News

[longevitytechnologies-blog]

What is cloud computing? Everything you need to know about the cloud, explained

What is cloud computing, in simple terms? Cloud computing is the delivery of on-demand computing services -- from applications to storage and processing power -- typically over the internet and on a pay-as-you-go basis.   How does cloud computing work? Rather than owning their own computing infrastructure or data centers, companies can rent access to anything from applications to storage from a cloud service provider. One benefit of using cloud computing services is that firms can avoid the upfront cost and complexity of owning and maintaining their own IT infrastructure, and instead simply pay for what they use, when they use it. In turn, providers of cloud computing services can benefit from significant economies of scale by delivering the same services to a wide range of customers. What cloud computing services are available? Cloud computing services cover a vast range of options now, from the basics of storage, networking, and processing power through to natural language processing and artificial intelligence as well as standard office applications. Pretty much any service that doesn't require you to be physically close to the computer hardware that you are using can now be delivered via the cloud. What are examples of cloud computing? Cloud computing underpins a vast number of services. That includes consumer services like Gmail or the cloud back-up of the photos on your smartphone, though to the services which allow large enterprises to host all their data and run all of their applications in the cloud. Netflix relies on cloud computing services to run its its video streaming service and its other business systems too, and have a number of other organisations. Cloud computing is becoming the default option for many apps: software vendors are increasingly offering their applications as services over the internet rather than standalone products as they try to switch to a subscription model. However, there is a potential downside to cloud computing, in that it can also introduce new costs and new risks for companies using it. Why is it called cloud computing? A fundamental concept behind cloud computing is that the location of the service, and many of the details such as the hardware or operating system on which it is running, are largely irrelevant to the user. It's with this in mind that the metaphor of the cloud was borrowed from old telecoms network schematics, in which the public telephone network (and later the internet) was often represented as a cloud to denote that the just didn't matter - it was just a cloud of stuff. This is an over-simplification of course; for many customers location of their services and data remains a key issue. What is the history of cloud computing? Cloud computing as a term has been around since the early 2000s, but the concept of computing-as-a-service has been around for much, much longer -- as far back as the 1960s, when computer bureaus would allow companies to rent time on a mainframe, rather than have to buy one themselves. These 'time-sharing' services were largely overtaken by the rise of the PC which made owning a computer much more affordable, and then in turn by the rise of corporate data centers where companies would store vast amounts of data. But the concept of renting access to computing power has resurfaced again and again -- in the application service providers, utility computing, and grid computing of the late 1990s and early 2000s. This was followed by cloud computing, which really took hold with the emergence of software as a service and hyperscale cloud computing providers such as Amazon Web Services. How important is the cloud? Building the infrastructure to support cloud computing now accounts for more than a third of all IT spending worldwide, according to research from IDC. Meanwhile spending on traditional, in-house IT continues to slide as computing workloads continue to move to the cloud, whether that is public cloud services offered by vendors or private clouds built by enterprises themselves. 451 Research predicts that around one-third of enterprise IT spending will be on hosting and cloud services this year "indicating a growing reliance on external sources of infrastructure, application, management and security services". Analyst Gartner predicts that half of global enterprises using the cloud now will have gone all-in on it by 2021. According to Gartner, global spending on cloud services will reach $260bn this year up from $219.6bn. It's also growing at a faster rate than the analysts expected. But it's not entirely clear how much of that demand is coming from businesses that actually want to move to the cloud and how much is being created by vendors who now only offer cloud versions of their products (often because they are keen to move to away from selling one-off licences to selling potentially more lucrative and predictable cloud subscriptions).

Predictions for cloud computing revenues to 2021 from 451 Research. Image: 451 Research   What is Infrastructure-as-a-Service?   Cloud computing can be broken down into three cloud computing models. Infrastructure-as-a-Service (IaaS) refers to the fundamental building blocks of computing that can be rented: physical or virtual servers, storage and networking. This is attractive to companies that want to build applications from the very ground up and want to control nearly all the elements themselves, but it does require firms to have the technical skills to be able to orchestrate services at that level. Research by Oracle found that two thirds of IaaS users said using online infrastructure makes it easier to innovate, had cut their time to deploy new applications and services and had significantly cut on-going maintenance costs. However, half said IaaS isn't secure enough for most critical data. What is Platform-as-a-Service? Platform-as-a-Service (PaaS) is the next layer up -- as well as the underlying storage, networking, and virtual servers this will also include the tools and software that developers need to build applications on top of: that could include middleware, database management, operating systems, and development tools. Insight platforms as a service: What they are and why they matter What is Software-as-a-Service? Software-as-a-Service (SaaS) is the delivery of applications-as-a-service, probably the version of cloud computing that most people are used to on a day-to-day basis. The underlying hardware and operating system is irrelevant to the end user, who will access the service via a web browser or app; it is often bought on a per-seat or per-user basis. According to researchers IDC SaaS is -- and will remain -- the dominant cloud computing model in the medium term, accounting for two-thirds of all public cloud spending in 2017, which will only drop slightly to just under 60 percent in 2021. SaaS spending is made up of applications and system infrastructure software, and IDC said that spending will be dominated by applications purchases, which will make up more than half of all public cloud spending through 2019. Customer relationship management (CRM) applications and enterprise resource management (ERM) applications will account for more than 60 percent of all cloud applications spending through to 2021. The variety of applications delivered via SaaS is huge, from CRM such as Salesforce through to Microsoft's Office 365. Cloud computing benefits The exact benefits will vary according to the type of cloud service being used but, fundamentally, using cloud services means companies not having to buy or maintain their own computing infrastructure. No more buying servers, updating applications or operating systems, or decommissioning and disposing of hardware or software when it is out of date, as it is all taken care of by the supplier. For commodity applications, such as email, it can make sense to switch to a cloud provider, rather than rely on in-house skills. A company that specializes in running and securing these services is likely to have better skills and more experienced staff than a small business could afford to hire, so cloud services may be able to deliver a more secure and efficient service to end users. Using cloud services means companies can move faster on projects and test out concepts without lengthy procurement and big upfront costs, because firms only pay for the resources they consume. This concept of business agility is often mentioned by cloud advocates as a key benefit. The ability to spin up new services without the time and effort associated with traditional IT procurement should mean that is easier to get going with new applications faster. And if a new application turns out to be a wildly popular the elastic nature of the cloud means it is easier to scale it up fast. For a company with an application that has big peaks in usage, for example that is only used at a particular time of the week or year, it may make financial sense to have it hosted in the cloud, rather than have dedicated hardware and software laying idle for much of the time. Moving to a cloud hosted application for services like email or CRM could remove a burden on internal IT staff, and if such applications don't generate much competitive advantage, there will be little other impact. Moving to a services model also moves spending from capex to opex, which may be useful for some companies. Cloud computing advantages and disadvantages Cloud computing is not necessarily cheaper than other forms of computing, just as renting is not always cheaper than buying in the long term. If an application has a regular and predictable requirement for computing services it may be more economical to provide that service in-house. Some companies may be reluctant to host sensitive data in a service that is also used by rivals. Moving to a SaaS application may also mean you are using the same applications as a rival, which may make it hard to create any competitive advantage if that application is core to your business. While it may be easy to start using a new cloud application, migrating existing data or apps to the cloud may be much more complicated and expensive. And it seems there is now something of a shortage in cloud skills with staff with DevOps and multi-cloud monitoring and management knowledge in particularly short supply. In one recent report a significant proportion of experienced cloud users said that they thought upfront migration costs ultimately outweigh the long-term savings created by IaaS. And of course, you can only access your applications if you have an internet connection. What is cloud computing adoption doing to IT budgets? Cloud computing tends to shift spending from capital expenditure (CapEx) to operating expenditure (OpEx) as companies buy computing as a service rather than in the form of physical servers. This may allow companies to avoid large increases in IT spending which would traditionally be seen with new projects; using the cloud to make room in the budget may be easier than going to the CFO and looking for more money. "CIOs are increasingly turning to cloud infrastructure and services in order to increase flexibility and relieve pressure on capital budgets," notes ZDNet's survey of IT budget predictions. Of course, this doesn't mean that cloud computing is always or necessarily cheaper that keeping applications in house; for applications with a predictable and stable demand for computing power may be cheaper (from a processing power point of view at least) to keep in-house.   via What is cloud computing? Everything you need to know about the cloud, explained | ZDNet Read the full article

