Um again, we talk about, hey, my stuff's protected because I have a hosted EMR.
00:35:59.360 --> 00:36:02.079
Um that's great that it's in there.
00:36:02.239 --> 00:36:05.440
But I bet you're not storing your HR files in there.
00:36:05.599 --> 00:36:14.079
I bet you're not storing and that stuff local many times, and your employees don't want their stuff leaked either.
00:36:14.320 --> 00:36:14.559
Right.
00:36:14.800 --> 00:36:19.679
And so you have to your job as the business owner is to protect all data.
00:36:19.840 --> 00:36:20.159
Right.
00:36:20.400 --> 00:36:30.480
Um not just what it's going to do to you in terms of your day in, day out, but also any litigation that may come up, you know, after the fact.
00:36:30.719 --> 00:36:38.880
And then ongoing, right, to say we want to do a our level best to ensure stuff is protected.
00:36:39.119 --> 00:36:42.480
You know, we we look at it as a layered approach, right?
00:36:42.719 --> 00:36:47.840
As a security blanket where you have your incoming traffic through your firewall.
00:36:48.159 --> 00:36:51.199
Um you would be shocked how many people do not have firewalls.
00:36:51.440 --> 00:36:55.760
Um that is where we're able to see traffic coming in.
00:36:55.920 --> 00:37:02.639
Um we're able to do you know website filtering based off um categorization.
00:37:02.800 --> 00:37:17.840
You know, every website out there is supposed to be categorized, um, whether it be uh social media, shopping, you know, grocery, whatever, but then you have you know the ones that certainly are at more risk, pornography and gambling and things of that nature.
00:37:18.079 --> 00:37:21.039
Well, if and then there's the ones that are uncategorized.
00:37:21.440 --> 00:37:25.360
Well, look, we don't we don't want you going to something that hadn't been categorized.
00:37:25.519 --> 00:37:25.920
Right.
00:37:26.159 --> 00:37:34.960
We can always whitelist it if it's a legitimate, but let us check it first before we just start blanketly going anywhere.
00:37:35.199 --> 00:37:43.119
So we have that traffic because if we can keep you out of the areas of the World Wide Web that might be higher risk, then we're reducing risk.
00:37:43.280 --> 00:37:43.440
Yeah.
00:37:43.599 --> 00:37:45.280
Uh and that's the that's the easy button.
00:37:45.360 --> 00:37:47.679
Having a firewall that goes in and does that.
00:37:47.920 --> 00:37:57.039
And then the machine itself, right, is hey, let's say you inadvertently click on something that um you shouldn't have.
00:37:57.199 --> 00:38:06.320
Um, even from a legitimate website, there have been plenty of people that have been compromised that have gone to a legitimate website, but that website was compromised.
00:38:06.559 --> 00:38:11.920
There was a little hyperlink that somebody put on there, or a Java excerpt, you know, whatever.
00:38:12.079 --> 00:38:18.400
Um, and having that machine, or somebody throws a thumb drive on there, you know, and it had something on it.
00:38:18.639 --> 00:38:20.320
That machine has to be protected.
00:38:20.400 --> 00:38:24.079
And then lastly, is of course your email, right?
00:38:24.239 --> 00:38:26.960
So your email is coming into the cloud service.
00:38:27.119 --> 00:38:29.199
Your machine is just looking up to the cloud app.
00:38:29.440 --> 00:38:29.679
Right.
00:38:29.840 --> 00:38:39.280
Um your email needs to be set up and filtering email addresses to look and see, hey, is this attachment legitimate?
00:38:39.440 --> 00:38:42.400
Um, what is it doing if it's run?
00:38:42.960 --> 00:38:47.840
And this domain that it came from, how old is this domain?
00:38:47.920 --> 00:38:55.440
You know, all of those analytics that it's running behind the scenes to say, you know, true email filtering needs to be taking place.
00:38:55.599 --> 00:39:12.960
And those are the three aspects that you know you're that really give you the most protection, the most bang for your dollar is making sure that you have a firewall in place, you have your Windows or Mac devices are being protected, not just with antivirus, but also the updates.
00:39:13.519 --> 00:39:16.719
Microsoft pushes out updates about every Tuesday.
00:39:16.800 --> 00:39:24.480
It's called patch Tuesday for a reason, and it's because they found issues in their solution or in their product, and they want you to fix it for them.
00:39:24.559 --> 00:39:25.199
Yeah.
00:39:25.440 --> 00:39:33.840
Well, if there's bad enough solution or problems, those attackers are aware of them, and they're now targeting those machines out there with that.
00:39:34.239 --> 00:39:42.400
So um the security through the firewall, the endpoint itself, and then your email, your hosting service through it.
00:39:42.559 --> 00:39:44.239
Those are the the big three.
00:39:44.480 --> 00:39:47.920
Lastly, would be your your security awareness training for an employee.
00:39:48.400 --> 00:39:53.840
Those are the those are the four things that really should be focused on for ongoing good security posture.
00:39:54.400 --> 00:39:56.000
Okay, that's good stuff.
00:39:56.719 --> 00:40:12.000
Well, that concludes today's part one of the episode for cybersecurity uh on small clinics, talking about what impacts that can have on your clinic, what we can do to protect ourselves from that.
00:40:12.400 --> 00:40:28.079
The next part will discuss how we can prevent those, more specifically about cybersecurity insurance, and then talk through these key takeaways that we want you to have to help your practice stay at its peak performance.
00:40:28.320 --> 00:40:30.320
Join us on the next episode.
00:40:30.719 --> 00:40:33.360
Thank you for joining Cumberland Conversations.
00:40:33.519 --> 00:40:36.880
We're proud to support the people who care for Tennessee's children.
00:40:37.039 --> 00:40:45.519
Don't forget to subscribe so you never miss an episode and stay connected with CPF for more tools, trainings, and community updates.
00:40:45.760 --> 00:40:47.599
Until next time, take care.
00:00:00.080 --> 00:00:02.240
Hey there, welcome to Cumberland Conversations.
00:00:02.399 --> 00:00:07.679
This is the place where we talk about the issues that matter most to you, your patients, and your community.
00:00:07.839 --> 00:00:12.720
We're diving into real conversations with real people, sharing insights you can actually use.
00:00:12.880 --> 00:00:14.640
Let's get the conversation started.
00:00:14.960 --> 00:00:23.760
Hi everyone, it's Michael Hook, Director of Research and Education for Cumberland Pediatric Foundation, welcoming you to this episode of Cumberland Conversations.
00:00:24.079 --> 00:00:41.920
Today is an episode of the CPF Spotlight, where we discuss important business topics, highlight some of our community partners and clinics, and give you important takeaways that can help your practice stay at its peak performance.
00:00:42.560 --> 00:00:51.679
Today I'm joined by Jason Wheeler of Sipio Technologies to discuss cybersecurity and the inherent risks for small pediatric clinics.
00:00:51.920 --> 00:00:54.479
Jason, thank you so much for joining us today.
