Coleman Technologies Blog

What Does a Security Audit Entail?

A security audit is intended to determine how effectively your business’ security is doing its job. Covering hardware specifications, your infrastructure as a whole, your network policies, the software you’re using, even how your employees behave, a good security audit will give you a complete picture of the protections and safeguards you have in place.

The reason behind doing this is simple: it allows you to identify (and, in theory, mitigate) any shortcomings in your current security infrastructure. Once your audit has been completed, you should essentially have a checklist of any detected vulnerabilities to attend to. Whether “attending to” these solutions will result in you decommissioning, consolidating, adding to, or reconfiguring them will all depend on the challenges you encounter.

Of course, considering how quickly technology can develop (particularly that which pertains to the business environment), these audits should be performed on a fairly regular basis. Even changes to your processes or the odd software update could easily expose you to new, unforeseen vulnerabilities.

In any case, documentation will be your greatest ally throughout this process. Any audit that is completed properly will generate an extensive list of discoveries, evaluations, and suggested next steps pertaining to your business’ security. These outlines should be detailed and particular, going so far as to identify specific departments within your organization if need be. Perhaps, due to the nature of the information they interact with, your HR department needs to have more cybersecurity protecting it specifically. Whatever your situation, your audit should give you a clear path to follow moving forward.

What You Might Discover During Your Audit

A brief disclaimer seems appropriate here: this is FAR from a comprehensive list. There are hundreds of issues that an audit could potentially catch, but in our experience, these are the most common discoveries:

• Poor password hygiene
• Data retention/backup policies not getting followed
• Granting permissions to users who don’t need them
• Misconfigured or outdated security software
• Inconsistent access control levels on folders on the network
• Non-compliant, unauthorized software installed on workstations
• Sensitive data being stored incorrectly
• Undocumented, outdated, or untested incident response plans
• Insufficient (or non-existent) activity auditing

Again, there are hundreds more possibilities, so be prepared.

Compliance Requirements

There are many standards that different industries and governing bodies have set for businesses to uphold, under threat of fines and other challenges if any shortcomings are discovered. Therefore, in order to pass these compliance standards, it is mandatory to run audits based around those that apply to your operations. These may include:

• SOC 2 type I
• SOC 2 type II
• ISO 27001
• GDPR (General Data Protection Regulation)
• SOx (Sarbanes-Oxley Act)
• HIPAA
• PCI-DSS
• FINRA
• FISMA

Again, this is not a comprehensive list, so make sure you are aware of any compliance regulations that you are expected to abide by.

Coleman Technologies is always here to help you make sure that your IT is properly managed and maintained—including the security and compliance standards that apply to it. To find out more about what we can do to help your business with its IT and cybersecurity, schedule a consultation with us at (604) 513-9428.

As technology continues to gain prominence in healthcare, it plays an increasingly vital role. Advancements in technology have allowed the healthcare industry to stabilize costs, improve access, and personalize care delivery—objectives that were challenging in the past. These benefits come with a potential downside: data privacy issues, which are becoming more concerning as technology advances.

How Technology Drives Healthcare

Technology hasn't just updated outdated systems and methods of care delivery—it has also brought about several significant improvements, streamlined the process between pharmacies, doctors, and insurance companies, enabling patients to obtain necessary prior authorizations more efficiently.

• Smarter medical devices - The widespread adoption of electronic medical records (EMRs) in doctors' offices and hospitals allows for secure, cloud-based record sharing, leading to higher quality care.
• Better predictive capabilities - Enhanced technology enables healthcare organizations to predict and manage outbreaks of contagious diseases before they escalate.

Data Privacy Challenges

Despite the advancements in technology, data privacy remains a critical concern. The sensitive nature of personal health information (PHI) and the growing threat of cybersecurity breaches make this issue particularly pressing. Healthcare providers need to keep software updated, as cybercriminals can take advantage of weaknesses before updates are fully implemented. While there is much to be excited about in healthcare technology, these advancements come with inherent risks.

To combat these challenges, healthcare organizations are heavily investing in cybersecurity.

Upgrading to newer, more secure systems is crucial for preventing security breaches. With robust security measures in place, healthcare technology can reach its full potential. Additionally, initiatives like the U.S. Food and Drug Administration’s (FDA) push to establish clear guidelines for cybersecurity in healthcare systems emphasize the importance of protecting sensitive data in an increasingly digital world.

Emerging technologies such as blockchain and AI also offer promising avenues for enhancing PHI security. However, the effectiveness of these innovations will depend on the level of investment organizations are willing to make.

If your medical practice needs help with their technology, our technicians can take a look. Give us a call at (604) 513-9428 to get started. 

What is BlueKeep?

BlueKeep is a malware strain that was first discovered in May 2019, and was patched in short order to prevent it from becoming another situation like EternalBlue. EternalBlue was the exploit that allowed WannaCry to have such a considerable impact, especially on healthcare providers in the UK. Despite this precedent, however, many hospitals neglected to apply the necessary patches--and that isn’t even the worst part.

The worst part is that the three systems that BlueKeep impacts (Windows 7, Windows Server 2008, and Windows Server 2008 R2) share one thing in common: they have all passed their end-of-life date, and therefore no longer receive security updates.

This makes this situation a two-fold disaster. Not only have patches been released to mitigate BlueKeep, the systems affected by BlueKeep should not be in use anyways.

Of course, it only gets worse, and paints an unfortunate portrait of medical IT. A reported 22 percent of BlueKeep-vulnerable devices are yet unpatched. Worse, 45 percent of connected medical devices remain vulnerable, making things like x-rays, anesthesia machines, and other care-driven technology a risk to use.

Are you concerned about your organization’s technology?

Lean on the IT experts at Coleman Technologies for assistance. We can help any organization ensure that their technology won’t put their operations or their patrons in harm’s way. Learn more about what we can do by calling us at (604) 513-9428.