Thanks to everyone who attended our November 4th webinar, Don’t Become the Next Cybersecurity Scary Story! We are grateful to our guest experts, Sean Nobles from NaviSec and Brett Haines from Atlantic.Net, for joining us. We discussed social engineering, PenTesting, ways to secure online accounts, how to guard against user error, and other best practices in cybersecurity.
If you submitted a question during the webinar, you will find the panelists’ responses below!
If you have not done so, you can still register to receive a recording of the webinar and a free Total HIPAA Training License!
I have a small ABA practice and we want to have two-factor authentication (2FA) but aren’t sure how to go about getting started. Do you have any advice for getting started?
NaviSec — I would point to Brett’s input during the webinar — lean on your vendors. For smaller shops, most major cloud-based solutions like Google Suite, Office 365, and banks will have built-in 2FA solutions that integrate with free mobile phone apps like Google Authenticator. For VPN, contact your MSSP. We’re a Fortinet shop and, out of the box, Fortinet includes a couple 2FA tokens for VPN users but other vendor solutions may vary.
A.Net — First, establish what systems your team uses and which need 2FA (e.g., VPN, Windows Servers, Linux Servers, Windows 10/11 Desktops, Macs, smart phones, etc.). Then spark up discussion with your IT manager or whoever you lean on for recommendations while also reaching out to vendors that supply 2FA. There are free versions of 2FA, however, it requires more work on your side so the recommendation is usually to start with looking at paid versions so installation, maintenance, updates, etc. are not a distraction from your core business. Duo by Cisco has been a popular provider, and you can look at other alternatives.
Do you have any thoughts on Sync rather than Dropbox or similar programs?
NaviSec — Each platform will have its own pros and cons. If your organization has compliance requirements like encryption at rest, file access monitoring, or backups, you may prefer one provider over another based on those features. Most of these providers have publicly posted security audit results and papers to roll up with your own compliance audits. The “best” solution will always be the one that best fits the use case.
A.Net — I am not too familiar with Sync and their offering. After a quick search I do see that Sync does offer a BAA here. This is a good sign for the start of your research into the provider. If the service provider doesn’t offer a Business Associate Agreement (BAA), then it would be a non-starter. I would start to ask around for reviews and insights about availability, backups, and best practices with Sync along with discussing with Sync themselves.
When using a VPN to connect to a production environment, you do not have control over the personal equipment and could open up the network to bad actors if the personal computer has been breached, correct?
NaviSec — That is correct. There are mitigating controls you can put into place like requiring endpoint compliance before allowing the machine to connect to the VPN. Fortinet’s VPN solution has client profile options that require certain patch levels/security posture of the connecting equipment to be allowed to join the VPN. Bring Your Own Device (BYOD) architecture can be very challenging to manage since you’re utilizing assets that the business doesn’t own to interact with company infrastructure and you generally can’t force employees to install software on their personal devices. I definitely understand the need for small companies to be cost sensitive but BYOD, in my opinion, is a very risky policy if the device is connecting to sensitive company networks and resources.
A.Net — If you do not have control over the personal device, yes, you do have the potential of opening up your network to potential compromised devices. It is best practice to segment your network in a way to not allow access for certain VPN users to systems they do not need access to. For example, if you are able to expose an accounting webpage that is on your internal network to only the accounting users on the VPN while blocking access to the rest of your network, then it reduces your exposure to potential bad actors. This should be part of your best practices per HIPAA regulations as well. It is “as needed” access based on roles in the company. With that said, if at all possible, it is best to not allow personal devices on your network that are not under control of your IT admins for the reason above and more. Once you give up control of devices on your network, your attack surface grows drastically.
How often do we need to change the SSH keys?
NaviSec — There may be compliance drivers for how often to change keys and passwords. Generally speaking, I would recommend using the same frequency as changing/expiring passwords or utilizing a centralized credential/authentication solution that manages key rotations in larger environments. I’m not super familiar with the solution but I believe this is one of Thycotic’s selling points.
A.Net — This ties into the same debate of when do you change passwords? I would follow the same protocols that you do for passwords and apply those to your SSH keys.
Can you include the NIST link for the password changes/requirements?
NIST Special Publication 800-63 Digital Identity Guidelines
Have you performed a Risk Assessment in the past year? Do you have updated HIPAA Policies and Procedures in place? Our HIPAA Prime™ program does all this and more! We create customized compliance documents and provide your staff with easy online training, ensuring compliance for your business.
Want to know more about how you can become HIPAA compliant?
Email us at info@totalhipaa.com to learn more about how we can help your organization become (and stay!) HIPAA compliant. Or, get started here.