00:00:55.119 --> 00:00:56.399
Very important topic.
00:00:57.200 --> 00:01:00.799
And there's a lot of misconceptions around cybersecurity.
00:01:00.960 --> 00:01:08.560
So before we get into that, tell me a little bit about your role at SIPO, how you got into this, like cybersecurity, man.
00:01:08.719 --> 00:01:08.799
Yeah.
00:01:08.959 --> 00:01:10.319
Yeah, so thanks for having me.
00:01:10.879 --> 00:01:16.159
Jason Wheeler, Director of Client Engagement, also a partner of SIPO Technologies.
00:01:16.480 --> 00:01:24.239
You know, I got into IT by default, honestly, a lot of on-the-job training.
00:01:24.319 --> 00:01:28.879
Uh started off at 19 years old delivering toner for a copier company.
00:01:29.040 --> 00:01:32.640
At that time, the copier company was simply copiers.
00:01:33.359 --> 00:01:35.040
You pushed it in, they made copies.
00:01:35.120 --> 00:01:36.079
That's all it was.
00:01:36.560 --> 00:01:42.560
So I was fortunate enough during my time there to see copiers go from analog to digital.
00:01:42.719 --> 00:01:47.200
You know, I would push a copier in and say, hey, I need to set this up to scan or print.
00:01:47.280 --> 00:01:49.680
And people would be like, that can scan and print?
00:01:49.920 --> 00:01:52.239
I mean, they hadn't, you know, they were not accustomed to that.
00:01:52.480 --> 00:02:01.840
So I was those customers did not have anybody in staff, on staff, to to set up shared print uh file folders.
00:02:01.920 --> 00:02:07.040
Um they didn't have access to set up email accounts for scanning.
00:02:07.280 --> 00:02:10.719
So we started doing some of that service for them.
00:02:10.879 --> 00:02:25.680
Um and then it transitioned from that on into uh document management solutions, um, and then the workflow around those document management solutions as well as the security around who has access to these file folders, right?
00:02:25.919 --> 00:02:26.960
Now they're electronic.
00:02:27.120 --> 00:02:31.680
It's not just in a file folder and in a file cabinet locked, right?
00:02:31.759 --> 00:02:34.400
Now it's out on the network who can get to it.
00:02:34.560 --> 00:02:38.879
So then it built on into that IT uh security portion of it.
00:02:39.120 --> 00:02:45.599
And then we saw the need from our customers saying, Hey, um, you're doing all this other stuff for me.
00:02:45.680 --> 00:02:47.520
Can you do my desktop support?
00:02:47.680 --> 00:02:57.039
Um so I've been able and been fortunate to be involved in that technology change and trend and see how the landscape has changed over the years.
00:02:57.120 --> 00:03:07.120
Um to now where, as I am the director of client engagement, I get to be out still daily talking to every industry there is really.
00:03:07.199 --> 00:03:15.120
Um we don't have a focus on any specific industry because honestly, we believe that all industries have the same needs.
00:03:15.360 --> 00:03:21.919
Um while there may be some that have more compliance that they must meet, but they still have the same needs.
00:03:22.080 --> 00:03:22.240
Yeah.
00:03:22.400 --> 00:03:28.800
So I it's interesting you say just this going from analog to uh where we're at today.
00:03:28.960 --> 00:03:44.719
Uh I was just thinking going from old notebooks and daily planners to the BlackBerry to now our smartphones, and thinking through how cybersecurity kind of developed along that line and and how we didn't even think about cybersecurity years ago.
00:03:44.879 --> 00:03:50.159
Um I don't know, I had a Blackberry, and I don't know that I ever thought about cybersecurity about what the risk was.
00:03:50.560 --> 00:03:53.599
But inherently there wasn't anything at the time, right?
00:03:54.240 --> 00:03:55.680
You know, I'm sure that there was.
00:03:55.840 --> 00:04:07.759
Um I I think even I think it was, if I remember correctly, um President Obama, you know, wanted to keep his Blackberry because it was actually one of the most secure devices out there because of the way they transmitted.
00:04:07.919 --> 00:04:12.400
Um and Blackberry Enterprise at the time was like r really long gone.
00:04:12.560 --> 00:04:14.719
Um but they were adamant he wanted to keep it.
00:04:15.199 --> 00:04:17.759
It seems like it was um President Obama.
00:04:17.920 --> 00:04:21.759
But yeah, I mean I think there was because the data exchange, right?
00:04:21.920 --> 00:04:28.959
When you start incorporating email, um you start incorporating honestly, um, a lot of the FBI.
00:04:29.040 --> 00:04:40.079
I I knew some some agents that worked for the forestry service that they used BlackBerries, and they kept a lot of evidence uh pictures um on those phones.
00:04:40.319 --> 00:04:43.759
So it was it was it was trending that way, right?
00:04:43.920 --> 00:04:50.720
They might not have known the impact, but the data was there, and how was it accessible by the bad actors, right?
00:04:50.800 --> 00:04:50.959
Yeah.
00:04:51.600 --> 00:04:52.720
That's interesting.
00:04:53.120 --> 00:05:04.800
So most of our audience that listens to the podcast and really members of the foundation are small practice uh clinics, they are physicians, they're mid-level providers, they're practice managers.
00:05:04.959 --> 00:05:24.000
Um and they understand that cybersecurity matters, but when you're you're focused on being a busy practice manager, you're looking at, you know, busy schedule, you're trying to manage uh staff shortages, uh, you're looking at finances, have we seen enough patients?
00:05:24.160 --> 00:05:25.439
We've our patients coming in.
00:05:25.519 --> 00:05:27.120
You there's a lot going on.
00:05:27.519 --> 00:05:37.439
How do we make this make sense to us in that setting when it's kind of one of those things that kind of, yes, I gotta deal with it, but I don't really feel it's that important.
00:05:37.600 --> 00:05:39.040
How do I make it important?
00:05:39.759 --> 00:05:44.319
Yeah, I think um you you nail it is that they they have a job to do, right?
00:05:44.399 --> 00:05:45.759
And it's not IT.
00:05:46.000 --> 00:05:51.439
Um they they talk to other cohorts, uh they they understand, they hear it, right?
00:05:51.600 --> 00:05:54.560
In the news, they hear about all the big people, right?
00:05:54.720 --> 00:05:56.959
Um that's been compromised.
00:05:57.120 --> 00:06:06.879
And I heard somebody say one time, and it was a great analogy, they said, you know, you you might not be, you're not too small to be targeted.
00:06:07.360 --> 00:06:13.439
You might be too small to make the news when you've been compromised, but you're not too small to be targeted.
00:06:13.600 --> 00:06:16.399
Um and nowadays you're not really targeted.
00:06:16.560 --> 00:06:24.639
Um I mean, certainly there are bad actors that are going after big um spear phishing campaigns and big the big industries.
00:06:24.879 --> 00:06:36.079
But as a day-in, day-out business owner or of any industry, you're at risk because these bad actors are pushing out to the masses.
