Category: Cybersecurity

Cyber Concerns Rise in the Wake of Russia’s Invasion of Ukraine

March 11, 2022

threatening hooded figure with the word cyber security superimposed to illustrate post on best practices for cybersecurity

Cybercriminals love pandemics, natural disasters, and wars. Global distractions are good for their business.

Russia’s invasion of Ukraine elevates cyber security risks, which were already on the minds of global business leaders. So far, the incursion has delivered new distributed denial of service (DDoS) attacks and a novel malware, Hermetic Wiper.

While most attacks have targeted Ukraine’s government, infrastructure, and financial services, US companies need to be on guard against spillover and direct attacks. The US/British-owned insurance broker AON was attacked on February 25. Although no direct connection has been reported, this was one day after the invasion.

But business leaders around the world did not need a war to stir their anxieties about cyber-attacks. The Allianz Risk Barometer, which surveys over 2,650 risk management experts around the world, identified cyber risk as the number-one threat to global businesses for 2022.

That means companies worry more about potential data breaches, ransomware attacks, and major IT outages than supply chain disruptions, COVID-19, or natural disasters. The second highest-rated concern was a business interruption, which can result from a catastrophic cyber-attack.

Not being able to provide products and services on time or–at all–is a frightening prospect. Business interruptions can have long-lasting, and for some companies, fatal impacts.

Tower’s commitment to business continuity relies on our powerful cybersecurity system and exacting protocols. These include the installation of anti-malicious software and its updates, the use of multi-factor authentication (MFA), VPNs, and real-time, 24/7 monitoring to detect and mitigate cyber intrusions. In addition, our employees receive extensive cybersecurity training and understand how to do their part to prevent breaches. We invest considerable time, thought, effort, and money to secure our data and our clients’ data.

Because data transfer presents a vulnerability, we also have a Vendor Risk Assessment Process for all third parties that can access Tower’s data, networks, and servers. In a digital age, companies need to be as concerned about their partners’ cybersecurity practices as they are about their own.

Hopefully, the war in Ukraine will not provoke massive cyber-attacks, but now is the time to secure your perimeters. To help you tell if your organization is as cyber secure as it can be, here’s a checklist gleaned from our partner, Palo Alto Networks, and the Shields Up site from the US government’s Cybersecurity & Infrastructure Security Agency (CISA).

  • Implement multi-factor authentication on your accounts.
  • Lockdown your network. Disable all applications, ports, and protocols that are not essential to operations.
  • Ensure software is up to date
  • Reinforce employee training, especially regarding clicking on strange emails. According to CISA, 90% of ransomware attacks come through phishing
  • Renew your plan for managing an attack.
    • Walkthrough scenarios in table-top exercises.
    • Test back-up and recovery plans and continuity of operations in case a network is disabled.
    • Make sure the emergency contact information for your people and partners is updated and available.
    • Revisit your crisis communications plan.

Most cyber threats can be managed, but we must be proactive. If your IT professionals have been requesting funds to strengthen cyber security, take this time to analyze the proposed solutions. Invest while you can.

Our CEO Rita Wilson has a strong technology background and a keen interest in these issues. If you have questions or just want to discuss your cyber security concerns, contact her at rita.wilson@towermsa.com

Meantime, shields up!

Forbes Features Tower CTO‘s Article, “How to Help the Masses Make Sense of Cybersecurity”

December 8, 2021

hands on a keyboard overlaid with a lock symbol to illustrate cybersecurity

Tower’s Chief Technology Officer Jesse Shade has published an article on the Forbes Technology Council channels, reminding fellow IT pros that most tech users don’t understand cybersecurity. And that when IT folks explain why doing certain things are important, users are more likely to do them.  Here’s his explanation of Multi Factor Authentication or MFA:

MFA stands for multifactor authentication. It is a security solution that requires more than one method of proving (authenticating) your identity. You have already used MFA if you have ever logged into an online account and were asked to provide information so you could:

 Receive a verification code via text or email.

  • Provide an answer to a security question.
  • Receive a verification code on a phone or computer authenticator application.
  • Use biometrics (fingerprint or facial recognition) on your computer or phone.