[longevitytechnologies-blog]

US bitcoin bomb threat ransom scam looks like a hoax say FBI, cops

Police departments around the US say they've been apprised of emailed bomb threats seeking payment in cryptocurrency or else explosions will ensue. On Thursday morning, the New York Police Department issued an advisory about an email message being circulated that threatens to detonate a bomb in the recipient's workplace unless a bitcoin payment is made. "While this email has been sent to numerous locations, searches have been conducted and NO DEVICES have been found," the NYPD said via Twitter. Two hours later, the NYPD said that, while it intends to respond to reports from individuals who have received this message, the threats do not appear to be credible. Police in Chicago, Illinois, Montgomery County, Maryland, San Francisco, California, Los Angeles, California and Washington, DC, among others, have issued similar statements indicating the emailed threat has been distributed nationwide. Though it looks to be highly unlikely that any explosives have been planted in conjunction with this bulk bomb mailing, the messages have nonetheless caused widespread disruption because some targeted organizations took precautionary actions such as evacuations or lockdowns. On Thursday afternoon, the FBI issued a statement: "We are aware of recent bomb threats made in cities around the country, and we remain in touch with our law enforcement partners to provide assistance." The federal law enforcement agency urged the public to remain vigilant and report suspicious activities that could threaten public safety. Given the mass distribution of these bomb threats, that's likely to mean a lot of incoming calls and messages. Screenshots of different threat message variants have been posted to Twitter and they include different bitcoin addresses where those targeted have been directed to send $20,000 in bitcoin. The bomb threat notes we've reviewed begin with the sort of incorrect use of English common to online extortion and spam schemes: "There is an explosive device (Tetryl) in the building where your company is conducted." Other messages posted online are similar but not identical, suggesting an attempt at A/B testing to figure out the most lucrative way to phrase the apparently empty threat. Ironically, the campaign itself appears to have bombed: No transactions have been recorded yet, at least at the bitcoin addresses we checked. The notes conclude with a disclaimer: "If an explosion occurred and the authorities notice this message: We arent a terrorist organization and dont take any responsibility for explosions in other buildings." Investigators may not take the extortionists at their word, given that anti-terror laws are likely to make identifying and extraditing the culprits a bit easier.   via US bitcoin bomb threat ransom scam looks like a hoax say FBI, cops • The Register Read the full article

[longevitytechnologies-blog]

What You Need to Know About PCI DSS Compliance this Holiday Season

In addition to facing a sophisticated and rapidly evolving cybersecurity landscape, enterprises must also adhere to legal regulations around data storage and security. Failure to comply with measures like the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI DSS) leaves both companies and, more importantly, their customers at risk. With the busy holiday shopping season in full swing, and retailers experiencing dramatically higher transaction volumes, protecting customer information and payment data cannot be an afterthought. What’s the deal with PCI DSS? All major credit card companies – Visa, MasterCard, American Express, Discover and JCB – abide by a set of security standards to ensure protection of sensitive customer information, such as credit card numbers, during transactions. Any business that wants to conduct even a single retail transaction using credit cards must comply with PCI DSS or it will be unable to accept payments by credit card. If a company is just starting to accept credit card transactions – perhaps as an online retailer or a smaller business – then the first thing to understand is how payments are being processed and what data is being collected and stored. Once the type of data being collected is understood, then it is easier to identify what information is needed and what is not. This is a critical first step to understanding which requirements apply to a specific company. As with many other compliance regulations, PCI DSS places the responsibility for compliance on the business conducting the transactions; meaning the retailer is responsible for both the compliance of its third-party payment service providers and internally-hosted systems. Being PCI DSS compliant means that you are ensuring the safety of your customers’ valuable data, keeping it out of the hands of bad guys who would want to resell it or make fraudulent transactions. For companies struggling to ensure they meet the right level of compliance, start by reviewing the information available through the PCI Security Standards Council and kicking things off with the PCI 3-Step Process. ‘Tis the season The holiday season is a busy time of year, but not just for shoppers and retailers – it’s also a prime time for hackers and cybercriminals to take advantage of unsuspecting victims. There are many different risks companies and customers may encounter, including fraudulent credit card transactions. Although chip technologies, PIN transactions and card-verification for online transactions are helping to curb fraudulent transactions, cybercriminals continue to devise new ways to score big during the holidays. A second risk – and this is as much to a retail brand as it is to the customer – concerns fraudulent websites and advertisements. A successful tactic for criminals is to buy a soundalike domain name and use that to set up a fake web-store for a high-end and popular brand. Typically, these scams rely on people mistyping the name of a site to be found, but recently it’s not unusual to see cybercriminals creating fake social media accounts to advertise a sale or send phishing emails advertising huge deals. These tactics pose a substantial risk to retailers. Even though these scams are propagated by cybercriminals, victims who believe they have executed a valid purchase often blame the real retailer for the deceit. This year, the Federal Bureau of Investigation even issued a warning about these scams ahead of Black Friday and Cyber Monday. Stay vigilant  Online and in-store transaction volumes experience a huge boost this time of year, so as early as possible, make sure that all your systems are up-to-date and running smoothly to reduce the risk of any outage, as well as potential damage from a breach. The sheer volume of online transactions will make it easier for cybercriminals to hide code inside a vulnerability or try a few quick password brute-force attacks while everyone is preoccupied with their shopping lists. While no plan is never 100 percent foolproof, retailers need to start by covering these bases: • Be PCI DSS compliant. Keeping systems secure and compliant with PCI DSS signals to customers that they can be confident all sensitive payment card information is protected and out of reach from malicious actors hoping to rack up fraudulent transactions using the funds of unsuspecting shoppers. • Patch all systems with the latest available releases of software, malware signatures, policies and IPS/IDS updates. • Activate multi-factor authentication and make sure it is working correctly for all systems, especially those that give access to any cardholder data. This is a requirement in PCI DSS, but the holiday period is a great chance for checking it once, then checking it twice. • Have a team available during the holiday period to monitor and audit security logs on, at a minimum, a daily basis. We know that it takes around 200 days for many breaches to be detected; instating a higher amount of review during this critical time can significantly reduce detection and remediation time. Failure to implement these basic cybersecurity hygiene practices will leave retailers vulnerable to damage and fines during a lucrative time for their businesses – and a celebratory time for their customers.   via What You Need to Know About PCI DSS Compliance this Holiday Season | SecurityWeek.Com Read the full article