00:06:36.240 --> 00:06:39.920
You know, their goal is to hit as many people as possible.
00:06:40.079 --> 00:06:43.279
It doesn't matter where they are, that's where the money's at for them.
00:06:43.519 --> 00:07:12.560
Um and to step back with the practice administrators and and the practice owners and the physicians and say, let's talk through in a small common sense approach to what has to be done on your machines, uh, on your email accounts, on your network that will impact you positively to reduce your risk, but it has to be an ongoing thing.
00:07:12.720 --> 00:07:14.399
It's not a set it and forget it.
00:07:14.480 --> 00:07:14.720
Right.
00:07:14.879 --> 00:07:18.160
It's a proactive approach versus a reactive approach.
00:07:18.319 --> 00:07:27.439
And to sit down and talk to them about that and and just explain it in those sense, they I think really get a better understanding of it.
00:07:27.600 --> 00:07:35.120
It's sometimes it's very from an outsider looking in that really doesn't understand it, it's it's a lot of money, they think.
00:07:35.279 --> 00:07:40.560
Uh it's gonna be a lot more time, I'm gonna have to deal with it, even though you tell them we're we're taking it away.
00:07:40.639 --> 00:07:42.319
That's that first blush.
00:07:42.480 --> 00:07:42.639
Right.
00:07:42.800 --> 00:07:43.279
Right, right.
00:07:43.360 --> 00:07:48.160
Um so being able to sit there and talk to them about that and say, look, this is some common sense stuff.
00:07:48.319 --> 00:07:51.839
Um that's the best what the starting point, right?
00:07:52.399 --> 00:07:54.639
So common sense.
00:07:55.199 --> 00:08:01.680
Small clinics are targeted, or maybe not targeted, but are definitely an open access point to information.
00:08:01.920 --> 00:08:06.639
We were talking beforehand about information is really what they're going at.
00:08:06.959 --> 00:08:30.480
Um what what has changed in the last few years that you've seen that's that's trending that's different from what we knew, say pre-pandemic or even just coming out of the pandemic, that we focus on you know these phishing scams and they're really trying to just get baseline information on your business to try to capture your business, but that's not what is happening, right?
00:08:30.639 --> 00:08:30.800
Right.
00:08:31.040 --> 00:08:32.080
That's that misconception.
00:08:32.240 --> 00:08:37.919
We're we're looking at um access points to get a ton of other information.
00:08:38.240 --> 00:08:38.480
Yeah.
00:08:38.720 --> 00:08:48.720
Yeah, and and really um, you know, I as we talked about, I think that the trend now is it it's always been to some degree disruption, right?
00:08:48.960 --> 00:08:57.039
Um years ago, certainly the the thought was they're trying to get my stuff to, you know steal my credit, right?
00:08:57.279 --> 00:08:57.519
Right.
00:08:57.759 --> 00:09:00.960
That's that's yes, that happens still for sure.
00:09:01.039 --> 00:09:03.200
Um, but really it's disruption.
00:09:03.440 --> 00:09:12.960
They want to be able to come in and say, I'm gonna lock you down from being able to do your business for the next ever how many days until you pay me.
00:09:13.200 --> 00:09:15.039
They they don't care what's in there.
00:09:15.360 --> 00:09:17.840
I mean th potentially, right?
00:09:18.000 --> 00:09:18.159
Right.
00:09:18.399 --> 00:09:31.679
Um, you know, when the Treasury Department was compromised, I would say a large majority of all of our Social Security number and information I mean the Treasury Department was compromised, um, was all relaked.
00:09:32.159 --> 00:09:46.399
Now the effort I think is as many people as I can touch, the more I can get my fingers into somebody's network, the more likelihood I am to cause a disruption in their business.
00:09:46.639 --> 00:09:46.960
Yeah.
00:09:47.200 --> 00:09:49.440
Um it's not about the patient.
00:09:49.600 --> 00:09:51.279
I'm not trying to get a patient's information.
00:09:51.440 --> 00:09:51.600
Yeah.
00:09:51.759 --> 00:09:52.240
I have that already.
00:09:52.559 --> 00:09:55.759
Yeah, I mean, if they're going to get the patient information, you know what they're gonna do with it.
00:09:55.840 --> 00:09:58.799
They're gonna hold it hostage to get money from you.
00:09:58.960 --> 00:10:03.519
Um they're gonna hold that it it's not really that they're wanting to sell it out there.
00:10:03.759 --> 00:10:06.879
I mean, the I I'm sure there are, right?
00:10:07.039 --> 00:10:07.279
Yeah.
00:10:07.519 --> 00:10:10.559
But it's it's business to these attackers.
00:10:10.720 --> 00:10:16.799
Um I I I dealt with and and worked with uh a um a school years ago.
00:10:16.960 --> 00:10:20.159
They called us up and said, Hey, we we need some help.
00:10:20.320 --> 00:10:22.159
We weren't doing business with them at the time.
00:10:22.399 --> 00:10:27.759
It was Christmas Eve, they had been compromised, um, took their whole network down.
00:10:28.080 --> 00:10:30.799
Um school started back in three weeks.
00:10:31.039 --> 00:10:40.240
Um and he told me, he said, Jason, this group I've dealt with uh he was uh IT director for many years.
00:10:40.399 --> 00:10:43.360
He said, I have dealt with a lot of vendors.
00:10:44.000 --> 00:10:48.159
He said, This has been the best customer service experience that I've ever dealt with.
00:10:48.879 --> 00:10:52.159
And he said, when I would call them, they would answer.
00:10:52.399 --> 00:11:04.799
When I would email them, they would he said they even said, you know, hey, you pay us our money, we'll get you back online by the end of the day, and we'll show you how we did it so you can protect yourself from doing it again.
00:11:05.120 --> 00:11:09.120
He said that's when I realized they this is a business for them.
00:11:09.360 --> 00:11:09.519
Yeah.
00:11:09.679 --> 00:11:11.600
You know, they are simply making money.
00:11:11.759 --> 00:11:12.000
Yeah.
00:11:12.159 --> 00:11:12.480
You know.
00:11:12.799 --> 00:11:27.200
I think I think you also said uh um uh a couple weeks ago when we were talking about this episode, there and this might be the same uh scenario of I will show you where your vulnerabilities were so that it doesn't happen again.
00:11:27.360 --> 00:11:27.679
Yeah.
00:11:27.919 --> 00:11:30.559
I was able to exploit it, anybody else can exploit it.
00:11:30.720 --> 00:11:31.759
What do we need to protect that?
00:11:32.080 --> 00:11:35.120
But that's kind of a a key thing that Scipio can do.
00:11:35.279 --> 00:11:41.519
Um so talk through that process real quick to just say like where does Scipio come in play?
00:11:41.759 --> 00:11:42.159
Sure.
00:11:42.399 --> 00:11:47.919
Yeah, so we we kind of take that layered approach to your network security.
00:11:48.159 --> 00:11:59.120
There's there's not one magic bullet out there that cures everything, and there's no MSP uh that can make you HIPAA compliant, that can make you 100% protected.
00:11:59.279 --> 00:12:02.000
There's not any uh in-house IT, right?
00:12:02.320 --> 00:12:05.600
You look out there, everybody's at risk.
00:12:05.840 --> 00:12:15.840
Um what we want to do is bring that common sense um solutions into the organizations that reduce your risk, all right?
00:12:17.279 --> 00:12:33.759
You we all know that you have budgets, we all know that they have to work in that budget front time frame, but we can put stuff in place that reduces it from the network layer down to the email layer down to the desktop protection layer.
00:12:33.919 --> 00:12:37.600
You know, those are the three really entry points into the network.
00:12:37.759 --> 00:12:45.759
And you have to focus on all three of those um simultaneously because one without the other two puts you at risk.
00:12:45.919 --> 00:12:46.159
Yeah.
00:12:46.399 --> 00:12:59.279
Um and so it's it's bringing in solid solutions that are cost-effective, um, budget-minded, and but reliable and monitorable solutions.
00:12:59.440 --> 00:12:59.840
Yeah.
00:13:00.159 --> 00:13:01.919
Proactive solutions, we could even say.
00:13:02.320 --> 00:13:02.480
Right.
00:13:02.559 --> 00:13:04.240
No, you definitely want to be more proactive.
00:13:04.480 --> 00:13:11.519
That's the idea of having this talk is to make sure that clinics have the opportunity to prevent something before it happens, right?
00:13:11.919 --> 00:13:18.159
Um but thinking through cybersecurity, there's a lot of misconceptions.
00:13:18.320 --> 00:13:28.080
So we talked about you know, small clinics uh thinking they're they're not necessarily the target, they're vulnerable, um, we're not necessarily going for information.
00:13:28.240 --> 00:13:33.200
What other misconceptions do you know or are most common with cybersecurity?
00:13:33.600 --> 00:13:40.080
I tell you one that I hear a lot of, specifically in clinics, is um that we're we're quote, good.
00:13:40.240 --> 00:13:41.279
We're covered, right?
00:13:41.440 --> 00:13:42.720
Because our EMR is in the cloud.
00:13:42.960 --> 00:13:43.840
Overconfidence.
00:13:44.080 --> 00:13:45.279
They're overconfidence.
00:13:45.519 --> 00:13:47.039
Because our EMR is in the cloud.
00:13:47.120 --> 00:13:47.279
Yeah.
00:13:47.519 --> 00:13:50.080
We don't have a server, we're good, right?
00:13:50.159 --> 00:13:52.240
They we hear that a lot.
00:13:52.399 --> 00:14:03.039
Um I don't store confidential information or or health information, but your devices access that information.
00:14:03.360 --> 00:14:11.120
And if I can act, as I'm a bad actor, if I can access your device, yes, I can access that information.
00:14:11.279 --> 00:14:23.919
Um so that is one that a lot of people think they put that onist on the EMR that's cloud and says, I don't even need cloud, I don't need cybersecurity insurance because they're handling it for me.
00:14:24.080 --> 00:14:24.240
Yeah.
00:14:24.320 --> 00:14:25.600
I'm not responsible for it.
00:14:26.159 --> 00:14:32.639
You're responsible for your due diligence to make sure your patient data is resp is uh uh protected.
00:14:32.799 --> 00:14:34.639
That's what your responsibility is.
00:14:34.799 --> 00:14:44.080
And meaning that means if somebody gets on your machine and they can do keyboard stroke logging and things of that, they can get into your cloud-hosted environment.
00:14:44.320 --> 00:14:50.399
Um that's a big misconception that we can wipe our hands of it because somebody else hosts it for us.
00:14:50.960 --> 00:14:53.519
So pretty much everybody is vulnerable.
00:14:53.679 --> 00:14:58.159
It doesn't matter what type of device you have, how you handle your information.
00:14:58.399 --> 00:15:02.480
Uh yes, you know, extenuating circumstances uh aside.
00:15:03.039 --> 00:15:11.919
Um so let's kind of reframe this then a little bit and think through what does a cybersecurity attack look like?
00:15:12.240 --> 00:15:19.519
So walk me through the the steps, like what's happening um from the start of when that attack comes in.
00:15:19.679 --> 00:15:20.559
What does that look like?
00:15:20.960 --> 00:15:21.600
What's happening?
00:15:22.240 --> 00:15:26.559
Typically what we see is through a phishing campaign, right?
00:15:26.879 --> 00:15:31.600
Um and the user receives an email.
00:15:31.840 --> 00:15:38.960
Um they uh either assume it is from, they they read the address and assume that it's legitimate.
00:15:39.200 --> 00:15:41.679
Um many times it is legitimate.
00:15:41.840 --> 00:15:57.600
Um many times an outside entity has been compromised and once they're compromised, let's say my email address is compromised, and you and I have been communicating about the podcast, right?
00:15:58.000 --> 00:16:08.799
And I now you start getting emails from me that are a little off topic from the but I say, hey, click on this document and see if it sounds good, right?
00:16:09.039 --> 00:16:16.320
And you click on it, it's a PDF, and it says, Hey Michael, I need you to put your credentials in to open this PDF.
00:16:16.399 --> 00:16:22.559
And you type your email and you type your password and you hit enter and it doesn't do anything.
00:16:22.720 --> 00:16:24.559
And you think, well, I must have done something wrong.
00:16:24.799 --> 00:16:25.440
Let me try it again.
00:16:25.759 --> 00:16:28.159
Double click it again, you do it again.
00:16:28.320 --> 00:16:31.279
Well, as soon as you did that, I've got your credentials, right?
00:16:31.360 --> 00:16:37.200
I'm able to now because what I've tail told that PDF to do is send me this.
00:16:37.679 --> 00:16:41.600
Open up a mirrored-looking uh login to Microsoft.
00:16:41.840 --> 00:16:45.759
When he types it, keystroke log it, and then send it back to me.
00:16:46.080 --> 00:16:49.600
So keystroke logging is essentially recording.
00:16:50.320 --> 00:16:52.159
Yeah, it's recording what you're typing in there.
00:16:52.639 --> 00:16:53.840
And then it's sending it out.
00:16:54.000 --> 00:17:01.519
When you hit enter to submit your credentials, that's saying, because the the programmers are writing it to do what they want it to do.
00:17:01.840 --> 00:17:07.279
And we can talk about, I think we talked about this years or from years ago, but they're writing it to do what they want it to do.
00:17:07.359 --> 00:17:10.079
And so it's sending them my credentials.
00:17:10.400 --> 00:17:24.640
Well, now, you know, I or um the bad actor can be anywhere in the world if you're using a you have a web-based enabled email account, whether it be Google, O365, Apple, whatever, right?
00:17:24.720 --> 00:17:25.920
It's they're all web-based.
00:17:26.000 --> 00:17:26.400
Yeah.
00:17:26.640 --> 00:17:32.160
Um and I can now log in to your email from anywhere in the world.