The rationale behind MFA is that if a bad actor gains access to your username and password, they aren’t likely to also have your mobile phone or computer where you will receive the second factor. It is even less likely they will have your fingerprint, retinal scan or the answers to your security questions. There are multiple factors to authenticate that you are who you say you are, hence, MFA.

How to Help the Masses Make Sense of Cybersecurity is a must-read piece on the role of IT pros in arming non-IT tech users to serve as the front-line cybersecurity force they must be.

Feel free to reach out to Jesse at jesse.shade@towermsa.com.

Related:  Building a Better Tower – Cybersecurity

Building a Better Tower – Cybersecurity

February 18, 2021

hands on a keyboard overlaid with a lock symbol to illustrate cybersecurity

Tower has invested in significant cybersecurity initiatives to “Build a Better Tower” for our clients.  I provided a brief overview of those initiatives in a recent article and this week I highlight Tower’s investment in protecting Tower and our clients’ data.

Tower’s Cybersecurity Defenses

Long before COVID-19 came along, bringing a tsunami of cyberattacks, Tower had already proactively strengthened our internal IT defenses.

During the fall of 2019 we partnered with Vigilant Technology Solutions to use a service that combines passive monitoring technology with certified information security analysts. Through a customized deployment of Vigilant’s NDR (Network Detection and Response) and EDR (Endpoint Detection and Response) technology, Vigilant’s analysis engines and human threat hunting has reduced the time to detect and contain threats by 99.97% over the industry average.  Without this kind of 24/7/365 monitoring and action, bad actors can enter a system undetected and stay there for months learning how to circumvent security measures and destroying backup data resources.

The graph below shows the timeline of the recent attack on SolarWinds that ultimately compromised 18,000 through deployed software.  SolarWinds CEO disclosed an updated attack timeline, indicating that hackers had first accessed SolarWinds on September 4, 2019.  Source: SolarWinds blog, January 11, 2021.

But it is not sufficient to protect our own technology. We also educated our clients and others in the industry so they could understand and prevent cyber threats. Vigilant’s CEO Chris Nyhuis joined our VP of Information Technology Jesse Shade and another expert, Rob Kolb of Premier Mindset, for an eye-opening webinar in February.  It’s available on demand. Jesse also wrote two WorkCompWire articles with excellent advice that you can read here and here.

Third-Party Risk Assessments

In addition to ensuring the protection of its internal data, Tower also implemented a Vendor Risk Assessment Process for all third parties that had access to Tower data or networks or housed servers that stored our data. Our philosophy is that we are only as strong as our weakest link.  The result of this assessment is a vendor management process that continuously measures and monitors our partners to ensure that as per the AICPA Trust Criteria, we consistently honor the commitments made to our clients.

These are just a few of the ways that Tower is continually and proactively enhancing our infrastructure, processes and offerings to deliver measurably better services to you.

Rita Wilson,
Chief Executive Officer

 

Building a Better Tower

February 4, 2021

Man with blocks is building a tower

To master an understatement, 2020 was an unprecedented year of uncertainty and challenge for Tower MSA Partners.

When travel came to a halt and face-to-face meetings, conferences, and other business activities transitioned to a virtual environment, a new “normal” arrived. Tower MSA Partners, like many other companies, acclimated to these changes, believing that we could wait out the pandemic. 

Very quickly though, our leadership team realized that by looking inward, this time of external change could be used as time of growth for our company.  Our introspection produced actions to further strengthen our technology and services and to identify best-in-class partners in order to provide greater value to our clients and to build a “better Tower” for all stakeholders.  

When work from home (WFH) was mandated, Tower managed the transition seamlessly.  With 24/7/365 cybersecurity protection already in place for our network and data, full business continuity was achieved.  We consistently hit our target metrics in MSA turnaround time, cost mitigation and prescription drug treatment reductions without exception.