[longevitytechnologies-blog]

The worst passwords of 2018 are just as dumb as you'd expect

It doesn't look like we're getting any smarter about our passwords. On Thursday, software company SplashData released its annual list of the Top 100 worst passwords, and it includes some pretty obvious blunders. Coming in at No. 1 is, you guessed it, "123456," and in second place is, yup, "password." This is the fifth year in a row these passwords have held the top two spots. Newcomers to the list include "666666" (No. 14), "princess" (No. 11) and "donald" (No. 23). "Sorry, Mr. President, but this is not fake news -- using your name or any common name as a password is a dangerous decision," SplashData CEO Morgan Slain said in a release. "Hackers have great success using celebrity names, terms from pop culture and sports, and simple keyboard patterns to break into accounts online, because they know so many people are using those easy-to-remember combinations." To compile its list, SplashData evaluated more than 5 million leaked passwords, mostly from users in North America and Western Europe. The company estimates that about 10 percent of people have used at least one of the Top 25 worst passwords, and about 3 percent have used "123456." "It's a real head-scratcher that with all the risks known, and with so many highly publicized hacks, such as Marriott and the National Republican Congressional Committee, that people continue putting themselves at such risk year after year," Slain said. Celebrities and government officials aren't immune to choosing terrible passwords, a Wednesday report from Dashlane made plain. The top offender on that list was Kanye West, who revealed at an October meeting with President Donald Trump that his iPhone passcode is "000000." Here are the 25 worst passwords of 2018, according to SplashData: 1) 123456 2) password 3) 123456789 4) 12345678 5) 12345 6) 111111 7) 1234567 8) sunshine 9) qwerty 10) iloveyou 11) princess 12) admin 13) welcome 14) 666666 15) abc123 16) football 17) 123123 18) monkey 19) 654321 20) !@#$%^&* 21) charlie 22) aa123456 23) donald 24) password1 25) qwerty123   via The worst passwords of 2018 are just as dumb as you'd expect - CNET Read the full article

[longevitytechnologies-blog]

Marriott announces data breach affecting 500 million hotel guests

International hotel chain Marriott announced today a security breach during which the personal details of 500 million hotel guests was stolen. The breach happened in 2014, but Marriott says it became aware of it on September 10, two days after its staff spotted an alert from an internal security tool about an attempt to access the Starwood guest reservation database in the United States. The hotel chain says it worked with leading security experts to investigate the alert. Investigators discovered the intrusion, dating back to 2014, but also that an unauthorized party had copied and encrypted information, and took steps towards removing it. Marriott said forensic experts managed to decrypt the data attackers stole from the Starwood guest reservation database earlier this month, on November 19. They said the attackers exfiltrated information on up to approximately 500 million guests who made a reservation at a Starwood property. The Starwood hotel chain, which Marriott acquired in 2016, includes other hotel brands, such as W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels. Investigators said that for 327 million of the Starwood guests, the information that attackers stole included a name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ("SPG") account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. For some of these guests, payment card data was also stolen, but Marriott did not say for how many. "For some, the information also includes payment card numbers and payment card expiration dates, but the payment card numbers were encrypted using Advanced Encryption Standard encryption (AES-128)," the hotel said today in an SEC filing. "There are two components needed to decrypt the payment card numbers, and at this point, Marriott has not been able to rule out the possibility that both were taken," the hotel chain added. For the rest, up to 500 million, the data only included a name, and sometimes other info such as mailing address, email address, or other information. Marriott started today notifying all affected guests via email. Hotel guests will also be able to visit a website that will be available later today at info.starwoodhotels.com for information about the incident. Where eligible, some users will also be able to enroll in a free identity monitoring service. "We deeply regret this incident happened," said Arne Sorenson, Marriott's President and Chief Executive Officer. "We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward." "Today, Marriott is reaffirming our commitment to our guests around the world. We are working hard to ensure our guests have answers to questions about their personal information, with a dedicated website and call center. We will also continue to support the efforts of law enforcement and to work with leading security experts to improve. Finally, we are devoting the resources necessary to phase out Starwood systems and accelerate the ongoing security enhancements to our network," Sorenson added. This is the third breach affecting Marriott's Starwood chain after the infections with Point-of-Sale (PoS) malware disclosed in 2015 and again in 2016.   via Marriott announces data breach affecting 500 million hotel guests | ZDNet Read the full article

[longevitytechnologies-blog]

Hackers Breach Dunkin' Donuts Accounts in Credential Stuffing Attack

The donut giant first noticed the attack Oct. 31.   A credential stuffing attack has allowed hackers to take a big bite out of Dunkin’ Donuts customer data. The donut giant announced Tuesday evening that a data breach in October may have led to customers’ personal information being compromised. Dunkin’ Brands Inc. in an advisory  posted to its website said that on Oct. 31, a malicious actor attempted to access customers’ first and last names, email address, as well as account information for DD Perks, Dunkin Donuts’ rewards program. That account info include customers’  16-digit DD Perks account number and DD Perks QR code. Dunkin’ Donuts has forced a password reset that required all of the potentially impacted DD Perks account holders to log out and log back in to their account using a new password.

The company said that it believes the hacker obtained usernames and passwords from security breaches of other companies, and then used those usernames and passwords to try to break in to various online accounts via widespread automated login requests – a method also known as credential stuffing. “Although Dunkin’ did not experience a data security breach involving its internal systems, we’ve been informed that third-parties obtained usernames and passwords through other companies’ security breaches and used this information to log into some Dunkin’ DD Perks accounts,” the company said in its statement. Dunkin’ Donuts said its security vendor was successful in stopping most of these attempts, but it is possible still that the hacker may have succeeded in logging in to some DD Perks accounts. Credential stuffing is affordable and seamless, making it attractive for hackers to carry out – in fact, NuData Security, a Mastercard Company, has found that 90 percent of cyberattacks start with some sort of automation – with credential stuffing being a prominent one, like the one perpetrated on Dunkin’ Donuts. “The software for credential stuffing is now so affordable that this type of attack is becoming accessible for almost anyone,” Ryan Wilk, VP of customer success for NuData Security, said in an email. The incident points to the need for basic security password hygiene – specifically the need for users to utilize different passwords for different accounts. Wilk said that merely forcing customers to change their passwords is not entirely effective. “Having customers change their passwords is a temporary fix, a band-aid that doesn’t get to the root of the problem,” he said. “One effective way to stop this type of attack is to implement security solutions that detect this sophisticated automated activity at login and other placements. By using technologies that include behavioral biometrics, automated activity is flagged at login before it can even test any credentials in the company’s environment.” The incident is the second notable data breach of a company this week. On Wednesday, Dell EMC warned customers of unauthorized activity on its network that occurred on Nov. 9 when it believes adversaries attempted to access names, email addresses and hashed passwords.   via Hackers Breach Dunkin' Donuts Accounts in Credential Stuffing Attack | Threatpost | The first stop for security news Read the full article

[longevitytechnologies-blog]

Dell announces security breach

US-based hardware giant Dell announced today a security breach that took place earlier this month, on November 9. Dell says it detected an unauthorized intruder (or intruders) "attempting to extract Dell.com customer information" from its systems, such as customer names, email addresses, and hashed passwords. The company didn't go into details about the complexity of the password hashing algorithm, but some of these --such as MD5-- can be broken within seconds to reveal the plaintext password. "Though it is possible some of this information was removed from Dell's network, our investigations found no conclusive evidence that any was extracted," Dell said today in a press release. In a statement sent to ZDNet, Dell said it's still investigating the incident, but said the breach wasn't extensive, with the company's engineers detecting the intrusion on the same day it happened. A Dell spokesperson declined to give out a number of affected accounts, saying "it would be imprudent to publish potential numbers when there may be none." The company also said hackers didn't target payment card or any other sensitive customer information, and that the incident didn't cause a disruption of its normal services at the time of the breach or after. Dell initiated a password reset for all Dell.com customer accounts after it detected the intrusion earlier this month. The company said it notified law enforcement, and also hired a digital forensics firm to perform an independent investigation. Based on currently revealed details, Dell appears to have exposed very little information associated with its official website, where most users come to shop official products or have discussions on its official support forums. While Dell has downplayed the incident's impact, it is worth mentioning that many breached companies amend these initial revelations as their investigations advance. Besides resetting passwords, Dell.com users should manually review what information they've stored in their respective accounts. In case they've saved financial information, they should keep an eye on card statements, to be on the safe side.   via Dell announces security breach | ZDNet Read the full article

[longevitytechnologies-blog]

Phishing Scams in Healthcare: A Persistent Threat

With the year nearly over, hacking attacks - especially those involving phishing and other email attacks - continue to rack up big victim counts for health data breaches reported to federal regulators in 2018. A Nov. 27 snapshot of the Department of Health and Human Services' HIPAA Breach Reporting Tool website shows 327 major health data breaches impacting nearly 9.8 million individuals have been added to the tally so far in 2018. "Cybercriminals update their messaging multiple times every single day. If the workforce has not been updated on this topic in the last few months, they could easily fall for newer versions of phishing attacks." —Susan Lucci, tw-Security Often called the "wall of shame," the OCR website lists health data breaches affecting 500 or more individuals. Since 2009, a total of 2,508 major breaches impacting about 187 million individuals have been posted to the federal tally. Breach Counts So far this year, 138 health data breaches were reported as hacking/IT incidents, affecting a total of nearly 6 million individuals, or more than 60 percent of all victims in 2018. The second most common type of health data breaches reported so far in 2018 are unauthorized access/disclosure incidents. The federal tally shows 128 of those incidents affecting more than 2.7 million individuals. Another 53 incidents involved loss or theft - including unencrypted devices, as well as paper/film records - impacting a total of about 726,000 individuals. Eight improper disposal incidents affected more than 339,000 individuals. Email Breaches Of the hacking breaches reported this year, 78 - or about 60 percent - were reported as involving email. In addition, 26 incidents reported as unauthorized access/disclosure breaches involved email. "Phishing schemes that rely on human weaknesses are the major entry point for breaches, and the human factor is the most difficult to control," notes Kate Borten, president of privacy and security consulting firm The Marblehead Group. "Phishing has gone from laughable emails to very sophisticated ones that even security professionals have to double check." Large Recent Breach Among the largest breaches added to the tally in recent weeks was a hacking/IT incident listed as affecting nearly 166,000 individuals reported on Nov. 17 by HealthEquity, a Draper, Utah-based health savings account company that's listed on the HHS website as a business associate. A sample breach notification letter from HealthEquity posted on the California attorney general's office notes that a cyberattack involving unauthorized logins to two HealthEquity employees' email accounts was identified in October by the company's information security team. "We immediately implemented security measures to prevent further access to the accounts and began analyzing all information contained in these accounts to identify any sensitive personal information. The unauthorized access occurred, in the case of one account, on Oct. 5, and in the case of the other, on different occasions between Sept. 4, 2018, and Oct. 3, 2018," the notification letter indicates. The email accounts contained documents that included personal information that is used by HealthEquity to manage member accounts, the letter notes. "The affected HealthEquity employees' email accounts had these materials for legitimate business purposes. The accounts contained information including participants' Social Security numbers and may have included other information such as names, HealthEquity member ID, account type, contribution amount, and employer's name." An HealthEquity spokeswoman tells Information Security Media Group that the number of individuals affected by the breach was actually higher than the number reported to HHS. "The requirements for HHS reporting is tied to HIPAA-related accounts. There were additional individuals affected with different account types outside of the reporting requirements," she says. "We have been working with roughly 185 different companies to notify the approximately 190,000 individuals affected by the incident. All affected individuals will receive information to enroll in five-year credit monitoring and identify theft protection services at no cost." Phishing tactics were not used to gain access to the email accounts, she says. "While the attack was limited to access through two Microsoft Outlook 365 email accounts and none of HealthEquity's systems were accessed or impacted, we continue to be vigilant and proactive in protecting the personal information of the individuals we serve." The company is implementing additional security protocols, including email retention and storage policies and regular Microsoft Outlook 365 email penetration testing, the spokeswoman adds. HealthEquity also reported to HHS a separate hacking/IT incident in June impacting 16,000 individuals and involving email. Another Incident Not Yet on Tally In another incident not yet posted to the wall of shame, New York Oncology Hematology, an Albany, New York-based cancer care and blood disorder services provider, on Nov. 16 began notifying 128,400 employees and patients of a targeted phishing attack on several workers that potentially compromised their protected health information or other personal data. "The phishing emails sent were sophisticated in that they appeared as a legitimate email login page, which convinced the NYOH personnel to enter their user names and passwords," says a statement posted on NYOH's website. "These credentials were then harvested and used by the attackers to gain access to the email accounts, which were typically only accessible for a short period of hours before access was terminated." NYOH hired a forensic firm to conduct a review of the content of the accounts following the phishing attack, which occurred between April 20 and April 27, the organization says. "Following a thorough analysis, on Oct. 1, they determined that one or more of the affected email accounts contained protected health information and other personal information of patients or employees. Patients and employees who joined NYOH after April 27, 2018, are not involved." NYOH says it is not aware of any access to or attempted misuse of patient or employee information related to this incident, but it's offering affected individuals one year of free identity theft and credit monitoring services. An Ongoing Challenge Incidents involving phishing attacks will continue to plague the healthcare sector, some experts predict. "There are a few reasons why this will not be going away. One is the evolving nature of the types of emails the hackers are sending, and another is not keeping the to employees fresh," says Susan Lucci, senior privacy and security consultant at tw-Security. "Cybercriminals update their messaging multiple times every single day. If the workforce has not been updated on this topic in the last few months, they could easily fall for newer versions of phishing attacks during this busy online shopping time as well as insurance renewal enrollment." Attorney Marti Arvin, vice president of audit strategy at security consultancy CynergisTek, notes: "Hackers are growing even more sophisticated in their efforts. All it takes is one user to click, and if that user's credentials are compromised, that may allow the hacker to get the credentials of other users by sending emails that appear to be from the originally compromised user." Preventive Measures But healthcare entities can take steps to reduce the risk that their organizations will fall victim to these scams, Arvin notes. Having technology solutions that help prevent the hacker from getting in the system in the first place is the first line of defense, Arvin says. "Good data segregation, data loss prevention software and other tools that may allow for quick detection may help minimize the breach impact," she says. Implementing technology that alerts users when an email comes from an outside source may help them pause before clicking, she notes. "Of course, continuous education and awareness is also key."   via Phishing Scams in Healthcare: A Persistent Threat Read the full article