00:17:32.319 --> 00:17:37.359
Um as long as I don't have if I don't have MFA turned on, right?
00:17:37.440 --> 00:17:37.599
Right.
00:17:37.920 --> 00:17:40.960
There's my stop gap for the first start, right?
00:17:41.039 --> 00:17:41.279
Yeah.
00:17:41.440 --> 00:17:45.039
All right, I've got his credentials, I got his email, I'm gonna log in.
00:17:45.279 --> 00:17:59.119
What we want it is the free furt um feature of MFA to be enabled, doesn't cost anything, so that when I do log in or the bad actor logs in, it then send me the code, that the next code, right?
00:17:59.200 --> 00:18:02.160
And that should be on your cell phone or another device.
00:18:02.319 --> 00:18:09.200
And so unless they have that physical device or they've you know done some very high-tech hashing, um, typically it stops them.
00:18:09.279 --> 00:18:09.440
Yeah.
00:18:09.680 --> 00:18:12.480
You know, that's again, it's a free solution.
00:18:12.640 --> 00:18:16.960
Um but you know, we've seen this from years ago.
00:18:17.200 --> 00:18:33.279
Um I think the biggest one of the one of the first really um viruses I saw that I thought was really, really sophisticated but so simple was what we all dealt with years ago was the old pop-up ad.
00:18:33.440 --> 00:18:40.319
It would be a big pop-up ad from Microsoft and say, hey, your machine is at risk and needs to be scanned for viruses.
00:18:41.039 --> 00:18:44.000
Hit yes to scan now or no to scan later.
00:18:44.400 --> 00:18:44.960
And everyone.
00:18:45.359 --> 00:18:46.960
You didn't have Norton virus on there.
00:18:47.039 --> 00:18:47.119
Yeah.
00:18:47.359 --> 00:18:48.880
Or McAfee, whatever, you know.
00:18:49.119 --> 00:18:49.279
Yeah.
00:18:49.359 --> 00:18:51.440
And people would hit yes or no, right?
00:18:52.000 --> 00:18:54.880
Well, if they'd say no, it'd really install.
00:18:55.039 --> 00:18:56.960
If you said yes, it would install the virus.
00:18:57.119 --> 00:18:59.119
If you said no, it would install the virus.
00:18:59.279 --> 00:19:02.079
Because the bad actors wrote it to do what they want it to do.
00:19:02.400 --> 00:19:12.160
Well, then if you remember, they said, hey, if you have this pop-up, don't click on anything, go up to the X and X out of it.
00:19:12.960 --> 00:19:19.759
Well, this is how this is just, in my opinion, this is proof that they are always working to be one step ahead of us.
00:19:20.799 --> 00:19:26.880
Well, all of a sudden, that pop-up, now when you click the X, it installed it too.
00:19:27.119 --> 00:19:28.720
They rewrote the program.
00:19:28.960 --> 00:19:46.720
They heard what IT managers and directors and staff were telling the end users, they then rewrote that pop-up, so when you hit X, that's why you will probably remember that people said if it pops up, don't click yes or no or X out of it, do Control Alt Delete and End Task.
00:19:46.880 --> 00:19:52.880
That's where many people had never even heard of Control Alt Delete and what Task Manager did until that happened.
00:19:53.039 --> 00:19:56.079
Um, and that started clicking, you know, people started doing that.
00:19:56.240 --> 00:20:08.960
But that was where we really I feel like I first witnessed the bad actors looking at what we're doing and writing to you know, socially engineer their solutions.
00:20:09.359 --> 00:20:35.920
I I think this this speaks to also why it's so important to do training with your staff, because I've even seen where these bad actors are pulling out some of those antiquated processes or those approaches to to try to trick you because you're expecting the new and improved approach and they pull out one of these, hey, your device needs to be restarted or your device needs this.
00:20:36.079 --> 00:20:41.440
I I mean, I get them on my phone, I get them on my personal email, uh, personal computer, everything.
00:20:41.680 --> 00:20:51.279
So it's important to do training, but it's also important to make sure that culturally as a clinic that your staff understands, don't freak out.
00:20:51.759 --> 00:21:12.000
Yes, you're busy, you have a lot to do, but just pause, make sure that you understand what it is, and ask for help or or you know, use the recommended, you know, if you're a CPO uh client, using what you guys recommend as here's what we do when this pops up on our computer.
00:21:12.319 --> 00:21:12.559
Yeah.
00:21:12.720 --> 00:21:18.960
And I think having you know, having a a group that you can, or whether it be in-house or outsourced, right?
00:21:19.200 --> 00:21:26.079
Having a group that you can leverage that says, hey, I need somebody to validate this email for me, right?
00:21:26.240 --> 00:21:30.960
Um, or honestly, I I messed up.
00:21:31.119 --> 00:21:31.440
Yeah.
00:21:31.599 --> 00:21:33.279
I need somebody to look at this.
00:21:33.440 --> 00:21:35.599
I I clicked on something and I think I messed up.
00:21:35.680 --> 00:21:35.839
Yeah.
00:21:36.000 --> 00:21:49.759
It doesn't take long for once you've done that, because many times we have seen that companies that don't have that individual, they don't want to self report to their boss that they clicked on something.
00:21:50.000 --> 00:21:54.000
And I mean they're they're scared that that their job's at jeopardy.
00:21:54.160 --> 00:22:09.359
Um especially in a clinic where you're dealing with PHI, it becomes uh a potential reportable Or almost always is reportable on uh HIPAA reports that there was a violation, and then you go through the process of notifying patients.
00:22:09.599 --> 00:22:16.319
Like there's a lot that I think scares staff into not reporting rather than just being safe.
00:22:16.640 --> 00:22:24.559
Yeah, and and I mean and so that right, the fact that you do nothing is the worst thing you know when you don't report it, because then it just grows.
00:22:26.079 --> 00:22:28.720
It can be very quickly out of hand.
00:22:28.799 --> 00:22:41.519
Um whereas if you're using someone and they're able to jump on the machine very quickly, um, log out all the sessions, reset the password, validate that something was sent.
00:22:41.680 --> 00:22:44.240
If it was, can what can we do about it?
00:22:44.400 --> 00:22:47.519
Um and then do scans of the machines and things of that nature.
00:22:48.079 --> 00:22:49.759
Just the worst thing to do is nothing.
00:22:49.920 --> 00:22:50.240
Yeah.
00:22:50.480 --> 00:22:57.759
Um so yeah, it's um having that uh resource available for you is huge, in my opinion.
00:22:57.920 --> 00:23:01.039
Um and the sc the training, right?
00:23:01.279 --> 00:23:04.960
It is um because it is very sophisticated now.
00:23:05.119 --> 00:23:13.839
I mean, they uh again, um many times you will be fished from legitimate emails that you are corresponding with.
00:23:14.319 --> 00:23:20.000
The reason you are being fished from me is because they see my sent items.
00:23:20.079 --> 00:23:28.640
Yeah, they see you and I are communicating, so they are targeting people that they and then they're also targeting your whole contact list.
