Protecting Your Practice From a Cyberattack

By Thomas Terronez, CEO - Medix Dental IT

Cyberattacks are an ever-growing business that continues to evolve with new creative tactics deployed every day. Through years of experience and conducting assessments, we have found cybersecurity in dental practices to be weak, making a hacker’s job easy. Several factors can contribute to this. The main factors are current IT providers not doing what they should be, poorly developed software, lack of knowledge and vetting IT vendors based on price. An IT provider should be doing more than automatic scans and data backups. Protecting a practice needs to go beyond that, or it is easy to fall victim to a cyberattack.

Cyberattacks could lead to:

• Lost production, remediation, reputation and reacquisition

• Loss of patient trust and patient fallout due to not protecting their personal information

• HIPAA fines According to a 2021 IBM Commissioned Report, the average cost of a data breach exceeded $4.2M during the pandemic. The report also stated the average time it takes to identify and contain a breach is 280 days. The top cybersecurity threats the dental industry faces today are ransomware, insider threats, compromised business email and lack of software patching.

• Ransomware has become a lucrative business for cybercriminals. This is when a cybercriminal places malicious software on your computer, invades your system and holds your information/data hostage until you pay a hefty fee. This type of cyberattack can leave your practice inoperable for months.

• Insider threats and social engineering are when hackers pay employees for their work login credentials. They use the credentials to perform malicious acts on your systems and practice data. The employee will claim, “I don’t know how my email got hacked,” and the company believes this due to the lack of evidence to find the true source of the security break.

• A business email is compromised when a cybercriminal gains access to your email system. The most common trend is when the hacker spoofs incoming/ outgoing emails to trick you into sending money for a fake expense or

• Software Patching Maintenance is an ongoing duty performed by your IT provider, patches should be monitored and applied accordingly. In March, there were major vulnerability patches released for several vendors, including

Microsoft, Adobe, Android, Google, Apple and Intel. Not applying critical security software patches throughout the year easily allows a hacker access to your practice systems.

Practice owners are encouraged to take a proactive approach to cybersecurity. Failing to do so can leave a practice inoperable should it encounter a cyberattack. Dental practices have been identified as an easy target due to having widely known weak and outdated cybersecurity - owners need to protect their practice data now more than ever before.

Here is what you can do . . .

Comprehensive Data Backup Strategy

Having a comprehensive data backup strategy is a business cybersecurity safety net. Every dental practice should have a data backup strategy and a disaster recovery plan to withstand a cyberattack with little to no effect on practice operations and data loss. A local backup or disaster recovery device segmented from the practice network to avoid being impacted by a network infection is ideal. While data backups are known as set-it-and-forget-it tasks, IT providers should closely monitor them to detect changes and odd behavior. Practices should work with their IT provider on an incident response plan and ensure their backup solutions are HIPAA compliant.

Cybersecurity Training

The first line of defense against ransomware is employees. It is imperative to the success of any digital workplace to invest in cybersecurity training. It is recommended to schedule quarterly cybersecurity awareness trainings (annually at the very least).

Cybersecurity training does not have to be overly complicated. Most training typically includes a cyber-threats overview, email security best practices, password policies, web protection and social engineering. Training can be through an interactive platform or by the completion of reading assignments.

Email and web browsing are the two main areas of training that practice owners need to ensure staff understands and implements security best practices in their daily routine at work. Try sending friendly reminders throughout the year in internal newsletters or printing off flyers for staff to reference as needed.

Educating practice staff on web browsing protection and allowing website usage for only websites necessary for practice operation reduces risk instantly. Practices should also disable autocomplete for web forms and remember your password features. Enabling these features makes it easier for a hacker to discover if a system were to get compromised. "An IT provider should be doing more than automatic scans and data backups. Protecting a practice needs to go beyond that, or it is easy to fall victim to a cyberattack."

IT Provider Cyber Insurance

There are several factors to consider when it comes to backing up practice data. Does your insurance cover lost data and recovery? For an extra layer of protection, have an adequate insurance policy in place that pays for mitigation, data recovery and business continuity. If you fall victim to a ransomware attack, having these three items covered in an insurance policy (along with performing data backups) will help get a practice operable again.

If firewalls, endpoint protection, and data backup strategy are not in your vocabulary – you are not alone. As cyberattacks continue to rise, it is critical for dental practices to partner with an IT provider that will serve as a strategic member of the practice team and manage cybersecurity responsibilities.

About the Author

Thomas Terronez is the owner and CEO of Medix Dental IT. With over 20 years of experience in dental IT, Thomas is the nation's renowned dental technology leader. His mission is to lead dental organizations through operational and scaling challenges by leveraging technology. He has a forward-thinking outlook and is solution-focused, which has led him to work with the top dental vendors on evolving and developing the technology infrastructure for the industry's future. For more information about Medix Dental IT, visit medixdental.com.

Multi-Layered Protection

While 100% protection does not exist, having multiple layers of security is the next best thing to mitigate and prevent cyber threats. Firewalls help shield computers from unwanted network traffic. Having a firewall that includes malware and virus scanning ensures that employee downloaded files do not contain infectious, hidden files before fully downloading onto the computer. Endpoint protection is a security necessity for every business. It protects enduser devices such as laptops, desktop computers, tablets, and servers that can be exploited by a cybercriminal. Lastly, ransomware mitigation software is another layer of protection we recommend to dental practices. It lures hackers to cyberhoneypots, which detect attacks and deflect them by immediately shutting down the computer if files are changed or removed. Ransomware mitigation software also allows for gaining information on the cybercriminal.

Dos and don’ts of email security:

• Email red flags: https://bit.ly/3vOqMRZ • Email security best practices: https://bit.ly/3P2XYgk