Dental practices have been encrypted through their own IT vendors. What about you?

You are right to ask. Several hundred dental practices were encrypted in a single 2019 incident through a shared vendor platform many of them relied on for backup, and the broader pattern of attackers going after management tools to reach many businesses at once has continued since. A provider who has never considered that their own tools are an attack path is not one to hand administrative access to.

What we do about it:

• Multi factor authentication on every administrative account in our own tooling, with no exceptions for convenience
• Administrative access granted at the least privilege each technician needs, rather than everyone holding everything
• Our own administrative activity monitored and alerted on in the same security platform we run for clients, so unusual action by one of our own accounts surfaces
• Backups that are not reachable using the same credentials as the systems they protect, which is the specific failure that turned that 2019 incident into a catastrophe rather than an inconvenience
• Deliberate vendor selection, including how quickly a vendor discloses when they have a problem

What we will not tell you is that it cannot happen. Ask any provider that question and be wary of a confident no. The right answer is what they have done to limit the damage if it does, and whether your backups would survive it.