00:23:28.880 --> 00:23:38.799
Oh, yeah, it's not always that you are getting uh anything unknown sender sending you something that's like here you that happens occasionally, yeah.
00:23:39.039 --> 00:23:44.319
But likely it's into somebody else's email and then going through there, the old chain letters.
00:23:44.400 --> 00:23:44.559
Yes.
00:23:44.880 --> 00:23:51.519
Um getting in there, then the pervasiveness of that creeps through their contacts, they it comes to you.
00:23:51.759 --> 00:24:04.160
It looks exactly like their email, and in most cases it can be their exact email, controlling their uh emails going out and then send you something, and now that all of a sudden they have it.
00:24:04.240 --> 00:24:04.400
Yeah.
00:24:04.720 --> 00:24:16.559
Um I know when at one point there was a change in the approach to send you an image of something, or they drop a uh an image in there and then there'd be a link.
00:24:16.799 --> 00:24:21.759
If the the button doesn't work on here, if it doesn't work, copy and paste this.
00:24:22.000 --> 00:24:22.640
Well, there you go.
00:24:22.799 --> 00:24:23.680
Now you have a virus.
00:24:23.839 --> 00:24:31.680
Like all those attempts thinking through that, has AI made this any worse?
00:24:32.000 --> 00:24:34.160
Uh you know, and it's made it better?
00:24:34.400 --> 00:24:35.599
Or what are we dealing with here?
00:24:35.839 --> 00:24:36.319
Uh oh man.
00:24:36.640 --> 00:24:38.240
Is AI part of the problem here?
00:24:38.400 --> 00:24:38.559
No.
00:24:39.039 --> 00:24:49.119
I mean, but seriously, is AI complicating this idea of cybersecurity and what do we need to do as clinics to try to manage now that aspect?
00:24:49.680 --> 00:24:53.200
I think certainly user awareness training.
00:24:53.680 --> 00:24:58.000
Um but use user awareness training can only go so far.
00:24:58.240 --> 00:24:59.200
We are human.
00:25:00.000 --> 00:25:06.319
If any if you look up any statistic, what is the biggest com uh risk of your organization?
00:25:06.559 --> 00:25:11.680
Doesn't matter what organization you are, when related to IT, your biggest risk is your employees.
00:25:12.000 --> 00:25:16.960
No matter how much you have put on there, how much security you have, because we're human, right?
00:25:17.119 --> 00:25:50.000
So AI right now has made it even more sophisticated in how they can target and approach because they can also get more information and be even more not predictable but more genuine in their email writings, where that they can go in and and script out an email based off other emails you and I have had and write it in a matter of seconds where it might see that you know, maybe I had I call you, hey Mikey, right?
00:25:50.480 --> 00:25:52.799
And you know I only call you Mikey.
00:25:52.880 --> 00:25:53.200
Yeah.
00:25:53.359 --> 00:25:57.039
Um and it starts using that, and it's like, oh, that's Jason.
00:25:57.200 --> 00:25:58.720
Nobody else calls me Mikey.
00:25:59.119 --> 00:26:00.640
You know, so very familiar.
00:26:01.039 --> 00:26:01.680
Very familiar.
00:26:01.759 --> 00:26:03.839
It's that's has to be Jason.
00:26:04.079 --> 00:26:39.680
Um, you know, I saw several months ago, I saw I think we talked about it, a 60 Minutes article where a woman who had a very big um you know Facebook following did social media, but also was a news reporter, and they did a little test, and they went out, it was I think with NBC or somebody, but she went out to the said she was out on the West Coast shooting a a bit and called um, supposedly called corporate office and said, Hey, I'm out here, and I left my credit card uh back at the office.
00:26:39.839 --> 00:26:43.119
Can you know, hey Sue, can you get me your credit card?
00:26:43.599 --> 00:26:45.279
And Sue said, I'm so sorry, yes.
00:26:45.359 --> 00:26:49.920
And she's like, hey, if you'll just give me that uh credit card, I'll get you reimbursed when I get back.
00:26:50.079 --> 00:26:54.960
Sue gave her a credit card, and every bit of it was done over AI.
00:26:55.599 --> 00:27:11.279
They went online, took all of her Facebook posts that had all of her audio and everything, downloaded it into a database, typed out exactly what they wanted it to say as she spoke on the phone over the computer, and it was a perfect match.
00:27:11.519 --> 00:27:13.839
And I was like, you know what?
00:27:14.079 --> 00:27:14.720
That's sophistication.
00:27:15.119 --> 00:27:16.079
That's sophistication.
00:27:16.240 --> 00:27:24.720
But also what it is, in my opinion, is it goes back to where I said they are always trying to stay one step ahead of us.
00:27:25.519 --> 00:27:30.640
You know, we had always said we want a good strong password.
00:27:31.200 --> 00:27:36.720
Then that strong password started becoming all right, people can it they can decrypt it, they can pa you know break it.
00:27:36.880 --> 00:27:39.200
So we need to do multi-factor authentication.
00:27:39.440 --> 00:27:43.279
Well, now banks and things require voice approval as well, right?
00:27:43.440 --> 00:27:43.599
Right.
00:27:44.160 --> 00:27:55.839
Well, to me, that's what they've just done, is said now if I can get their voice, and I think we've even heard this before that you know, people will make phone calls and they'll say, Hey, is this Jason?
00:27:56.240 --> 00:28:04.000
And they want you to say yes, because if they record you saying yes, then they can say Jason attested and agreed to this something, something.
00:28:04.559 --> 00:28:07.519
And so that's been going on for a couple years.
00:28:08.079 --> 00:28:10.880
Um now it's I think it's just gonna go deeper.
00:28:11.039 --> 00:28:20.720
Um so we have to be more diligent and more diligent and more diligent with our training and unfortunately our skepticism about what's legitimate and not.
00:28:21.039 --> 00:28:28.240
And I mean that's that's a world we live in, but there are tools that we can reduce our risk.
00:28:28.400 --> 00:28:28.559
Yeah.
00:28:28.720 --> 00:28:30.240
And that's that's the name of the game.
00:28:30.720 --> 00:28:34.559
Reduce the risk and I think maintain confidence in the approach.
00:28:34.720 --> 00:28:43.200
You know, we don't we're not trying to fear monger, we're not trying to create a sense of we can't do any of this kind of stuff because there's there's just no chance of winning.
00:28:43.440 --> 00:28:46.240
There's not is there it's not about trying to win.
00:28:46.400 --> 00:28:51.680
It's just trying to do the appropriate proactive step to try to prevent what we can, right?
00:28:51.920 --> 00:28:53.039
Lessen the damage.
00:28:54.400 --> 00:28:57.119
Not much unlike taking care of patients, right?
00:28:57.440 --> 00:29:03.279
We try to lessen lessen that as much as we can and triage um their their problems and so forth.
00:29:03.440 --> 00:29:07.039
Um not at all trying to get into a medical talk there at all.