By looking at the internal controls that protect, monitor, and drive our business, we also created a stronger Tower that included:  Tower that included:

  • Increased cybersecurity – protecting Tower’s network and its clients’ data from a cyber threat.
  • Completed an intense SOC 2 Type 1 audit
  • Pursued strategic partnerships to extend best-in-class service
  • Created and delivered valuable educational content to help clients secure their own systems and data, enhance MSP compliance, and optimize MSAs
  • Introduced a free service — a 2nd Opinion on questionable MSAs
  • Deployed a Section 111 Management Dashboard to easily identify and correct errors, avoiding the potential for monetary penalties

Over the next few weeks we’ll explain these initiatives and others designed to provide secure and cost-effective MSP compliance services for our clients.

Rita Wilson

Chief Executive Officer
 

New Ransomware Attack Threatens Healthcare Sector

October 30, 2020

threatening hooded figure with the word cyber security superimposed to illustrate post on best practices for cybersecurity

Tower’s cybersecurity partners, Avertium and Vigilant, have advised us of a major ransomware attack, primarily targeting the healthcare sector.  The threat actor, known as “Ryuk,” uses phishing e-mails to gain access and then control of the victim’s computer and ultimately the company’s network.  Once in control, files are encrypted and only decrypted in exchange for a “ransom.”

Avertium sent Tower this joint cybersecurity advisory from the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS) detailing a resurgence of this threat.  Avertium also provided its cyber intelligence report which includes information on the attack and preventive measures.

Tower’s Response to Ransomware Threats

As a company that works directly with the healthcare sector, protection of our client’s information is critical to our Medicare Secondary Payer compliance services.  Consequently, upon receiving the report of the Ryuk threat we immediately contacted our cybersecurity partner, Vigilant Technology Solutions, to confirm protections are in place to counteract any threats to Tower’s system.

Vigilant assured us that cybersecurity best practices are in place.  First, its CyberDNA solution actively monitors Tower’s data traffic 24/7 and responds to threats in real time.  Second, our network-installed McAfee Endpoint Protection (MEP) identifies a potential threat as early as possible and prevents the threat from entering the network or database.  Third, our IT pros have previously taken the following recommended actions to keep customer data secure:

  • Ensure MEP is fully deployed to all applicable/at risk assets within your environment
  • Provide security awareness communications to employees as a reminder to be mindful during day-to-day activity:
    • Never open unsolicited emails and their attachments. 
    • Be wary of suspicious looking advertisements.
    • Limit / avoid the use of personal email on company assets.
  • Regularly update infrastructure (both operating system and application software) with the latest patches to ensure full coverage in addition to updated McAfee Anti-Virus software.
  • Ensure backups of data/records are regularly performed and available.

We urge our clients to confirm the above preventive measures are in place for their own network security. 

For more detailed information on preventing ransomware attacks, CISA provides an updated guide which can be found here.  If you have any questions regarding Tower’s cybersecurity program, please contact Jesse Shade, VP of Information Technology at jesse.shade@towermsa.com or 888.331.4941.

Towers’ VP of IT Jesse Shade on The Hot Seat

August 5, 2020

Jesse Shade Portrait

Jesse Shade, Tower’s Vice President of Information Technology, will be a panelist on the “Cybersecurity Threats: What You Can’t See Can Hurt You” webinar. Presented by WorkersCompensation.com as part of its The Hot Seat series, the free webinar starts at noon EDT on August 6.

Shade, who is a member of the Forbes Technology Council, brings more than 35 years of IT experience to the panel. He oversees all aspects of Tower’s technologies, including data security. 

Joining Jesse Shade in the information-packed session is the George State Board of Workers’ Compensation’s Director of Information Technology Bobby Allen and WorkersCompensation.com’s Media Director Nancy Grover.

Among the topics Jesse Shade will cover are:

  • Misconceptions about cybersecurity
  • Should organizations outsource cybersecurity efforts?
  • How can you guard against internet attack?

The webinar will be moderated by WorkersCompensation.com President and CEO Bob Wilson and Judge David Langham. There is no charge for the webinar.

