This time of year, my wife and I receive many cards and messages from family and friends wishing us happy holidays. These messages bring a lot of joy and remind us how lucky we are to have so many special people in our lives. Most of these messages come in the mail (they’re really the only important pieces of physical mail I receive these days), but some of my friends send their holiday greetings electronically.
Thirty years ago, the general public was only just becoming familiar with the concept of email (widespread use of email didn’t really occur until the introduction of AOL in the early nineties). Yet, in December 1987, an electronic Christmas message became the first widely disruptive computer worm in the history of computing. The worm, called the Christmas Tree EXEC, was written by a student at the Clausthal University of Technology in Germany. The worm worked by drawing a Christmas tree with text graphics on a user’s computer screen, then sending itself to each entry in the target’s email contacts file. The worm spread and caused massive disruption across multiple computer systems, including the European Academic Research Network (EARN) and BITNET.
While the Christmas Tree EXEC taught the computer industry about the threat of computer worms, we continue to see these and other types of malware today. Today, these attacks can cause widespread internet disruption because so many systems are connected.
So, what can we do to protect ourselves from computer worms and other malware? In the spirit of the holidays – and as we’re in the middle of Hanukkah – here are eight tips for dealing with malware threats:
- Patch Your Systems, Networking Gear and IoT Devices
A patch is a piece of software designed to update a program or the supporting data and operating system to fix or improve it. Patches can protect your systems from harmful threats lurking on networked devices. You should always apply patches as soon as possible or else risk exposure to hackers which can result in a massive breach, like the Target breach four years ago.
- Install Antivirus/Antimalware on Your System
By installing antivirus or antimalware software on your system, you are taking a proactive approach to safeguarding your system from security threats. These types of software will routinely scan your computer for threats and vulnerabilities, including viruses, worms, botnets, trojan malware and other online threats.
- Conduct Regular Risk Assessments
Not only are risk assessments an essential part of a well-managed security program, they are also required by HIPAA. For guidance on how to conduct a HIPAA risk assessment, the Department of Health and Human Services offers a good starting point along with a healthcare IT Security Risk Assessment Tool.
- Train Your Staff to Identify Phishing Attempts
Phishing is a type of social engineering that uses emails designed to trick the recipient into clicking on a malicious attachment or visiting a malicious website. It’s easy to be deceived by a phishing scam. 97% of people globally can’t correctly identify a sophisticated phishing email. Often, phishing emails are disguised to look like they came from your IT department or a top executive from within your organization, such as your CEO. If you train your staff to be on the lookout for phishing emails, you can better protect your network from these kinds of attacks. Here are a few ideas for how to go about training staff on phishing or spear-phishing emails.
- Understand Which Vendors You Are Working With and Pursue Vendor Consolidation
A key way to limit the risk to your network is to consolidate the number of vendors you work with. The more you can eliminate handoffs with your data, the less likely that data is to be compromised by hackers. When selecting vendors, ask to see their security and compliance certifications – do not simply trust a vendor who self-attests to being compliant and secure. Here are the certifications you want to look for when selecting a vendor.
- Regularly Scan Your Networks for Vulnerabilities
Web vulnerabilities are prevalent: in 2016, 76% of scanned websites had vulnerabilities and over 229,000 attacks were blocked per day. If you regularly scan your networks for vulnerabilities, you can detect threats sooner and move faster to prevent attacks. Read Symantec’s report for a full understanding of internet security threats.
- Use a P2PE Validated Solution to Keep Credit Card Data Off Your Network
We talk a lot about point-to-point encryption (P2PE), but this is because it is crucial for protecting payment data from being exposed and intercepted by hackers. If you use a PCI-Validated P2PE solution, then you can keep credit card data off of your network completely, which not only protects payment data from exposure, but can also reduce your PCI compliance efforts. Only P2PE solutions listed on the PCI Security Standards Council website are PCI-Validated.
- Use Service Providers To Directly Process Cardholder Data
Most healthcare organizations today offer a multichannel approach to patient payments, which means they make online payments available to their patients. You must make sure that you are protecting payment card data that travels via this channel as well. Instead of touching cardholder data on your website for even a split second, leverage the InstaMed Secure Token to deliver a seamless and secure online consumer payment experience within your existing online experience with cardholder data never touching your servers.
I hope that you find these tips useful and that they help prepare you for a very safe and secure 2018. I’ll leave you with the message that the Christmas Tree EXEC left for us 30 years ago, and I sincerely hope that none of you experience computer worms or any malware this holiday season: