Mailbox Security

At Health IT we are Focused on Security. We do everything we can to protect you, your reputation, your technology infrastructure, and your patient’s privacy from day one.

• We protect your network perimeter with a managed modern firewall.
• We protect your computers with our layered Security Stack. While this provides protection from the consequences of a cyber attack, it does not protect the mailbox itself.
• We protect your practice data with great backups and secure remote access.

But your email and your data increasingly live in the cloud — and that’s where the attacks are getting through. Most of what we see now targets your Microsoft or Google identity: break into a mailbox, get access to any data in email or Sharepoint / Onedrive. Multi-factor authentication is critical but not complete protection – there are ways around this now. We’re seeing enough of these attacks succeed across our customer base to act.

So we’re strengthening the security around your mailbox and identity. It comes in three parts:

• Browser Security. A managed browser extension for Chrome and Edge. It has one job – to stop you handing your credentials to a fake Microsoft 365 site, in real time. We’re rolling this out now.
• In-Email Security. Spam and phishing filtering, attachment scanning, and risk-based banners. Every message is examined and comes with advice on how safe it is. Every link is sandboxed, so a dodgy click doesn’t hurt you. We’re rolling this out now.
• Identity Protection. A 24/7 service that detects and shuts down identity threats — business email compromise, credential theft, session hijacking, and rogue sign-in apps. If you do get hacked in the middle of the night this will mitigate the damage. We’ve almost completed rolling this out.

Combined with our Cyber Security Training which is free to every customer and our existing endpoint and site security, we have a layered, robust defence to meet the challenges that are coming.

Optional extras

• Mailbox Backup. Covers mailboxes plus SharePoint and Teams. Not every mailbox needs it, so we apply it only where you want it.
• Email Encryption. Encrypt any outgoing email, even from Best Practice, Medical Director, or Genie. Add [Encrypt] to the start of the subject line and send as normal. The recipient’s identity is verified to decrypt it — no password to share, nothing for you to support.
• Security Monitoring (SIEM). We gather and watch the logs from your servers, firewalls, and Microsoft tenancies in one place. Often required for cyber insurance, increasingly required to deal with government, and possibly mandated before long. Traditionally expensive — but by building on the security stacks you already have, we make it far more affordable. In fact some SIEM is included with our identity protection to help protect you around the clock.

What else can we do to further protect your systems?

• Multi-Factor authentication (MFA) must protect every mailbox, every business application available over the Internet, and every remote access into your systems.
• We are currently implementing DMARC which is a system designed to prevent email spoofing, where a bad actor pretends to send email from your address, resulting in a lot of nuisance work and potential reputational and operational damage to your business.
• We make Cyber Security Training available at no cost to every customer. We’ve upgraded to the Cyberhoot system because of its good content which takes only a few minutes a month to consume. Your people are at the front line of your cyber security and they should be forearmed with the knowledge to help protect your business.
• We provide Beacon at no cost to help with your physical security. Beacon is an alert system that runs on your computers.

What’s next in security?

Health IT has again achieved Gold certification of the SMB1001 security standard. This new standard is full of simple security controls that are applicable and available to small business. Alongside the Australian government’s Essential Eight we think these controls are excellent at protecting a modern surgery. Accrediting to a certification of this standard is not expensive and will uplift your security posture and reduce the risk of cyber attack / data breach. Health IT will soon be offering services around SMB1001 including auditing and uplifting your overall cyber security.

Is there anything Health IT cannot help me with?

Yes! Well we can’t force your staff to do their security training but apart from that – everybody should have a Password Manager. This makes it easy to make every password strong and unique. It can also store MFA tokens so that your security is not as obstructive to your day to day work. We don’t provide this because we believe that you should have a place to put private things that IT has no access to. We strongly recommend 1Password or LastPass. While we choose not to resell this solution we can help you implement it. This seems like a good place to remind you that we also provide a secure password generation system at https://passphrase.com.au/ .

Did you know?

If you hold a current Avant Practice Medical Indemnity insurance policy, you are automatically covered for up to $100,000 of Cyber Security Insurance. Talk to Avant for details.

Need more information?

You know you can get straight through to a human in Brisbane by calling us on (07) 38394321. Or use this form to contact us.