[longevitytechnologies-blog]

Seven GDPR complaints filed against Google over user location tracking

Consumer protection agencies from seven EU countries filed today GDPR complaints against Google for using deceptive practices to track users' location. The seven consumer protection agencies claim that Google "lacks a valid legal ground for processing the data in question" and that because of its deceptive practices the users' consent "is not freely given," hence, the company is in violation of the new General Data Protection Regulation (GDPR) that entered into effect in the EU space since late May, this year. GDPR complaints have been filed with national data protection authorities in the Netherlands, Poland, the Czech Republic, Greece, Norway, Slovenia, and Sweden. "Location data can reveal a lot about people, including religious beliefs (going to places of worship), political leanings (going to demonstrations), health conditions (regular hospital visits) and sexual orientation (visiting certain bars)," said today officials from BEUC, an umbrella group for 43 national consumer organisations from 32 European countries. All seven GDPR complaints have been filed based on the findings of a 44-page report published today by Norway's Consumer Council, the country's consumer protection agency. The aforementioned report shows how Google has been using a number of deceptive practices to enable location tracking for Google accounts via two settings known as Location History and Web & App Activity. Location History is a Google account setting that continuously logs the location of the user. The location data collected through Location History is derived from GPS, Wi-Fi scanning, and Bluetooth scanning, which means that Google can track a user's precise location inside buildings as well as outside. This setting has to be 'activated' by the user, however, the report has found that Google used several tricks to ensure that users do so. Web & App Activity is another Google account setting, which collects different user data from a variety of Google services. Certain apps and services, such as Google searches and searches made through Google Maps, are logged with location data of where the user was when he or she performed the search. In other words, users who turn Location History off, but leave Web & App Activity on, will still have some of their location data collected by Google. This setting is activated by default in all Google accounts. The report claims that Google has been using a series of deceptive practices and design tricks to push users into activating the two location tracking features and leaving them enabled. The report lists the following practices: Hidden default settings: when setting up a Google account, the actual account settings are hidden behind extra clicks. Users first have to click "More options" to see what the settings are, and whether they are enabled or disabled. Web & App Activity is enabled by default, meaning that users who did not click "More options" will not be aware that this data collection is happening. Misleading and unbalanced information: whenever the Location History and Web & App Activity settings are presented to the user, the clearly visible information is limited to a few positive examples of what the setting entails. The information that is visible often also trivialises the extent of tracking that is going on, and how it is used. Deceptive click-flow: although Location History has to be "actively" enabled, the set up process and click-flow is presented and designed in a way that the user is compelled to enable the setting. Repeated nudging: users are repeatedly asked to turn on Location History, in many different contexts. On Android devices, users that do not wish to enable Location History have to decline the setting at least four times when using different services that are preinstalled on Android phones: in Google Assistant, Google Maps, Google app, and Google Photos. Bundling of services and lack of granular choices: Throughout the Google ecosystem of services, separate services or functionalities are integrated and co-dependent, or simply bundled together. Enabling Location History is required in order to enable other services that users may want to use, such as Google Assistant and Google Photos Places. Permissions and always-on settings: When enabled, Location History is always on in the background on Android devices, regardless of whether the user is actively using a service that requires location services. The Norwegian agency's report has been put together after two field tests carried out on freshly installed Android smartphones in July (Samsung Galaxy S7 Android device running Android version 8.0.0) and again in October (on the same Samsung device, and on a Google Pixel device running Android version 9). The two tests identified similar issues, resulting in a decision from the seven agencies to go forward with GDPR complaints. Following today's filings, data protection agencies in each of the respective seven countries will have to investigate Google's location tracking practices in light of the current GDPR legislation. If found guilty, Google risks fines that can go up to €20 million ($22.6 million) or 4 percent of annual global turnover. Today's GDPR complaint filings also come after two separate investigations by Quartz and the Associated Press found similar issues with Google collecting users' location details, even when location services are visibly disabled in the user interface. Google tried to save face over the summer when it made changes to the Google account dashboard interface, but by that point, it was too little too late, as the company had already drawn the ire of users and EU consumer protection agencies alike. via Seven GDPR complaints filed against Google over user location tracking | ZDNet Read the full article

[longevitytechnologies-blog]

Widespread Malvertising Campaign Hijacks 300 Million Sessions

Researchers say the bad actor behind the malvertising campaign is still active.   A massive malvertising campaign targeting iOS devices hijacked a whopping 300 million browser sessions in just 48 hours. Researchers at Confiant recorded the campaign Nov. 12, and said that the threat actor behind the campaign is still active to this day.

