Mike Howells

Breach De Jour - Mount Carmel Behavioral Health On August 30, 2024, Mt. Carmel Behavioral Healthcare LLC (MCBH) disclosed a data breach to the U.S. Department of Health and Human Services after unauthorized access was detected in an employee email account. The breach exposed sensitive information, including patients' names, Social Security numbers, medical record numbers, patient account numbers, health insurance details, and other medical information. The unauthorized access occurred between June 11-12, 2024. MCBH has since secured the email account, initiated a forensic investigation with third-party cybersecurity experts, and begun notifying affected individuals. To mitigate such risks, healthcare organizations must enforce robust email security protocols, including multi-factor authentication (MFA), continuous monitoring for anomalous access patterns, and data encryption. Regular phishing awareness training for employees and implementing secure email gateways can further reduce vulnerabilities. Incident response playbooks should also be tested regularly to minimize the window of unauthorized access and prevent similar incidents from escalating. #CyberSecurity #HealthcareSecurity #DataBreach #PHISecurity #IncidentResponse #HealthDataProtection #HIPAACompliance #MtCarmel #MFA #EmailSecurity

1

No matter where your organization is on your #ZeroTrust journey, achieving optimal maturity is always the end goal. Check out some tips and tactics to help you build your #ZTA with CDW VP of Security Stephanie Hagopian! #Security https://dy.si/RhqFA

19

Join us at the Detroit CIO & CISO Executive Summit on June 18th to learn how Generative AI is reshaping cybersecurity! Discover the latest threats, data protection strategies, and mitigation techniques for this powerful yet risky technology.

36

3 Comments

As I often say, it all comes down to inventory. CIS 1.1 (Assets), 2.1 (Applications), 5.1 (Accounts). Cybersecurity is far more about blocking and tackling than it is about trick plays. Great posts below...

8

1 Comment

A recent experience with a vendor has me thinking about how much effort cybersecurity practitioners put into tearing down the reputation of being the "department of no" and building partnerships with our executive leaders to achieve the common goal of pushing the business forward. This particular vendor has become my "department of no". Fundamentally, we're in a customer-vendor relationship. I get that it's your job to sell your product, and my job to buy it. But that relationship should go deeper. If I easily get value from your product, that leads to word-of-mouth recommendations, an almost guaranteed chance of retaining my ARR, and as many suggestions from me on how to make the product better that you'll accept. If you disappear once the contract is signed, are opaque with your product roadmap, remove features, or implement arbitrary restrictions on my usage of the product, what impression am I supposed to have of your company and your product? If you can't bother to give me a regularly scheduled call with a shared TAM (that every other vendor provides), but prefer that I submit a ticket every time I want to ask product roadmap questions that you take 48 hours to respond to, is your goal to stop me from asking questions altogether? It feels like you don't think of this as a partnership, but just a transaction. We have companies in this space that don't understand our community and the type of relationships that we invest ourselves into building and maintaining everyday. We don't have time for vendor relationships that don't serve our company's needs; our time and attention is too precious.

56

2 Comments

Today I get to spend some time enjoying the Twin Cities! However, we must remember Treat Actors never take vacation! Last year, a cyberattack targeted the Minneapolis Public Schoolssystem, temporarily disabling district technology and leading to a data breach that exposed personal information. This incident highlights the urgent need for robust cybersecurity measures to protect our critical infrastructure. Stay safe and be prepared with a strong cybersecurity defense you never know when a threat is going to attack our systems! #CyberSecurityAwarenessMonth #Minneapolis #StaySafeOnline #CyberDefense

