The Death of the Mac Malware Myth

 

Do you have Mac computers in your office? A lot of companies use them because there’s long been a myth that Macs are more secure than PCs. “There’s no malware for Macs,” the old saying goes. And while that used to be true, it’s far less true these days. In the year just past, more Mac malware was discovered than in any other year, indicating that as Macs become more popular, they become a bigger target for malware designers.

Why People Believe Macs Don’t Get Malware and Viruses

Plain and simple, Macs are less popular than PCs, especially in business environments, and therefore a virus designed for a Mac will have less effect than a virus designed for PCs. That makes it less attractive to malware designers.

Second, Mac’s OSx is built on top of a Unix-like operating system. Unix was developed as a teaching tool back in the 70’s and is extremely secure. It has evolved into many open-source variants and, because so many thousands of people have contributed to it and patched security holes, it is very secure. All Apple operating systems, like MacOS, have benefited from that history.

Why Even Mac Users Are Threatened Now

Some viruses don’t even depend on a specific computer to be malicious. Malicious code can live inside the scripting languages built into MS Word and Excel files that both Macs and PCs can now run. Malicious JavaScript can be embedded inside PDF files. Some malware even lives on web pages, where malicious software and fake web pages can steal your user credentials as part of a Phishing attack, exposing your business and personal data to the criminals of the dark web.

As for the Mac-specific threats, one user on Quora.com (a popular question-and-answer website) answered a question in 2017 about Macs and Malware and concluded with “I don’t use any anti-virus or anti-malware software on my Mac, but I wouldn’t dream of trying to do that on a PC.”

But 2018 turned out to be a banner year for Malware on Macs. An article on ArsTechnica.com discusses malware that they contend Apple knew about for 4 months and never announced its discovery. An article on ITSPmagazine.com wrote up a list of 11 recent malware and virus threats.

That’s not nearly the number developed for Windows PCs, but it still makes the case that if you use Macs for your business (and even your home) and you value your business (and personal information), you need to protect yourself and your business from these digital threats.

How To Protect Yourself From Mac Malware and Viruses

Generally speaking, reputable Mac software is approved and “signed” by Apple. With the rare public exception of the malware referenced in one of the articles above, Apple does a good job of ensuring that software in its App Store is safe. If what you need can’t be found there, go to the publisher’s official website rather than downloading the software from some other source.

Keep your software updated. A lot of malicious software exploits software bugs. Once the publisher discovers those bugs, they are quickly fixed and patched. If you keep your software updated, you’re less likely to have these kinds of vulnerabilities.

Install good antivirus and anti-malware software on your Macs. Better yet, “Advanced Endpoint Detection” (AED) tools can detect malicious behavior on computers even before they ever show up in a virus definition file. AED knows what normal activity looks like and what malicious behavior looks like, and can shut down malicious behavior when it sees it.

Always be aware of what you’re doing online. Most malware is transferred via the web and email. So training yourself to recognize legitimate websites and links is a good first step. Better yet, use software to monitor and filter your email for phishing attacks and malicious links.

How Digital Uppercut Can Help

All four of these steps are part of Digital Uppercut’s new Business Protection Toolkit. This system can help keep your software up to date, ensure only approved software is installed on your computers, guard your computer against malicious behavior with AED, and monitor your web and email traffic for online threats.

Then we back that all up with a Security Operations Center, where we live computer security experts who monitor your network log files for threat patterns and spring into action if threats are detected.

The Business Protection Toolkit can even help you meet compliance standards, ensuring that your network data is encrypted on a file and folder level, which is far more secure than full-disk encryption.

Contact Us Today

Whether your business network is all Mac, all PC, or a mix of both, let Digital Uppercut protect you from PC and Mac Malware and help keep your business running. Talk to us about our Rapid IT services, Data Protection, Disaster Recovery, Cloud services, and of course, our Business Protection Toolkit. Contact us online or call us at 213-398-8771today.

Beware of Fake WiFi Hotspots

 

Do you travel? Almost everyone does at some point or another, whether for business or pleasure. And you are probably very conscious of the threats of having your pocket picked or your luggage stolen while you travel. Well, you should also be aware that there are cybercriminals who are looking to steal from you, and the consequences could be far, far worse than a missing wallet. Whether you’re at an airport, any local restaurant or coffee shop, you need to beware of fake WiFi hotspots trying to steal your data.

How You Can Get Hacked On A Fake WiFi Hotspot

So how does a typical hack on a free or public WiFi network actually happen? There’s more than one way.

The most obvious way is for some malicious person or company to put up its own competing WiFi network. These “Evil Twin” networks are named in a way that looks legitimate, but is far from it. Once connected to one of these malicious networks, users are open to a variety of threats.

1. Data Eavesdropping: For example, all of your data can be monitored and recorded by criminals. They can see the images you send, the text you type, and even the usernames and passwords you use.
2. Malware Injection: These fake WiFi hotspots can be configured to load malicious software onto your phone or computer. These viruses or trojans then install themselves on your device and remain there, even when you leave the fake hotspot where you were originally infected. PC and Mobile Malware can steal your passwords, encrypt your data, hold it hostage, and spread to other devices.

And here’s how easily this can happen: The legitimate free WiFi at Los Angeles International Airport is called “_LAX Free WiFi”. A bad guy might name his Evil Twin network something as similar as “LAX Free Public WiFi,” and most of the travelers in the terminal would never know the difference. They’ll happily connect and have no idea they're being hacked by a fake WiFi network.

But the threats don’t come entirely from fake WiFi networks. They can also come from legitimate, but free and open wifi networks. There are dozens of programs that allow hackers to monitor unencrypted network traffic on wifi networks, and most of them are free to download.