00:29:07.279 --> 00:29:09.599
But um a lot of similarities.
00:29:09.680 --> 00:29:10.000
It really is.
00:29:10.400 --> 00:29:11.200
A lot of similarities.
00:29:11.440 --> 00:29:15.440
Um so we you mentioned uh multi-factor authentication.
00:29:15.680 --> 00:29:23.839
We talk about phishing and and this idea that clinics are are just as vulnerable as large hospitals.
00:29:23.920 --> 00:29:41.599
But I think uh another piece that is important to understand is the hyper-realistic scenarios that are presented, as what you're just suggesting with uh poor Sue, who now owns probably uh a new wardrobe and tons of stuff that she doesn't get to use, right?
00:29:42.160 --> 00:29:54.319
Um there are instances in relatively recent where even individuals who have seemingly top-of-the-line protection still fall prey to some of the stuff.
00:29:54.480 --> 00:30:00.160
So Mark Cuban uh had an issue where he was a victim of phish.
00:30:00.319 --> 00:30:04.880
Um I think um Mark Zuckerberg, a lot of marks apparently.
00:30:05.039 --> 00:30:11.119
Um Mark Zuckerberg had an issue uh where his password was hacked.
00:30:11.680 --> 00:30:34.960
Um and then others where they're especially healthcare executives, and really I think executives anywhere are getting spearfished or this idea of whaling where let's go for the big one, then they can kind of uh uh act as the decoy that we as the backed actor use to disseminate emails down to staff.
00:30:36.079 --> 00:30:38.720
I'm gonna click on something that my boss sends me.
00:30:38.880 --> 00:30:39.519
Why would I not?
00:30:39.680 --> 00:30:40.240
Yeah, right?
00:30:40.960 --> 00:30:49.279
Well, now there's an even greater impact by sending this stuff from the top all the way down to the bottom.
00:30:49.359 --> 00:30:50.000
Yeah.
00:30:50.480 --> 00:30:53.519
And and of course, too, the the the bad actors, right?
00:30:53.680 --> 00:30:59.519
That's a uh that's a gold medal for them, uh, to be able to say, I I hacked Zuckerberg.
00:30:59.599 --> 00:30:59.759
Yeah.
00:30:59.920 --> 00:31:01.039
Or I hacked Mark Hughes.
00:31:01.200 --> 00:31:04.079
Oh no, and it was and those those people were all over the news.
00:31:04.240 --> 00:31:04.960
They were proud of it.
00:31:05.200 --> 00:31:05.440
Yes.
00:31:05.680 --> 00:31:14.720
But the impact that that had, and as easy as it was for them to get into to those individuals' accounts and stuff, it's it's just amazing.
00:31:14.960 --> 00:31:15.200
Yeah.
00:31:15.519 --> 00:31:22.319
But so training, but how do we make that training against that kind of evolving situation?
00:31:22.480 --> 00:31:28.480
How do we make that training not seem scary and and create fear, but also not be boring?
00:31:28.799 --> 00:31:32.799
Like annual compliance is already all the time, somewhat boring.
00:31:32.960 --> 00:31:38.880
Like this is such an important and rapidly evolving risk.
00:31:39.200 --> 00:31:45.440
How do I train and make sure that my staff aren't just clicking through and actually able to pay attention?
00:31:45.680 --> 00:31:45.839
Right.
00:31:46.319 --> 00:31:49.119
I like to SIPIO, what does SIPIO suggest in terms of?
00:31:49.759 --> 00:31:52.720
So I think being being interactive with it is great.
00:31:52.880 --> 00:32:01.680
Um not the frequency of it is important, but sometimes too much frequency can make it just become dull and um you know forgettable.
00:32:01.920 --> 00:32:08.000
But small short-term um tests and and training is what I feel like does the best.
00:32:08.079 --> 00:32:12.400
Um, even making it into kind of some competition level stuff, right?
00:32:12.480 --> 00:32:18.640
Where, hey, you're you're people who scored 100% for the first three quarters or whatever, you know, get a little reward.
00:32:18.799 --> 00:32:20.880
I I think making it fun like that.
00:32:21.039 --> 00:32:24.720
It should not be something that is seen as a chore.
00:32:25.039 --> 00:32:35.519
Um I think it should be something that is seen as, hey, this should be five minutes and done, and it was enough information that I learned something new every time in a five-minute section.
00:32:35.759 --> 00:32:44.559
And it might be the smallest little tidbit, but if you can get your employees to buy in on it, they're gonna be take that away from you.
00:32:44.720 --> 00:32:52.400
And honestly, what we see a lot of times is the employees don't buy into it until the owners buy into it.
00:32:52.799 --> 00:32:56.240
And we up it has to come from upper management.
00:32:56.480 --> 00:33:08.000
Upper management has to be reiterating this and stressing the importance of it and never making it sound to them like we gotta do this again, right?
00:33:08.480 --> 00:33:11.920
Your employees hear you doing that, they're gonna take the same stance.
00:33:12.079 --> 00:33:12.319
Yeah.
00:33:12.559 --> 00:33:20.079
If upper management's not gonna be show the importance of protecting patient data, what do you think the lower you know employees are gonna do?
00:33:20.240 --> 00:33:21.359
They're gonna be in the same boat.
00:33:21.680 --> 00:33:26.799
Well, and and I think this even goes beyond just the idea of protecting patient data.
00:33:26.960 --> 00:33:29.519
It's protecting even their own information.
00:33:29.839 --> 00:33:32.880
Because they're accessing your personnel files, they're accessing everything.
00:33:33.359 --> 00:33:35.200
HR files for their employees, everything.
00:33:35.440 --> 00:33:35.759
Sure.
00:33:36.160 --> 00:33:50.160
Um and I think that's the the, in my opinion, the biggest misconception on cybersecurity is really just the the extent of what they're trying to do or get access to and then what they're trying to do with it, you know.
00:33:50.720 --> 00:33:55.839
But all of that said, everybody's vulnerable.
00:33:56.079 --> 00:33:58.319
We live in this this dire world, right?
00:33:58.480 --> 00:33:58.720
No.
00:33:59.200 --> 00:34:05.440
There's just some very real situations, um but there's ways to to prevent it, right?
00:34:06.000 --> 00:34:10.320
So how do we actually stop that?
00:34:10.960 --> 00:34:12.320
What do we do?
00:34:12.559 --> 00:34:17.360
What steps can be taken to prevent the attack that has already happened?
00:34:17.599 --> 00:34:23.679
And then I want to talk about what do we do to prevent it from starting completely.
00:34:24.400 --> 00:34:40.400
So certainly active in process attack is having someone who's overseeing the uh the accounts, uh, whether it be the machine itself, uh, whether it be the network or even the email hosting service, right?
00:34:40.559 --> 00:34:42.400
Whether it be 0365.
00:34:42.960 --> 00:34:58.480
You have to have someone there who understands, you know, let's do how to do trace route of emails and things of that nature for say, let's see, has have because a typical user would look in their sent items and say, nothing's been sent.