2

This is the ubiquitous OBD2 port, found in all of our cars. This morning I will bring my car in for service, and the folks at the garage will plug some kind of device into this port, and they will learn all kinds of magical information about my car - just as they will for every other car that rolls through their shop today, and every day. As chatter around medical device SBOMs warms up again, I harken back to a concept I floated a few years ago around healthcare's "OBD2" port - a way to dynamically inventory the software contents of a medical device using a standardized, out-of-band interface. Not unlike our use of HL7 to transmit health data in a universal fashion, why have we not yet taken the same approach to understand what our medical devices are made of? I'm optimistic that in my lifetime, we are going to get to this point. Healthcare's OBD2 will be a virtualized, purpose-built way to know exactly what components exist on a device. Instead of reviewing SBOM documents that are compiled on some cadence, or (gasp) deriving SBOM from even more manual methods, practitioners would know in real time what the software inventory on a device consists of. We're not emailing vendors for these answers. We're not logging into 3rd party portals. This information flows into any of the slew of existing asset management sources of truth that many already invest in - vulnerability scanners, passive inventory systems, CMDBs, endpoint protection platforms - all using an industry standard we agree to be our rock - our OBD2. A little Monday dreaming to get the week started. As we say in Kenpo (as is said many other places) - dreams without plans are just dreams. We want more than dreams in this space, and I'm hopeful this really is the desired end-state for medical device SBOM, and somewhere, in some dark corner, it's already in flight.

22

5 Comments

We must be proactive in identifying and remediating cyber vulnerabilities! “The team found a password file left from a previous employee on an open, administrative IT share, which contained plaintext usernames and passwords for several privileged service accounts," the report reads. #cybermonitor #Ncontracts

7

Interesting article highlighting the importance of the CISO position and why organizations should value the insight and knowledge qualified CISOs provide.

8

I want to highlight another phenomenal Security Engineer from my previous team that was shockingly included in my former company FloQast's huge layoffs on Friday. Chris Fulton was a rockstar on our Corporate Security team for over 2 years and had a profound impact on our Vulnerability Management, Phishing Security, and Incident Response processes. Chris' attitude and temperament are perfect for a high-stress Security Engineering job. He has the unique ability to remain calm under pressure while still being highly effective and even aggressive when solving the problem at hand. This is something that just can't be taught, but when a major security incident occurs, Chris is someone you want on your team! (Speaking from personal experience) Chris also has *very* strong technical/coding skills, something that was evident when you look at the Phishing browser extension he built. Anyone who has worked with GMail's API knows how difficult it can be. Chris was able to build a HIGHLY effective tool using this API as a Security Engineer I. Since then, he's only gotten stronger. Finally, Chris' soft skills are something to be admired. He took the initiative to build custom Security Awareness training videos that we all agreed would put KnowBe4 out of business if he ever wanted to make that a career. If your team is looking for a *very* strong, mid-level Security Engineer to harden your corporate security posture, I can't recommend Chris enough!

102

3 Comments

Identifying core business functions and having a protection, recovery, and business continuity plan is essential. This is yet another reminder for asset inventory, system segmentation, visibility, incident response plans and business continuity planning. Tracking this one. #cybersecurity #networksegmentation #incidentresponse #businesscontinuity #ciso #cto #plan #tabletop #invest #people

10

Middle of the range desktop custom built PC's don't have to cost the earth. Here is a parts list for a semi decent desktop for the avarage worker if anyone is interested in doing a custom build.

4

If you're curious about what the first 90 days of a C-Suite person looks like, check out Copilot's view. The attached document compares and contrasts the first 90 days of the CIO, CMO, CFO, CHRO, and CISO. While it's not an exhaustive list, it provides a representative sampling. I suspect Copilot's answers reflect average performance. However, the document raises some interesting points and questions. Are there any major misses by Copilot? What are your thoughts?

21

5 Comments

***update this fix is working. Unless you log into a local admin account, you may need safe mode with networking to access the crowdstike driver folder with admin privileges. This is sounding pretty bad. Check the article to see how to boot in safe mode, rename your crowdstike folder and get up and running.

6

I wrote a blog post about how data breaches are commonplace, and how we will see a shift in focus away from data privacy towards cyber resiliency. Check it out and let me know what you think! https://lnkd.in/gV_eHnNM

35

1 Comment

IT and cybersecurity services aren't just for big businesses. Adams Brown Technology Specialists customizes its solutions based on the individual needs of a company, not size. Brendan Giesick explains more in this segment from Good Day Kansas. #KansasITServices #cybersecurity #datasecurity

1