Hackread, a website I monitor to learn about trends in hacking and cybersecurity, wrote about a recent report that tells how much at risk you are at certain airports around the country. The report, by Coronet (a cybersecurity software company), surveyed the top 45 busiest airports and rated each one with a “Threat Score”. Here are the top 5 most dangerous airports for connecting to free WiFi:

1. San Diego International Airport (San Diego) Threat Index Score: 10
2. John Wayne Orange County Airport (Santa Ana, Calif) – Threat Index Score: 8.7
3. William P Hobby Airport (Houston) – Threat Index Score: 7.5
4. Southwest Florida International Airport (Fort Myers, Fla.) – Threat Index Score: 7.1
5. Newark Liberty International Airport (Newark, N.J.) – Threat Index Score: 7.1

How To Keep Your Devices Secure While Travelling

So what can you do to protect yourself? We wrote about Tech Travel Dangers and how to avoid them before, but here are some tips for you.

• Don’t connect to free or open WiFi networks EVER. This is by far your best advice.
• Bring your own WiFi, whether it’s your phone's hotspot or a separate device.
• If you must connect to a public, encrypted network (wired or wireless), make sure that you have a software firewall enabled on your computer or mobile device.
• When connecting to any public WiFi, even if it’s secure, instantly turn on a VPN (Virtual Private Network).

Whether you’re in an airport or in the middle of town, fake WiFi hotspots, as well as free or open WiFi networks, are dangerous. By the time your travels are over, you might find your entire office network hacked, your sensitive data breached, or worse.

Why Talk With Digital Uppercut?

That’s why you should talk with Digital Uppercut, whether you’re travelling or not. If your office networks and mobile devices are not secured, whether you think your staff might be connecting to fake WiFi hotspots or not, your business is vulnerable. And if your business is regulated (by medical, financial, or legal authorities), those vulnerabilities could not only cost you your data and your business, but huge fines and worse. Digital Uppercut is a company that not only specializes in digital security but is also an expert in regulatory compliance, including HIPAA, FINRA, and PCI. We can conduct a free preliminary audit to help you determine whether you are vulnerable. Contact us or call us today at 213-398-8771, and let’s set up a time to talk.

What’s worse than getting hacked?

Doctors have a lot of deal with these days, especially with all the new changes in health insurance and advances in modern medicine. Getting hacked has got to be a horrible experience for doctors, too, because not only does someone else have a copy of your data, the "bad guys" may be holding your data hostage (and charging you thousands of dollars to get it back). Or they might simply have deleted it from your network entirely (including your backups).

So what could be worse than that?

The short answer is that the law has no problem with kicking a company when it’s down, and so, as your office might be struggling to figure out how badly you were hacked, to restore the lost data, and to get back to “business as usual,” the Department of Health and Human Services just might come along and fine you a million dollars or more.

Why One Company Was Fined 2.3 Million Dollars

In 2015, the FBI conducted an undercover operation where they bought some stolen medical records on the “Dark Web,” a part of the Internet that most people know nothing about. (Hint: It’s the marketplace for stolen data.) The FBI traced the data back to 21st Century Oncology, a company that performs cancer testing. The FBI found "personally identifiable information" (PII) and "Personal Health Information" (PHI) in patient data, including social security numbers, medical diagnoses, and more.

In December 2017, the Office for Civil Rights, a part of the HHS, reached a $2.3 million settlement with 21st Century (21CO) for violating HIPAA. Specifically, 21CO failed to...

• Conduct an accurate and thorough assessment of the potential risks and vulnerabilities of their data.
• Implement security measures sufficient to reduce risks and vulnerabilities sufficiently.
• Implement procedures to regularly review information system activity records, such as audit logs, access reports, and security incident tracking reports.
• Have a written “business associate agreement” before disclosing protected health information to third-party vendors.

Why does this matter to a small medical office like yours?

Because the OCR doesn’t care how small or large your practice is. If your company were hacked and your data were breached, they would apply the HIPAA standards and fine you accordingly. And in case you were wondering, you could also end up in jail.

And what’s more, you don’t even have to get hacked to get fined.

Notice that the four things that the Office of Civil Rights listed, none of them have to do with the actual breach of the data. ALL of them have to do with following the procedures to protect your data. In other words, protecting yourself from multi-million dollar fines is easy.

Here’s how you protect yourself

If you are just learning about your potential risk for huge HIPAA fines, there is really only one thing you need to know:

Protecting your practice starts with a HIPAA Risk Assessment. Simply having your Assessment done can save you almost a quarter of a million dollars in fines. And maybe just as importantly, it provides a clear roadmap to becoming HIPAA-compliant, securing your data, and protecting your staff and patients from the problems associated with a data breach -- including having your business shut down.

Generally speaking, small businesses, including medical practices like yours, often don’t have the budget to protect themselves the way a big business can. But 21st Century Oncology shows that just having a big business budget doesn’t mean you’re going to do the right thing.

Even with a small business budget, you can get protection that greatly exceeds whatever 21CO was doing.

It might interest you to know that 21st Century Oncology has since filed for Chapter 11 bankruptcy protection.

If your business stores or uses Personally Identifiable Information or Personal Health Information (like a physician, optometrist, dentist, hospital, attorney, therapist, psychologist, manufacturer, or personal care organization normally does), you need to protect yourself from the effects of getting hacked and having your data breached.

Find out how easy it is to have your HIPAA Risk Assessment completed. Digital Uppercut is one of the most thorough and respected Regulatory Compliance companies in Los Angeles. Our approach, which combines regulatory compliance with security and solid IT, is unique in Southern California. Contact or call us today, and let’s chat about you, your business, and what we can do together to help protect it.