00:34:58.880 --> 00:35:00.320
I I'm good, right?
00:35:00.559 --> 00:35:14.559
Well, we have to dig deeper than that because we have found and see time and time again that the bad actor gets into your email, they send emails out, and then delete the sent items, and then delete it out of the deleted items.
00:35:14.639 --> 00:35:16.000
So you think there's nothing happened.
00:35:16.320 --> 00:35:21.840
So you have to have that expertise to go in and and really dig into it to see what's been done.
00:35:22.079 --> 00:35:33.679
And then to immediately have good software, antivirus, EDR, endpoint detect and respond uh solutions on there to ensure that the machine is clean.
00:35:34.320 --> 00:35:37.360
Is there concerns that maybe that machine is not clean?
00:35:37.440 --> 00:35:48.239
We need to decommission it, we need to bring it out of the network, we need to accept segregate it off of the network so that it's not potentially jumping to somebody else's machine.
00:35:48.320 --> 00:35:52.480
Uh and then what access did that user have to the network shares?
00:35:52.719 --> 00:35:58.880
Um again, we talk about, hey, my stuff's protected because I have a hosted EMR.
00:35:59.360 --> 00:36:02.079
Um that's great that it's in there.
00:36:02.239 --> 00:36:05.440
But I bet you're not storing your HR files in there.
00:36:05.599 --> 00:36:14.079
I bet you're not storing and that stuff local many times, and your employees don't want their stuff leaked either.
00:36:14.320 --> 00:36:14.559
Right.
00:36:14.800 --> 00:36:19.679
And so you have to your job as the business owner is to protect all data.
00:36:19.840 --> 00:36:20.159
Right.
00:36:20.400 --> 00:36:30.480
Um not just what it's going to do to you in terms of your day in, day out, but also any litigation that may come up, you know, after the fact.
00:36:30.719 --> 00:36:38.880
And then ongoing, right, to say we want to do a our level best to ensure stuff is protected.
00:36:39.119 --> 00:36:42.480
You know, we we look at it as a layered approach, right?
00:36:42.719 --> 00:36:47.840
As a security blanket where you have your incoming traffic through your firewall.
00:36:48.159 --> 00:36:51.199
Um you would be shocked how many people do not have firewalls.
00:36:51.440 --> 00:36:55.760
Um that is where we're able to see traffic coming in.
00:36:55.920 --> 00:37:02.639
Um we're able to do you know website filtering based off um categorization.
00:37:02.800 --> 00:37:17.840
You know, every website out there is supposed to be categorized, um, whether it be uh social media, shopping, you know, grocery, whatever, but then you have you know the ones that certainly are at more risk, pornography and gambling and things of that nature.
00:37:18.079 --> 00:37:21.039
Well, if and then there's the ones that are uncategorized.
00:37:21.440 --> 00:37:25.360
Well, look, we don't we don't want you going to something that hadn't been categorized.
00:37:25.519 --> 00:37:25.920
Right.
00:37:26.159 --> 00:37:34.960
We can always whitelist it if it's a legitimate, but let us check it first before we just start blanketly going anywhere.
00:37:35.199 --> 00:37:43.119
So we have that traffic because if we can keep you out of the areas of the World Wide Web that might be higher risk, then we're reducing risk.
00:37:43.280 --> 00:37:43.440
Yeah.
00:37:43.599 --> 00:37:45.280
Uh and that's the that's the easy button.
00:37:45.360 --> 00:37:47.679
Having a firewall that goes in and does that.
00:37:47.920 --> 00:37:57.039
And then the machine itself, right, is hey, let's say you inadvertently click on something that um you shouldn't have.
00:37:57.199 --> 00:38:06.320
Um, even from a legitimate website, there have been plenty of people that have been compromised that have gone to a legitimate website, but that website was compromised.
00:38:06.559 --> 00:38:11.920
There was a little hyperlink that somebody put on there, or a Java excerpt, you know, whatever.
00:38:12.079 --> 00:38:18.400
Um, and having that machine, or somebody throws a thumb drive on there, you know, and it had something on it.
00:38:18.639 --> 00:38:20.320
That machine has to be protected.
00:38:20.400 --> 00:38:24.079
And then lastly, is of course your email, right?
00:38:24.239 --> 00:38:26.960
So your email is coming into the cloud service.
00:38:27.119 --> 00:38:29.199
Your machine is just looking up to the cloud app.
00:38:29.440 --> 00:38:29.679
Right.
00:38:29.840 --> 00:38:39.280
Um your email needs to be set up and filtering email addresses to look and see, hey, is this attachment legitimate?
00:38:39.440 --> 00:38:42.400
Um, what is it doing if it's run?
00:38:42.960 --> 00:38:47.840
And this domain that it came from, how old is this domain?
00:38:47.920 --> 00:38:55.440
You know, all of those analytics that it's running behind the scenes to say, you know, true email filtering needs to be taking place.
00:38:55.599 --> 00:39:12.960
And those are the three aspects that you know you're that really give you the most protection, the most bang for your dollar is making sure that you have a firewall in place, you have your Windows or Mac devices are being protected, not just with antivirus, but also the updates.
00:39:13.519 --> 00:39:16.719
Microsoft pushes out updates about every Tuesday.
00:39:16.800 --> 00:39:24.480
It's called patch Tuesday for a reason, and it's because they found issues in their solution or in their product, and they want you to fix it for them.
00:39:24.559 --> 00:39:25.199
Yeah.
00:39:25.440 --> 00:39:33.840
Well, if there's bad enough solution or problems, those attackers are aware of them, and they're now targeting those machines out there with that.
00:39:34.239 --> 00:39:42.400
So um the security through the firewall, the endpoint itself, and then your email, your hosting service through it.
00:39:42.559 --> 00:39:44.239
Those are the the big three.
00:39:44.480 --> 00:39:47.920
Lastly, would be your your security awareness training for an employee.
00:39:48.400 --> 00:39:53.840
Those are the those are the four things that really should be focused on for ongoing good security posture.
00:39:54.400 --> 00:39:56.000
Okay, that's good stuff.
00:39:56.719 --> 00:40:12.000
Well, that concludes today's part one of the episode for cybersecurity uh on small clinics, talking about what impacts that can have on your clinic, what we can do to protect ourselves from that.
00:40:12.400 --> 00:40:28.079
The next part will discuss how we can prevent those, more specifically about cybersecurity insurance, and then talk through these key takeaways that we want you to have to help your practice stay at its peak performance.
00:40:28.320 --> 00:40:30.320
Join us on the next episode.
00:40:30.719 --> 00:40:33.360
Thank you for joining Cumberland Conversations.
00:40:33.519 --> 00:40:36.880
We're proud to support the people who care for Tennessee's children.
00:40:37.039 --> 00:40:45.519
Don't forget to subscribe so you never miss an episode and stay connected with CPF for more tools, trainings, and community updates.
00:40:45.760 --> 00:40:47.599
Until next time, take care.
