Home Forums Discussions General Discussion ransomware attack

The chance for a small private medical practice being attacked by a ransomware is high according to ChatGPT. Do you have such experiences? what do you do to prepare for such threats? The impact could be disastrous for us!

Thank you for sharing in advance,

Hello,

Yes, the chances are not in your favor of a ransomware attack. Many think the bad guys go after big banks and fortune 500 corporations. Those entities, however, are a waste of time. Entities such as General Motors, Bank of American, Wells Fargo,etc. have huge IT budges and entire teams of people whose sole job is security.

The majority of small businesses, such as those of you on this forum, are a different story.

* Many do not have the IT budget for hard security.
* Many do not care about security because many do not care about IT. To this day, the number one reason I lose a client is because they tell me things like "we haven't had any problems in 15 years, why should we prepare for something that has never happened?"
* To this day, the majority of new clients I have signed up for the past 5 years do NOT have any type of disaster recovery process in place. No backups. And convincing them to do so was like pulling teeth.
* Many are still running Windows 10 and other end-of-life software. If it ain't broke, don't fix it. Not good enough.
* Completely incompetent IT. There are a lot of IT guys out there that are just morons or older guys riding out the last few years until retirement.

The list goes on and on. The bad guys figured this all out long ago. It's better to make a little money from hundreds of entitles just like you than to try to make a lot of money from a one time hack.

What to do to prepare:

* Move to Office 365. Set up MFA. Lock down email. Email to this day is still the number one way the bad guys get in. I still have clients that use free AOL accounts, and they think that is good enough. It's not.
* Use a good antivirus such as Sophos. Something that can lock down a computer if a threat is detected.
* Disaster recovery. On and offsite backups are a most. Backups should be tested yearly. If you have never restored your backups, you have no idea if they work or not.
* Stop running end-of-life software. No more Windows Server 2012. No more Windows 10. No more. I am well aware that some of you have some old program that will not run on anything past Windows 7. You love your little program. You've had it for 15 years. But the company that made it went belly up in 2015. It's time to move on. Some of you would still be running Windows XP if you could.

That list is not the end-all-be-all but it is a good start.

James

I agree with a lot of what JamesNT said. I am NOT it or text support but I do learn as I go.

As for office365, from what I have heard office365 is being heavily targeted with spoofing and even smart people are falling victim. I friend of mine who runs an it business has recently been testing his clients and own staff with spoofs and he said some of the smartest were clicking the links. Microsoft article on it. https://www.microsoft.com/en-us/sec...-and-misconfigurations-to-spoof-domains/

As for me, I hate the subscription model. I hate logging in. Way too cumbersome. I personally have been using libre office. It's free and great. Open source. You can change some settings to make it save as .docx which is Microsoft's file. You can set it as default program for everything but Microsoft makes it a little tough

Windows 10... Your computer may actually be able to be upgraded with an official work around. Microsoft claims these computers were not chosen to be automatically updated for some reason but it's because they want to sell more licenses. Microsoft used to have instructions on how to do it on their website but looks to be removed. This article walks you through it. https://www.pcmag.com/news/microsoft-offers-tpm-20-bypass-to-install-windows-11-on-unsupported-pcs


As for back up. My office does this. Back up on the server. External hdd on the server, external drive on different computer. Every two days one of those is swapped with a third drive that is taken home. We used to do it daily but got lazy. Now it's MWF. if we are hacked and they lock the server we have an external drive on the server. If it was locked too.... Well fine. It's sort of used as a decoy second back up. Then the other in office is the real one, but what if the office burns down... Well we have the one at home. What if your house burns down, well we have the one at the office... What if both do...uhhhhh.... Well that's why I'm planning to get things automated so I can have back ups everywhere... Kidding.

What about cloud back up.... The problem here is when they get hit with ransomware. Small offices are at risk but hospital systems and medical things are a gold mine. Nethealth got hit and paid after 2 days. Major hospital systems get taken down. Something I used to use, cloud based, got hit with the heartbleed attack.

If you depend on cloud and were hit hard when half the world went down because someone didn't test an update in the sandbox but just let it out then you know why not to.

Biggest thing... If you remote in to your computer, use Google remote desktop or even better use tailscale and remote desk top. Whatever you do, DO NOT expose remote desktop to the Internet itself. Bots will start penetration tests within 24 hours. There is an entire search engine out there to find exposed ports and remote desktop sessions etc.

Fun fact I learned over the past two days... My office we use iPads or laptops to control our desktop computer using a remote connection. It's faster than trying to run the program on the mobile device and pull from the server via Wi-Fi. Even though tailscale technically goes out to the cloud then back to your office, it doesn't have to. My office Internet was down. Our server is on site so all hard wired computers had access. I could use my iPad with tailscale and Windows remote and still access my desktop so it fell back to LAN (local area Network) mode and I was going just fine whereas everyone else could not. Tailscale is honestly very simple to set up. The most difficult part was figuring out the remote desktop app.