According to researchers, those behind the malvertising campaigns typically inject malicious code into legitimate online ads and webpages, so when victims click those pages, they are forcefully redirected to a malicious page. In this case, the ad unit forcefully redirects mobile users to adult content and gift card scams. Those included “forceful redirection to fake ‘You’ve Won a Gift Card’ or adult content landing pages,” Confiant CTO Jerome Dangu said in an analysis of the campaign, published Monday. In this specific case, when users visited a web page, the malicious ad would execute embedded obfuscated JavaScript. Victims were then redirected to an array of malicious landing pages, including happy.hipstarclubcom or happy.luckstarclubcom. These landing pages typically impersonated Google Play apps, making them appear more legitimate, researchers said. The pages would typically then try to phish visitor data in order to commit affiliate marketing related fraud and or steal personal identification data, such as email, address, revenue information, purchase intent, and more, Dangu told Threatpost. “The session is hijacked without user interaction,” Dangu said . “When a user is given the opportunity to win $1,000, there will be some people falling for it. And at the scale of the scheme, this is very profitable for the attacker.”

The Scale

Malvertising campaigns are no rare occurrence. In July, for instance, the AdsTerra online advertising company was leveraged as part of a malvertising campaign that involved at least 10,000 compromised websites. This recent campaign, which targeted primarily iOS users in the United States, stands out due to its scale, Dangu told Threatpost.

While Confiant blocked over 5 million hits, the company estimated the total amount of impressions served to publishers to be over 300 million impressions during the 48-hour period. To put that into perspective, 2017’s largest malvertising campaign, launched by threat actor Zirconium, wracked up one billion impacted browser impressions – throughout an entire year. Dangu said that almost 60 percent of Confiant’s customers were impacted by the campaign, and “if you were browsing your favorite websites with your iPhone on , there’s a good chance you were exposed to it.” Applying a conservative 0.1 percent conversion rate to the 300 million impacted browser sessions, that could amount to at least 300,000 victims, said Dangu. “Each of these victims is worth multiple dollars to the attacker,” Dangu told Threatpost. “Since our telemetry indicates that the attacker spent about $200,000 to run the campaign, we believe the attacker raked in to the tone of $1 million in 2 days.”

The Bad Actor

While there are dozens of these malvertising groups, “this one stands out by the scale of the attack they were able to deploy,” Dangu told Threatpost. “Although we attribute continuous activity to this attacker since at least August, we don’t have any more visibility on who is behind this.”

What Dangu does know, he said, is that the bad actor has been active since August – but with much lower visibility to tier-1 publishers and using smaller exchanges. Researchers observed the attacker targeting the US – but also running malvertising campaigns in other locations, like Australia and New Zealand. The bad actor is still active, researchers said, and have simply been pivoting to different ad networks on an on-going basis. “We expect they will continue to leverage programmatic advertising platforms to maintain their operations for the foreseeable future,” Dangu said.     via Widespread Malvertising Campaign Hijacks 300 Million Sessions | Threatpost | The first stop for security news Read the full article

[longevitytechnologies-blog]

8 Popular Android Apps Caught Up In Million-Dollar Ad Fraud Scheme

Cheetah Mobile—a prominent Chinese app company, known for its popular utility apps like Clean Master and Battery Doctor—and one of its subsidiary Kika Tech have allegedly been caught up in an Android ad fraud scheme that stole millions of dollars from advertisers. According to app analytics firm Kochava, 7 Android apps developed by Cheetah Mobile and 1 from Kika Tech with a total 2 billion downloads on Google Play Store have been accused of falsely claiming the credits for driving the installation of new apps in order to claim a fee or bounty. Many mobile application developers generate revenue by promoting and recommending the installation of other apps inside their apps for a fee or a bounty that typically ranges from $0.50 to $3.00. To know which advertisement recommended the app and should get the credit, the newly installed app does a "lookback" immediately after it is opened for the first time to see from where the last click was originated and attribute the installation accordingly. However, Kochava found that Cheetah Mobile and Kika Tech apps are misusing user permissions to track when users download new apps and are apparently exploiting this data to hijack app-install bounties for even apps installed from other referrals, according to Buzzfeed News. "This is theft — no other way to say it," Grant Simmons, the head of client analytics for Kochava, told the publication. "These are real companies doing it — at scale — not some random person in their basement." Here's the list of seven Cheetah Mobile apps and one Kika app, which received an investment from Cheetah Mobile in 2016, caught participating in the fraudulent ad scheme: Clean Master (with 1 billion users) Security Master (with 540 million users) CM Launcher 3D (with 225 million users) Battery Doctor (with 200 million users) Cheetah Keyboard (with 105 million users) CM Locker (with 105 million users) CM File Manager (with 65 million users) Kika Keyboard (owned by Kika Tech with 205 million users) So, if you have any of the above-listed apps installed on your Android device, you are recommended to uninstall them immediately. These apps inappropriately claim credits for having caused the app downloads even when they played no role in the installations. The bounties, in this case, range in the millions of dollars. You can have a look on the typical ad referral process (left picture) versus a hijacked ad referral process (right picture).

