Understanding the risks associated with data privacy and security and some strategies to protect your Company.

1. Don’t Let Them
Take a Byte:
Defend Your Data
Bit by Bit
Kevin Ricci, CISA, MCSE

3. Former FBI
Director Mueller:
“There are two types
of companies, those
that have been
hacked and those
that don’t know it”

4. Why is this important?

5. Key Statistics
• 94% of organizations have had at least one data breach in the
past two years.
• Averages:
• Number of breach incidents in the past two years: 4
• Number of records compromised per breach – 28,765.
• Cost per record lost - $188
• Industry with highest average cost per breach is Healthcare -
$233 per record compromised.
• Cause of Breaches:
• 37% - Malicious or criminal attack
• 35% - Negligent employee
• 29% - System glitch
Source: Ponemon Institute’s 2013 Cost of Data
Breach Study: Global Analysis

7. Full service Professional Services Firm:
Attest
Services
Tax
Preparation
and
Compliance
IT Audit and
Security
Internal
Control
Internal
Audit
Outsourcing
SSAE 16
Services

8. CPA
CIA
Highly qualified
in a variety of
specializations
CFE
CISA
MCSE
ABV
CVA
MST

9. Affiliations:
– AICPA
– PCAOB
– ACFEI
– ISACA
– PCAOB
– TANGO
– CICPAC
– Practicewise
– VACO Risk
Solutions

10. HIPAA Overview
• The Health Insurance Portability and
Accountability Act (HIPAA) was passed
by Congress in 1996
• Purpose
– Ensure the portability of health care
– Prevent fraud and abuse
– Reduce paperwork
– Enforce standards that will improve the
efficiency of healthcare delivery, simplify
the exchange of healthcare data, and
reduce cost
– Ensure the privacy and security of health
information

11. HIPAA HITECH and Final Omnibus Rule
• In 2009, the American Recovery and Reinvestment Act was
passed and included the Health Information Technology
for Economic and Clinical Health (HITECH) Act. In 2013,
the Final Omnibus Rule was passed.
• HITECH continues the effort of HIPAA to encourage
migration to electronic patient records via financial
incentives
• Widens the scope and magnitude of privacy and security
protections available under HIPAA and clarifies their
provisions
• Provides stronger enforcement including regular audits
• Modifies and clarifies the definition of what constitutes a
reportable privacy breach
• Business Associates (BA) are now obligated to comply with
the relevant regulations

12. HIPAA Overview
Health Insurance Portability and Accountability Act of 1996
Title I
Insurance
Portability
Title II
Preventing
Fraud and
Abuse
Title III
Tax Related
Health
Provisions
Title IV
Group Health
Plan
Requirements
Title V
Revenue Offsets
Title II
Medical Liability
Reform
Title II
Administrative
Simplification
EDI
Privacy
Security

13. HIPAA Security Rule:
• Established in 2003
• The Security Rule is
comprised of 22
safeguards broken into
three sections
–Administrative
Safeguards
–Physical Safeguards
–Technical Safeguards

14. HIPAA PHI
• The formal definition of protected health information (PHI):
– Past, current, or future mental or physical health information
or related billing with one of 18 identifiers
– Electronic, Verbal, Written
• Electronic PHI is any identifiable patient data that is either
stored or transmitted in electronic form.

15. HIPAA
Who Needs to Comply?
• Covered Entities
– Health Plans
– Healthcare Providers
– Healthcare
Clearinghouses
• Business Associates
– An entity that creates,
receives, maintains, or
transmits protected
health information on
behalf of a covered
entity

16. Individuals Affected by Breaches

17. HIPAA Penalties
Violation Amount Per
Violation
(A) Did Not Know $100 - $50,000
(B) Reasonable Cause $1,000 - $50,000
(C)(i) Willful Neglect-Corrected $10,000 - $50,000
(C)(ii) Willful Neglect-Not Corrected $50,000

18. HIPAA
HHS Website

19. HIPAA
Tips For Compliance
• Administrative
– Create a thorough HIPAA policy handbook for all
employees
– Require periodic training
– Have all employees sign a confidentiality statement
– Have a comprehensive data breach plan
– Work with your business associates to verify that they are
compliant

20. HIPAA
Tips For Compliance
• Technical
– Complete a security assessment review
– Identify your PHI through data mapping
– Implement the minimum necessary standard – only
provide employees access to what they need
– Properly dispose of hardware when it is no longer needed
– Encrypt backup media, portable computers, and mobile
devices containing PHI
– Use business class email
– Enforce strong logical controls
– Maintain a business class firewall and antivirus solution

21. PCI DSS Overview
• American Express,
Discover, MasterCard, Visa
and JCB formed the
Payment Card Industry
Security Standards Council
in 2004
• They are responsible for
the development,
management, education,
and awareness of the
Payment Card Industry
Data Security Standard
(PCI DSS)

22. PCI DSS
Where Do I Fit In?
Level 1
>2.5m >6m >6m >6m
Level 2
50k to 2.5m 1m to 6m 1m to 6m 1m to 6m
Level 3
1 to 50k 20k to 1m 20k to 1m 20k to 1m
Level 4
N/A 1 to 20k 1 to 20k 1 to 20k
Required Optional

23. PCI DSS Compliance
• Identify
• Inventory
• Analyze
• Fix
• Scan
• Compile
• Submit

24. PCI DSS
Why Should You Comply?
• Inability to accept payment cards
• Legal costs, settlements, judgments
• Higher future costs of compliance
• Fines and penalties
• Lost confidence/sales
• Going out of business

25. PCI DSS
Tips For Compliance
• Identify your credit card data through data mapping
• Don’t store credit card data on your network
• If possible, utilize dial-up terminals that do not pass
through your network
• Consult with a PCI DSS specialist to confirm your level,
assist with completing the associated requirements, and
review your backup
documentation

26. State Data Security
Overview
• Currently, there is no federal standard, so
many states have implemented data breach
notification and data security/privacy
regulations of their own
• If you have employees or clients that live in
those states, you may need to comply with
their requirements

27. State Data Security
Data Breach Notification

28. State Data Security
Data Security Regulations

29. General Security Guidelines
• Social media
• Data mapping
• Logical security
• Physical security
• Backups and disaster recovery
• Mobile devices
• New threats
• Spear Phishing
• Non-disclosure agreements
• Cyber insurance
• Education

30. Social Media
• Implement a social media policy for your
business
• Educate your employees
• Restrict any social media sites that are not
used for business purposes
• Consider a post-separation agreement

31. Data Mapping
• Do you know what your sensitive
data is?
– Intellectual property
– Medical information (PHI)
– Personally identifiable information
(PII)
– Credit card data
• Do you know where your sensitive
data is?
– Human Resources
– Bookkeeping
– Servers, laptops, desktops, backup
media?

32. Data Mapping

33. Logical Security
• User passwords
– Minimum of 8 characters
– Enforce complexity
– Periodic changes
– Deny access after so many
invalid attempts
• General
– Password protected
screensaver
– Coordinate with HR to
immediately be notified of
terminated employees
– Change any hardware default
passwords

34. Logical Security

35. Physical Security
• General
– Educate your receptionist
– Redundant ISP
– Locked to-be-shredded containers
– Guest passes
• Data center
– Visitor log
– Security cameras
– Alarm
– Temperature, water, smoke, fire detectors
– Uninterrupted power supplies (UPS)

36. Backups and Disaster Recovery
• General
– Viability testing
– Offsite transport
– Encryption
• Onsite backups
– Fireproof safe
– Security
• Cloud backups
– Service agreement
– SSAE 16
• Disaster recovery plan

37. Mobile Devices
• Policies
• Use an antivirus app
• Use a password
• Encryption
• Avoid freeWi-Fi
• Remote wipe

38. New Threats
• Ransomware
• Heartbleed
• Internet Explorer Vulnerability

39. Spear Phishing
• Train employees on
what to look for
• Be careful where you
post personal information
• Beware of unexpected emails
• Keep your software up to date

40. Non-Disclosure Agreements
Any consultant that can access
your network should provide you
with a non-disclosure /
confidentiality agreement

41. Cyber Insurance
Work with your legal and insurance contacts to
make sure you have the necessary level of cyber
insurance in the event of an attack or data breach

42. Education
• Critically important – end users are
often your weakest security link!
• Provide security training during the
onboarding process
• Provide your staff with an annual
security training
• Provide additional training to anyone
with direct contact with PHI, PII, or
other sensitive information
• Have employees sign a document that
they acknowledge the security
policies

43. Kevin Ricci, Director of IT
kricci@lgcd.com
(401) 421-4800 x278