55. Aja Anderson: "It is frustrating to take the extra steps, yet it is keeping us safe."

Episode 55 of HIPAA Critical welcomes back Paubox Customer Success Manager, Aja Anderson, to discuss the findings of the Paubox HIPAA Breach Report for September 2021.

Rather read?

Aja Anderson:  Yeah, absolutely. It comes as no surprise to either of us. Network servers far and away outpaced all over platforms with over 4.5 million breaches. And this is a half-million increase from last month. 

There were two big breaches that stood out, there was a hospital health care provider group in Nevada, that had 1.3 million compromised and then there was another healthcare provider in Georgia, with 1.4. When you and I were going over the numbers, we both felt that that was interesting, right? 

Aja: Yeah, we didn't round these up. So we just found that interesting. Because it's not a trend that we've observed in the past. And I'm not casting aspersions, I'm just wondering,

Aja: Hmm. You know, we like you said, we're not I'm ever surprised by this data. 

Aja: Sure, well, we observed there was like a 20% drop, in breaches that were happening on email between this month and last. That's probably is related to folks going on vacation. There's just not as much email traffic. 

And this is something that we talk about when we meet, we have to understand what normal looks like for us and every customer is going to be a little bit different. There are some broad comparisons, you can draw based on how many individuals are sending traffic through the servers. 

But one of the benefits of Paubox is that we have these resources on our dashboard, that you can actually look at the statistics over a period of time, you can go back, you know, a year and look at your statistics of how many emails that you're receiving and sending and you can look for patterns. 

So we have an IT executive at one of our companies who is constantly monitoring that traffic and looking for changes, looking for minute changes, because as you pointed out, the email breaches don't have the same sort of occurrences. It's not as high as a number as the network servers. 

But it still has a big impact on these IT professionals that are running security for their companies. So what we're talking a lot about what I'm encouraging people to pay attention to, is their traffic, and to define what normal looks like. So if they see unusual activity, they can reach out immediately. 

That's what we're doing on the Paubox side. Our customer success managers are looking at that data. We're bringing that data into our customer meetings, and using that to stay alert.

Aja: Sure, absolutely. So there are a couple of breaches and attacks that we've touched on over the past few episodes. And in looking at those I realized all of them happened on some kind of major holiday weekend, it happened while our attention was elsewhere. 

Aja: Very, yeah, interesting how that keeps repeating. The JVS attack happened over Memorial Day. The Kaseya attack happened on [the] July 4th [weekend]. The colonial pipeline attack happened over Mother's Day, which is absolutely a holiday. We were focused on other things. The back door was open, essentially. One small thing, it's one small thing. It's interesting. 

I keep looking back at Kaseya. You asked me for an update, I was doing some research and was having trouble finding like a really concrete update as to what had happened. Because when we were discussing it, I believe, two months ago now, we noted that there just wasn't a whole lot of information as to what happened. 

And there was a blog that pointed out that Kaseya said it was a sophisticated attack 10 times in the statement that they released. And then that blog followed up with a log file that showed that the attack only took two seconds. 

Aja: Hopefully that's all kosher. It made me think for the first time about the jargon that's being used when these things are happening and whether the language kind of undermines how simple the ultimate security issue is, like how easy it could have been corrected had it been dealt with in advance? 

Aja: It didn't, it just left me with a lot of questions. 

Aja: You absolutely should because it is important to be proactive and getting people as much information as you can, as soon as you can. And also being honest about what it is that's going on. 

Because we talk about this every month, and we keep seeing these numbers increase, we keep seeing the number of folks that are compromised increase. This isn't a problem that's going away. We're headed into another holiday weekend. I'm wondering what's going to happen, once we get to Monday? What might have happened over this weekend?

The FBI actually released a statement saying, be aware, be prepared. They drew the parallel among all these attacks this summer happening over the holiday. So they're saying that you need to pay attention to the routine activity, look at your architecture, establish a baseline, you know, understand what normal looks like, understand what an anomaly might look like. 

It's important to have logs, you know, look at audit logs, you know, who's the last user that changed something? And understanding your data, understanding how to leverage your data in the company setting can also apply to your personal life. That gets us into the tips for this month. 

Aja: Exactly, exactly. And I know that we can get frustrated when we're asked to take extra steps. Your IT officers will always say to you that you need to clean up your security hygiene.  You need to be using two-factor authentication. I'm going to say the same thing. 

And I'm also going to recognize that it feels it feels frustrating. My dad was complaining to me the other day that he had to set up two-factor authentication for his healthcare provider to log in to see his appointments and his records. I was like, why are you upset by that? Because it was another step. I was like, oh, yeah. And it's protecting your health information. Your sensitive information that's gonna sell on the black market.

And he was like, oh, yeah, okay, I guess. But I relate, right? I relate, it is frustrating to have to take extra steps. Yet, that's what's keeping us safe. That's what's keeping us a step ahead.

Aja: He has the unfortunate task of keeping us compliant and keeping us up to date. And that's why anytime I see something from him, I'm like, yep, I'm doing it right this second. And I'm going to confirm because he's committed to keeping us not just compliant, but also safe. 

Aja: He doesn't want us to end up on a breach report. You should always be listening to that person, you know, at work. You should take the advice that they're giving you at work and apply it to your home. Because in this remote environment, you have to treat your home as your office. 

Aja: Yeah. That's, that's great. I'm so glad. Thank you, Rick, thank you for keeping us compliant.

Aja: Yeah, so, big shock. My advice for you, in your personal life, is very similar to what I've said in your professional life. And that’s getting a sense of what normal activity looks like for you. 

I have, I think, five different email addresses that are all subscribed to newsletters I never read. I know that I have been p’owned as the kids say.

Aja: I don't know what they say. Anyway, I checked that website at a colleague's suggestion, and I had been p’owned, like, 18 times, because I'm not paying attention to my inbox hygiene. I'm subscribing to things right and left. Don't do that. 

Figure out what normal activity looks like for you. Understand who you are in regular communication with. Unsubscribe from whatever you can, and clean up your inbox. 

And when something comes in that is not normal and not safe, you're going to recognize it much more easily. You can take the practices that you're building in the workplace, and you can scale them down and use them personally, just to stay alert. So be careful. So stay alert, get a sense of what normal looks like, and listen to your compliance officer.