Kika Tech responded to the allegations, claiming the company "has no intentions of engaging in fraudulent practices," and it "will do everything to quickly and fully rectify the situation and take action against those involved." However, Cheetah Mobile blamed third-party SDKs (software development kits) or ad networks for the click injection, but when Kochava pointed out the SDK involved in the click fraud activity is actually owned and developed by Cheetah Mobile itself, and not by third parties, Cheetah denied that its SDKs were involved in ad fraud. When contacted, Google told the publication that the company is still investigating Cheetah Mobile and Kika Tech apps for any fraudulent activity reported by the app analytic firm.   via 8 Popular Android Apps Caught Up In Million-Dollar Ad Fraud Scheme Read the full article

[longevitytechnologies-blog]

U.S. Postal Service API Flaw Exposes Data of 60 Million Customers

The United States Postal Service (USPS) has fixed an API flaw that potentially exposed data on 60 million customers. A researcher reported the flaw to USPS more than a year ago; but it wasn't until security blogger Brian Krebs contacted the organization this month that it took any action. The same researcher contacted Krebs. Krebs verified the flaw and contacted USPS, who this time "promptly addressed the issue". The problem was an API with inadequate authentication. All it required was for the user to be logged in to gain unauthenticated access to aspects to the USPS 'Informed Visibility' service -- a service intended to provide near real-time tracking data. Logged-in users could query the system for account details, including email address, username, user ID, street address, phone number and mailing campaign data for other users. Such information could be used by criminals for scamming and targeted phishing purposes. "The flaw that allowed this to happen," comments Rusty Carter, VP of product management at Arxan, "was a component of the USPS Web site, an application program interface (API), which was designed to help business customers 'make better business decisions by providing them with access to near real-time tracking data' about mail campaigns and packages. Instead, it may have shared critical, competitive information about businesses mail campaign best practices, with anyone who stumbled upon the flaw." In June 2018, Torsten George, security evangelist at Centrify, warned that APIs could be the next big cyber-attack vector. While the use of APIs is increasing, and such use adds agility to system development, they are not given sufficient cybersecurity priority. "According to a One Poll study," he wrote, "businesses on average manage 363 different APIs, and two-thirds (69 percent) of those organizations are exposing their APIs to the public and their partners" "When building out APIs," adds Carter, "organizations and developers need to assume that all the data and functionality inside the app can be made directly available as a tool to any attacker." Although current information suggests the USPS API flaw merely allowed access to customer data, it is indicative of widespread lack of focus on API security. In August 2018, T-Mobile revealed that attackers had gained access to personal information for about 2.3 million of its customers. The fault was a similarly unprotected API. In that incident, attackers described by T-Mobile as 'an international group', gained access to company servers. "Underprotected APIs remains a significant problem for many of today's web and mobile applications," commented Ilia Kolochenko, CEO at High-Tech Bridge. "DevSecOps efforts are nascent if not non-existent in many large companies. Developers tend to ignore security best-practices, being already busy enough with endless streams of new features requested by the business to remain competitive on the market." This absolutely resonates with USPS, which made a net loss of $2.7 billion for FY 2017. In a statement issued in November 2017, it said, "Equally important in order to return to financial stability is continued aggressive actions on our part to innovate and constantly improve operational efficiency. The Postal Service has reduced its cost base by approximately $13 billion over the past decade, and we continue to take actions to reduce costs and improve efficiency." At the time of writing, USPS has made no public statement on its website. In a statement shared with Krebs it said it has no information that the flaw was ever leveraged criminally, and that "the Postal Service is further investigating to ensure that anyone who may have sought to access our systems inappropriately is pursued to the fullest extent of the law."     via U.S. Postal Service API Flaw Exposes Data of 60 Million Customers | SecurityWeek.Com Read the full article

[longevitytechnologies-blog]

Amazon Exposes Customer Names, Email Addresses

Amazon informed some customers this week that their name and email address were exposed due to a “technical error,” but the company provided very few other details. The e-commerce giant claims the issue has been addressed and has told users that they do not need to change their password or take any other action. It has also revealed that the incident is not a result of something customers have done. Many recipients initially believed the emails were part of a scam as the message did not address them by name and its signature included a link to “http://Amazon.com” – some found the lack of HTTPS and the capital “a” suspicious. It’s unclear what caused the technical error and how many users are impacted. Twitter has been flooded by people saying they received the email, including individuals from the United States, the United Kingdom and Australia. Unsurprisingly, many users are unhappy with the lack of transparency. Amazon has refused to share any additional details with customers or the press.

Some believe the incident may be related to the firing of an employee last month for sharing customer email addresses. At the time, Amazon said an employee had been terminated for handing over customer email addresses to a third-party seller that had been blocked as a result of the incident. The Wall Street Journal previously reported that Amazon had been investigating employees sharing customer data with sellers in exchange for bribes. “I wouldn’t hurry with premature conclusions until all technical details of the incident become clear,” Ilia Kolochenko, CEO and founder of web security company High-Tech Bridge, told SecurityWeek. “Based on the information currently available, it is technically incorrect to call this incident a ‘data breach’. This rather looks like an inadvertent programming error that made some details of Amazon’s profiles publicly available to random people.” “Amazon’s reaction seems to be quite prompt, however an official statement would certainly be helpful to prevent any speculation and unnecessary exaggeration of the incident and its scope,” Kolochenko added.     via Amazon Exposes Customer Names, Email Addresses | SecurityWeek.Com Read the full article

[longevitytechnologies-blog]

Holiday Traveling with Cellphones and Tables, Oh My!

Know the risks Your smart phone, tablet, or other device is a full-fledged computer. It is susceptible to risks inherent in online transactions. When shopping, banking, or sharing personal information online, take the same precautions with your smart phone or other device that you do with your personal computer — and then some. The mobile nature of these devices means that you should also take precautions for the physical security of your device and consider the way you are accessing the Internet. Do not use public Wi-Fi networks Avoid using open Wi-Fi networks to conduct personal business, bank, or shop online. Open Wi-Fi networks at places such as airports, coffee shops, and other public locations present an opportunity for attackers to intercept sensitive information that you would provide to complete an online transaction. If you simply must check your bank balance or make an online purchase while you are traveling, turn off your device's Wi-Fi connection and use your mobile device's cellular data Internet connection instead of making the transaction over an unsecure Wi-Fi network. Turn off Bluetooth when not in use Bluetooth-enabled accessories can be helpful, such as earpieces for hands-free talking and external keyboards for ease of typing. When these devices are not in use, turn off the Bluetooth setting on your phone. Cyber criminals have the capability to pair with your phone's open Bluetooth connection when you are not using it and steal personal information. Be cautious when charging Avoid connecting your mobile device to any computer or charging station that you do not control, such as a charging station at an airport terminal or a shared computer at a library. Connecting a mobile device to a computer using a USB cable can allow software running on that computer to interact with the phone in ways that a user may not anticipate. As a result, a malicious computer could gain access to your sensitive data or install new software. Don't fall victim to phishing scams If you are in the shopping mode, an email that appears to be from a legitimate retailer might be difficult to resist. If the deal looks too good to be true, or the link in the email or attachment to the text seems suspicious, do not click on it! What to do if your accounts are compromised If you notice that one of your online accounts has been hacked, call the bank, store, or credit card company that owns your account. Reporting fraud in a timely manner helps minimize the impact and lessens your personal liability. You should also change your account passwords for any online services associated with your mobile device using a different computer that you control. If you are the victim of identity theft, additional information is available from https://www.idtheft.gov/. What Next? Longevity Technology provides a solution for a full mobile device management system including device security, technical support, remote wipe and much more. Contact us now so we can discuss what Longevity Technology can bring to your organization! https://www.longevitytech.us/contact-us/ Read the full article