Forbes Technology Council Welcomes Tower’s Jesse Shade

June 24, 2020

Jesse Shade Portrait

Tower’s Vice President of Technology Jesse Shade has joined Forbes Technology Council, a prestigious invitation-only forum of senior CIOs, CTOs, and technology execs.  Members collaborate to help solve daily business challenges—like cybersecurity threats—and share insights in Forbes.com articles. Read the related release: Tower MSA Partners’ Vice President of IT, Jesse Shade Accepted into Forbes Technology Council

We know Jesse will be a major asset to the Council because he delivers such high value to Tower. Possessing an unusual blend of interpersonal skills as well as hands-on technical expertise, he is responsible for strategic planning and serves on Tower’s executive team.  

Tower designed and built its own technology based on best practices in MSP compliance and MSA preparation.  The seamless system drives all compliance processes from Section 111 Mandatory Insurer Reporting, conditional payment resolution, MSA triage, and clinical interventions all the way through MSA preparation, CMS submission, and claim closure.

To be simple for clients to use, technology has to be quite complex behind the scenes.  That’s where Jesse’s 35+ years of IT experience in numerous industries, including banking, defense and aviation, comes into play. He leads development efforts for our proprietary technology and its network infrastructure all within a cybersecurity framework that protects Tower and its clients and business partners. (To learn more about cybersecurity threats, especially during COVID-19, check out Jesse’s two Leaders Speak articles on WorkCompWire.)

We’re proud that Jesse will be participating in Forbes’ exclusive Technology Council and look forward to seeing his articles in Forbes.com.

Related information

Jesse Shade

Forbes business communities

Best Practices for Cybersecurity

May 26, 2020

threatening hooded figure with the word cyber security superimposed to illustrate post on best practices for cybersecurity

Tower MSA Partners’ SVP of IT Jesse Shade offers advice to workers’ compensation companies on best practices for cybersecurity.

Did you know that personal health information (PHI) is more valuable on the black market than financial data?  This makes workers’ comp organizations very attractive targets for cyber criminals.

“Payers and other workers’ compensation organizations need to guard this sensitive data within their own enterprises. And, since these companies regularly exchange data with each other, each company needs to be just as concerned about the cybersecurity practices of its partners as its own,” says Tower’s Senior Vice President of Information Technology, Jesse Shade in this informative WorkCompWire article: Securing Data During COVID-19 and Beyond.

In last week’s article – COVID-19 Response Triggers Cybersecurity Threats to Workers’ Comp –  Jesse described the scope of the cybersecurity issue especially in the midst of COVID-19.  In this one, he outlines out best practices for cybersecurity in the form practical ways to protect PHI and other data and discusses the tools your IT department needs. He also gives you questions for your managed care organizations, MSP compliance companies and other service providers to ensure that their security practices can withstand attacks.

Cyberattacks have risen astronomically during COVID-19 and will continue long after the pandemic passes.  The IBM Cost of a Data Breach Report put the average cost of a data breach in the U.S. at $8.19 million in 2019.  In addition to the financial hit, companies risk their reputations and the trust of their clients, customers and partners. 

As Jesse says, you can’t afford to ignore cybersecurity.  

Related:

Building a Better Tower – Cybersecurity

 

Tower’s Jesse Shade Warns of Cyberattacks During COVID-19 and Tells How to Mitigate Them

May 15, 2020

ominous figure embedded in coding to illustrate cybersecurity threats

When Tower held its cybersecurity webinar in February, presenters stressed that cyberattacks increase dramatically during a crisis. This certainly holds true for COVID-19. Attacks soared by 330% in its early weeks, according to an Atlas VPN report.

Workers’ compensation payers, third-party administrators, ancillary care providers, and MSP compliance companies pose very attractive targets – regardless of the size of the company.  

They store, manage, and transfer large volumes of protected health information (PHI), which is quite valuable to criminals.

In this WorkCompWire article, our Senior Vice President of Information Technology, Jesse Shade, explains how cyberattacks occur and describes security measures to protect networks, systems, and data.

During the work-from-home transition, experienced IT pros deployed VPNs to connect remote machines to enterprise networks and installed the latest and greatest security software.

However, if a company can buy antivirus and antimalware software off the shelf or online, so can criminals. And, they analyze these products and create ways to work-around their security  capabilities.

Threat actors can even enter a network undetected and stay there for months and learn how to circumvent its security measures. Jesse recommends proactive solutions to prevent breaches in this timely story.