Workforce Capability

Cyber Medical Breach

Another Cyber Attack against Medical Institutes, has my information been sold to criminals?

Hackers break into two firms hosting medical care databases with 425,000 records and 200,000 payment details![1]

Another medical breach last month with hackers making off with hundreds of thousands of banking details. This happened over eight months before it was discovered! There is a considerable backlash, and the US Senate wants answers, asking if any security audit was conducted?

Another hospital in the UK this month had to cancel all its surgery and appointments while the IT team tried to resolve the issues.[2]

We put so much trust into 3^rd party vendors looking after our private information and assume sufficient Cybersecurity controls are in place. It is imperative that companies understand the risks involved in trusting vendors with your data, especially if the vendor does not have a good Cyber Hygiene regime in place.

How can an organisation reduce the Risk of a breach?

Proper processes and procedures are needed for times of operational stress and these needed to be practised and tested. Critical information assets[3] need to be identified and protected so that companies can continue to function if they come under a cyber attack.

Both IT and general staff must have Cyber awareness training, and this should be delivered from an organisation that brings real-world context to the scenarios. This approach has been proven to be the most cost-effective way to reduce risk; as reported in the media from several sources in Australia, including some Government agencies.

Follow these steps and be part of the Cyber Security compliance solution.

Step 1

Train your staff

Step 2 – 8

You will find out by doing step 1.

[1] https://www.theregister.co.uk/2019/06/06/congress_amca_leak_quest_labcorp/

[2] https://www.theregister.co.uk/2019/07/03/cisco_network_outage_hospital_appointments_and_surgery_to_be_cancelled/

[3] Assets that are critical to the organisation that if they were destroyed, made unavailable, disclosed or modified then the organisation would not be able to continue to operate.

For More Information Specific to Medical Practices Click Here

Category: Digital and Cyber Capability

Engineering Control to reduce knee injury

Every business is required by law to conduct a hazard and risk assessment and review every task that workers do.

The Hierarchy Of Control starts with can you eliminate, or substitute a product/task for something else. Third is engineering controls.

People have accepted that there is little that can be done to prevent injury if they are spending a lot of time bending their knees.

A new engineering control could help prevent injury to the knees

Body Wellspring Knee Device

Category: Safety and Wellbeing Capability

Cyber Attacks threaten law firms

How will a data breach at your Law firm impact your business? It’s more than just your reputation at stake!

Legal entities are a prime target for criminals, imagine case files leaked that will affect the outcome of a trial, or put lives at risk by releasing the witnesses names, and where they live.

Law firms may be held accountable for negligence in not having sufficient Cybersecurity in place and could be liable for prosecution by third parties.

Business critical information and Intellectual Property are valuable sources of information for criminals and state-sponsored hackers. This sort of data is available in every law firm, and breaches are continually being reported in Australasia.

A recent report from Australia estimated that the average cost of a data breach per organisation is 1.9Million Australian Dollars[1]. However, there are some simple steps an organisation can take to help mitigate this risk.

Simple Steps.

Have a review of the Cyber Security Maturity within your organisation and identify what your critical information assets are by conducting a robust and structured risk assessment. This will help you determine what you do and what you don’t need.

Train all company staff in Cyber awareness, including your Lawyers with an online Cybersecurity awareness program.

Conduct Cyber awareness training for onboarding all staff before they start and annual refreshers.

[1] https://www.ibm.com/security/data-breach

More Info Cyber Security Awareness Training

Category: Digital and Cyber Capability

Lawyers… non-compliant with fire regulations?

Over the years I have not audited one lawyer’s office that was fire compliant!

According to Ben Warren, a Brisbane Lawyer ‘Ignorance of the law is no excuse’ and few occupants in CBD buildings – including lawyers – would be aware that “occupier” obligations under the fire safety regulations extend beyond mere participation in the building owner’s compliance regime. The “occupier” (each tenant) often has distinct statutory obligations, including the need for a specific evacuation plan, diagrams, staff training, etc..

Most lawyers would not know what to do in an emergency. The legal practice often decides that to have the lawyers participate in a two-hour fire training course is not productive. Can you imagine… the lost revenue on a practice of 10 lawyers whose charge our rate is over $300 per hour… would lose them over $6000.

The lawyers often appoint their secretary to act as Chief Warden… from experience, they usually fail to participate in the fire drills, and it is hard for the secretary to enforce participation. If a real emergency occurs… they would not know what they are supposed to be doing.