[longevitytechnologies-blog]

If UK's Shadow Home Sec Diane Abbott can be reeled in by phishers, truly no one is safe

While fraudsters traditionally prey on the gullible and feeble-minded, their wicked ways have ensnared British Labour MP Diane Abbott. The UK Shadow Home Secretary admitted to handing over control of her computer to a stranger after a random caller asked her to install Remote PC. It's a common scam. Once the miscreant has control of the PC, they often attempt to steal sensitive information like passwords and bank details. Yes. Sadly I was initially taken in😢 — Diane Abbott (@HackneyAbbott) November 6, 2018 As Home Secretary – note that Ladbrokes offers 4-1 on Labour being the next government – Ms Abbott would be responsible for cybersecurity, as well as crime and policing. She would also have to decide whether Britain implements an identity card system, an idea currently being revived in the context of "digital government". We asked her office if Ms Abbott would consider helping to publicize the menace of PC Support fraud. Perhaps as its public face? We haven't yet heard a reply.   via If Shadow Home Sec Diane Abbott can be reeled in by phishers, truly no one is safe • The Register Read the full article

[longevitytechnologies-blog]

Microsoft Bug is Deactivating Windows 10 Pro Licenses and Downgrading to Home

A bug in what appears to be the Microsoft Windows activation service is causing Windows 10 Pro licenses to be downgraded to Windows 10 Home and then stating that Windows is not activated. This bug appears to be widespread with many users reporting that Windows is stating that their license is not activated and prompting the user to troubleshoot the problems.

Windows 10 Pro not activated We can't activate Windows on this device because you don't have a valid digital license of product key. If you think you do have a valid license or key, select Troubleshoot below. Error code: 0xC004C003 If you're having problems with activation, select Troubleshoot to try to fix the problem.   When users perform the Troubleshoot option, Windows is stating that "We found a Windows 10 Home digital license for this device running Windows 10 Pro."

Troubleshooting Completed   According to posts about this bug on Reddit and the Microsoft forums, someone had contacted Microsoft via their support chat and was told that Microsoft is aware and are working on the bug. "Microsoft has just released an Emerging issue announcement about current activation issue related to Pro edition recently. This happens in Japan, Korea, American and many other countries.I am very sorry to inform you that there is a temporary issue with Microsoft's activation server at the moment and some customers might experience this issue where Windows is displayed as not activated. Our engineers are working tirelessly to resolve this issue and it is expected to be corrected within one to two business days " I personally have contacted the Microsoft support chat and they had no idea what was going on.  We are awaiting more information from the Microsoft press contact, but had not heard back at the time of this publication. This is a developing story ...   via Microsoft Bug is Deactivating Windows 10 Pro Licenses and Downgrading to Home Read the full article

[longevitytechnologies-blog]

Capitation Payments - What You Need to Know

Capitation Payments. What You Need to Know.

The Affordable Care Act (ACA) in 2010 prompted an ongoing effort to reduce healthcare costs while striving to improve quality patient care. A push toward paying for value with a focus on clinical outcomes, incentives, and mandatory reporting, has led to increased cost control efforts. The intent is to improve the quality and overall population health while reducing waste by changing how payment is received, and how healthcare is delivered. Capitated care shifts the role of managing the amount, form, and cost of care to the providers. This is a departure from the traditional fee-for-service model which utilizes a set fee for each service. This can allow providers to invest in quality improvements to increase their efficiency, and give them the opportunity for financial rewards while sharing in the risk of potential losses.

What is Capitation?

Capitation payment is a model of reimbursement in which the providers receive a fixed amount of money per patient. This is paid in advance, for a defined time, whether the member seeks care or not. Ideally, patients who have little utilization will naturally balance out with the patients who have higher utilization. Capitation payments are developed based on the number of patients, the expected average amount of healthcare utilization for each patient during a specific time frame, and can vary based on the geographic area. As a value-based reimbursement strategy, capitation payments include quality measures and standards to deter withholding treatment for financial gain. The physician, a network of hospitals and physicians, or a primary care network, agree to provide specific preventive services that can be completed in the office and usually include a focus on: Prevention and treatment Administration of prescribed injections and immunizations Performing outpatient laboratory tests Health education and counseling Routine vision and hearing screening

A Few Benefits of Capitation

It can be challenging for physicians to collect and analyze the varied data for measuring clinical and financial elements required for value-based payments. The availability of current healthcare data through the utilization of electronic healthcare records (EHR) can provide the physician with a better ability to manage capitated risk. This can increase their chances for success with capitation reimbursement by offering the ability to identify cost and utilization patterns quicker and easier and connect patient data with other providers. This can offer a better view of the patient’s overall healthcare experience and treatment. Other potential benefits of capitation payments include: The ability to explore cost-effective care processes that yield the best outcomes, rather than relying on face-to-face services to generate a bill for services A more predictable cash flow, less need for a large internal billing staff, and a reduced wait time for reimbursement A greater incentive for encouraging and providing preventative care Greater physician accountability, which can limit the provision of unnecessary care or costly procedures, and may reduce patient out-of-pocket expenses

Potential Drawbacks of Capitation

Patient visits have become more complicated due to different rules with varied health plans as far as what services the physician can provide, which medications are approved, and what authorizations are required. Attempting to adhere to these requirements, and manage quality measures by manually collecting and analyzing necessary data elements could be difficult. The use of EHR can be beneficial to assist in identifying services, patient populations, and a better understanding of the costs and approved reimbursements. Obtaining capitation payments requires maintaining a balance with providing quality healthcare services. Although some still have concerns about physicians withholding or rationing, care for financial gains or the potential to receive bonuses for conservative measures. Other potential drawbacks, or concerns regarding capitation, include that it can: Incentivize enrolling a large number of patients which can result in longer waits, and shorter time, for individual patient visits Restrict patient choice by requiring patients to stay within the network Put increased financial risk on the physician for patients with significant medical issues Potentially burnout physicians who are overwhelmed with attempting to keep up with regulatory changes, reporting requirements, and increased patient needs

Promotion of Quality Care

Capitated care strives to control healthcare costs and the use of healthcare resources while creating incentives for preventative healthcare and the provision of quality care. This effort to improve the patient and physician experience, which places the responsibility of the patient’s care in the hands of the physician, can come with financial risks and gains during the quest for better overall healthcare outcomes.   via Capitation Payments - What You Need to Know | CareCloud Read the full article