|
On January 31st, 2024, Ann Lurie’s, the largest children’s hospital in downtown Chicago, experienced a catastrophic ransomware breach that brought down their entire computer network, including phone systems. This incident not only affected the hospital but also had a ripple effect on numerous private clinics across the Chicagoland area connected to the same network. For instance, the clinic we visit for my 8-month-old son lost access to critical systems overnight, including patient schedules, medical records, vaccination history, doctor notes, billing, and insurance information. In response, clinic staff resorted to manual methods, jotting down doctor’s notes on paper, collecting insurance information via fax, and scheduling appointments using a traditional calendar. It took a staggering 78 days for the systems to fully recover, leaving parents like myself unable to even ask basic questions to our doctors as online portals were down and doctors were preoccupied with dealing with the fallout. This incident sheds light on the vulnerability of even well-funded institutions with compliance measures and internal technical teams. Now, consider the implications: What if your business faced a similar scenario, with your access to your technology and data severed for 78 days? Can your business weather such a storm?
Recent events, such as Microsoft’s struggles against Russian cyberspies and the discovery of un-patchable vulnerabilities in Apple computers with M-chips (M1, M2, and M3) are only the tip of the iceberg. It’s no longer a matter of if but when every business will encounter a cyber breach, and unfortunately, some will face it more than once. The goal now is not merely prevention but rather readiness and minimizing the impact when breaches occur.
Over the next few weeks, my goal is to present you with a comprehensive guide to achieving this goal. Delve into this discussion, as it not only provides technical insights but also outlines essential operational steps for you to undertake independently. Furthermore, armed with this blueprint, you’ll be empowered to personally oversee the safety, security, and continuity of your business.
This week, we’ll begin by addressing the core layer of this onion: your data. However, before we proceed, a quick disclaimer: while I offer expertise, I’m not a cybersecurity specialist, and individual risks and compliance needs vary from one business to another. If you’re considering professional assistance, I encourage you to reach out, so we can gather the necessary resources to effectively safeguard your business.
DATA PROTECTION
1. Begin by compiling a list of your crucial data. Remember, data encompasses more than just PDF documents on your computer; it includes your contacts, emails, QuickBooks database, and more. Consider all information vital to your business operations, regardless of where it’s stored.
2. Next, assess the presence and effectiveness of your anti-malware protection to safeguard your data. While there may not be any options for certain platforms like QuickBooks Online, surprisingly, protection exists for services such as Dropbox and many other cloud-based platforms.
3. Implement measures to monitor the state of your data. For instance, platforms like Dropbox offer email notifications for significant data modifications or deletions, enabling timely intervention. Similar monitoring features exist for computers and essential services like Microsoft 365 or G’Suite. While we utilize enterprise-grade tools for monitoring our client data, enabling built-in features to detect unauthorized access is something you can easily do on your own. Though these notifications may generate some noise, early detection saves lives.
4. Diversify your data protection strategy and never solely rely on a single provider. Always maintain backups. In the event of a provider breach such as Microsoft or DropBox, hackers factor in all internal backup systems, risking permanent data loss. Whether it’s an external drive or another cloud provider, ensure you have 2 to 3 copies of your data elsewhere. Review the important data list from Step 1 and confirm that all critical data, regardless of location, is backed up. Cloud-based services like QuickBooks Online may pose challenges; in such cases, instruct your office admin to save PDF reports as a secondary measure.
5. Regularly verify your data protection measures. Too often, clients assume they have backups in place, only to discover they haven’t been executed properly for months. Periodically check the functionality of your malware protection, monitoring settings, and backups to ensure they are current and data can be restored when needed.
Next week, I’ll delve into the steps for device protection. Take a few moments to create an internal checklist. Whether you decide to manage cybersecurity on your own or collaborate with your IT partner, prioritize it. Don’t hesitate to ask the tough questions and actively engage in the process, as the well-being of your business hinges on it. Remember, I’m here to support you every step of the way. With the right actions, you’ll be well-prepared for whatever comes your way
– Burak Sarac, Team Lead |