Remember, “Ignorance of the law is no excuse…” Legal practitioners need to understand that they MUST as a minimum, by law do the following:

· Conduct and document a Hazard & Risk Assessment of their practice

· Install Evacuation Signs and Diagrams

· Have a separate Emergency Evacuation Response Plan (separate to their other procedures)

· Have ALL staff, including doctors complete, General Evacuation Training every year

· Have ALL staff, including doctors complete First Response Training every two years

· Have the wardens (usually practices managers or nurses) do training every year if in QLD and in the other states every six months.

· Conduct a Practice Fire Drill for all shifts on an annual basis

What legislation did you ask? Qld Fire & Rescue Services Act 1990 and AS3745 Managing Emergencies in Facilities.

In interviews with 271 survivors of 911, researchers in 2008 found that only about 8.6% had fled as soon as the alarm was raised while about 91.4% stayed behind to wait for more information or carrying out at least one additional task (collecting belongings/calling a family member). The interviews also showed that 82% of those who were evacuating stopped at least once during their way down, due to congestion on the stairs, take a rest, or due to environmental conditions (smoke/debris/fire/water).

Do we have to wait for a major disaster in Australian high rise offices before people take fire compliance seriously?

Time to act now! Find out if your business is fire compliant! Book a Virtual Fire Safety Audit today!

Book a Virtual Fire Audit

Category: Safety and Wellbeing Capability

Failure to conduct a hazard & risk assessment kills a patient

Health service charged after patient death

Melbourne Health has been charged by WorkSafe following the death of a patient at its Broadmeadows aged persons mental health unit.

WorkSafe lodged three charges against Melbourne Health under section 23(1) of the Occupational Health and Safety Act (the OHS Act) at the Broadmeadows Magistrates Court on 7 June relating to the death on 23 September, 2013.

WorkSafe alleges that Melbourne Health contravened the OHS Act on three occasions when it failed to ensure, so far as was reasonably practicable, that the 75-year-old male patient was not exposed to risks to his health or safety arising from the conduct of its undertaking.

Every practices MUST conduct a Hazard & Risk Assessment. We have online courses that your team can work through together.

Book a free Strategy Meeting today

Category: Safety and Wellbeing Capability

Cybercriminals could HACK hospital medical equipment…

“Cybercriminals could HACK hospital medical equipment to stop patients’ treatment or make them overdose, IT experts warn.”[1]

In 2017 a hospital in the UK was shut down by cyber criminals who demanded a ransom to release data in each hospital staff members account.

Nearly 20,000 appointments were cancelled after the health service failed to provide basic security against cyber attackers. The virus, which spread via email, locked staff out of their computers and demanded £230 ($289) to release the files on each employee account.

Five Accident and Emergency departments even had to divert ambulances away at the peak of the crisis.

Since this attack took place, the healthcare industry is still vulnerable to attacks due to insufficient defence in depth tactics to thwart cyber-attacks.

“Hacking across any industry can occur for financial gain, to gather information, as a form of protest or just ‘for the fun of it,” says Professor Alan Woodward, a computer security expert at the University of Surrey.

‘Chief Information Security Officers report cyber-attacks are on the rise in healthcare.’

According to a new study by Carbon Black, two-thirds of surveyed healthcare organisations said cyberattacks have become more sophisticated over the past year.

Nearly half (45 per cent) of surveyed healthcare organisations said they had encountered attacks over the past year where the primary motivation was the destruction of data.[2]

Destructive attacks, tailored to specific targets, cause system outages and destroy data in ways designed to paralyse an organisation’s operations and are often carried out by malicious nation-states.

Simple Steps

Installing good security software specifically designed to combat ransomware attacks mentioned above would help mitigate many of these types of attacks.

Ensuring computer operating systems and software are UpToDate with the latest patches can also help. If your system is using software that is no longer supported, then it’s time to upgrade.

Information Technology staff need the training to complement their skills to ensure they stay UpToDate with the latest types of attacks and how to defend against them. Empowering your team to protect the networks efficiently will help mitigate the risk that medical systems face.

More tips to come soon.

[1] https://www.dailymail.co.uk/health/article-7149385/Cybercriminals-hack-medical-devices-used-NHS-hospitals.html

[2] https://www.healthcareitnews.com/news/cisos-report-cyberattacks-rise-healthcare

Book a Strategy Call to discuss how you can be cyber safe

Category: Digital and Cyber Capability Tags: cybersecurity