Very Dental: So, You've Been Ransomewared with Reuben Kamp

[00:00:01] This is a production of the Very Dental Podcast Network. This is the Very Dental Podcast.

[00:00:17] Welcome to the Very Dental Podcast, where you'll find entertaining and relevant conversations with visionaries, clinicians, and your friends in the dental space. Now, here's your host, Dr. Alan Mead.

[00:00:29] Very Dental people, welcome to another episode of the Very Dental Podcast. I'm your host, Dr. Alan Mead, and joining me today as a co-host, a new friend of mine, Reuben Kamp. Reuben, how are you doing?

[00:00:41] Doing well. Thanks, Alan.

[00:00:43] So, Reuben is like the primary guy at a place called Dark Horse Tech, and I will explain to you why we have Reuben on.

[00:00:51] You know, I suspect Reuben is used to being in rooms full of dentists that wish he weren't there. Is that accurate, Reuben? Do you think is that fair?

[00:00:58] Yeah, before they realize I'm kind of a fun guy, they're like, oh no, the HIPAA police is here.

[00:01:05] Yeah, exactly, exactly.

[00:01:07] So that's the icebreaker.

[00:01:08] The background is basically a good friend of mine recently had a ransomware attack at his office.

[00:01:17] And it turns out another good friend of mine has survived a ransomware attack and gave me Reuben's name.

[00:01:25] And so I had emailed Reuben.

[00:01:27] And I'm like, first off, going through this situation with my friend literally causes me anxiety just thinking about it and hearing how it's, but also, you know, when you're not expecting to need to deal with something like this, you've got to get people together to help you like almost immediately.

[00:01:43] And so luckily, I was able to contact Reuben and I said, you know, completely separate from my friend's situation.

[00:01:48] I want to have you on the podcast because I think there's a lot of people.

[00:01:51] Everyone hears ransomware and two things.

[00:01:55] First off, oh my God, what a nightmare.

[00:01:57] And second off, that'll never happen to me.

[00:01:59] Those are the two things I think that probably happen the most.

[00:02:02] And so is that, am I, am I on the right track with how dentists think about ransomware Reuben?

[00:02:07] I think that's how dentists think about any IT issue.

[00:02:11] Yes.

[00:02:12] Yes.

[00:02:13] Um, it's obviously we hear from a lot of people that have gone through that it's where you kind of have earned the first before you out and ask for help.

[00:02:27] Yep.

[00:02:28] Yeah.

[00:02:29] I don't know if that's IT specific, you know, dentists all day long, uh, if they have to do it, they'll try to get away with it, DIY and all that stuff.

[00:02:39] Uh, but it's specifically for it.

[00:02:41] It seems like we hear a lot of people, um, that have unfortunately gone through a traumatic event and the cybersecurity realm, and then we're trying to help them pick up the pieces.

[00:02:49] Yeah.

[00:02:50] And that's, I will say that the only time I feel like in dentistry, the only time I hear about cybersecurity issues is a, when, when people are trying to sell you a policy that you're like, I don't know, I already have so much insurance.

[00:03:03] And then B when, when someone's had something happen and they're trying to figure out what to do.

[00:03:08] So Ruben, what does dark horse tech like, like what is you guys cover a lot of ground?

[00:03:13] Just, I want the, and I'll have your links in the show notes and stuff.

[00:03:16] What, what does dark, dark horse tech do?

[00:03:18] And then, then I got a bunch of questions for you about ransomware.

[00:03:20] For sure.

[00:03:21] So the, uh, short story is I'm a son of a dentist and that is how I made it into this community.

[00:03:30] Interesting.

[00:03:30] This is, I won't, I will lie to you.

[00:03:32] There are so many, so many guests on this show are children of dentists who have, who have, and a lot of them are the tech ones, the website people and all that stuff.

[00:03:39] That's exactly what it is.

[00:03:40] I'm sorry.

[00:03:41] Go ahead.

[00:03:41] No, he says, if you don't, if you end up going to dental school, just don't be a general dentist.

[00:03:46] You know, don't try to have to be good at everything.

[00:03:50] Just be a specialist, but excellent, excellent advice by the way, but go ahead.

[00:03:55] Excellent.

[00:03:56] Well, good.

[00:03:58] Um, so I've always been a techie.

[00:04:00] So after college, I ended up getting a job with Benco and was doing their it support really for New York state driving all around doing that on site.

[00:04:13] And we know about these companies, their main thing they want to do is sell a consumable product.

[00:04:22] Mm-hmm .

[00:04:23] And really it is there to keep shine or Patterson out of that office.

[00:04:28] Mm-hmm .

[00:04:29] And I'm a pretty passionate guy about what, you know, my profession and what I want to do.

[00:04:36] So eventually three years after I started there, I ended up leaving and starting dark horse.

[00:04:43] Okay.

[00:04:43] So from the jump, it was really about flat fee, unlimited support, and we'll protect your office.

[00:04:53] Mm-hmm .

[00:04:54] And that is pretty much carried us through a decade.

[00:04:58] Okay.

[00:04:59] And then ever since ransomware has become such a big issue, we have really pivoted to becoming much more security focused.

[00:05:11] Okay.

[00:05:12] Okay.

[00:05:12] The support is great.

[00:05:13] You got to be there for the clients and give them that dental specific support.

[00:05:18] Mm-hmm .

[00:05:18] Yeah.

[00:05:19] But the number one thing is you got to keep hackers out of the office.

[00:05:23] Yeah.

[00:05:23] Prevent downtime, prevent patients from having their data compromised.

[00:05:30] Mm-hmm .

[00:05:30] And then that dentist has to tell their patients, you know, so that's a reputational thing.

[00:05:36] Yeah, absolutely.

[00:05:37] Absolutely.

[00:05:37] So we're defense.

[00:05:40] Yeah.

[00:05:40] Defense first.

[00:05:41] Defense wins championships.

[00:05:43] Yeah.

[00:05:43] Yeah.

[00:05:44] Yeah.

[00:05:44] Interestingly, so as you're an IT company, I am curious, and this is a completely separate

[00:05:51] thing, but do you guys build systems?

[00:05:55] Do you guys build hardware or do you refer to them?

[00:05:57] Do you put hardware packages together and have them send?

[00:06:01] Because the other thing is like, okay, you're probably a nationwide company.

[00:06:04] Yes.

[00:06:05] Do you have offices everywhere?

[00:06:06] Yes.

[00:06:06] Do you go to places or is it more, do you find people, local people to support your, I'm curious

[00:06:12] about that.

[00:06:12] Yeah.

[00:06:13] So on the hardware side, we let Dell do this, right?

[00:06:18] Yep.

[00:06:18] Yep.

[00:06:20] Selling computers is not really why any of us in IT got into this business.

[00:06:25] Exactly.

[00:06:26] Like it's a commodity.

[00:06:28] It's really about the relationships, the protection piece, the stuff that we need to

[00:06:33] use our head for.

[00:06:35] So we just like, even if our clients want to go to Dell, right?

[00:06:39] Black Friday is coming up.

[00:06:41] Dell, our margin, we're like client just buy the computer.

[00:06:44] Got it.

[00:06:45] Got it.

[00:06:46] Got it.

[00:06:47] So yes, we are national.

[00:06:50] We have about 75 employees.

[00:06:52] Yeah.

[00:06:52] We have done about 400 startup practices.

[00:06:54] Okay.

[00:06:56] And so there is an onsite component to a lot of the initial client onboarding.

[00:07:03] Mm-hmm.

[00:07:04] After that, if a mouse doesn't fall off a wall, you know, let's say startup and they're

[00:07:12] expanding those last five treatment rooms, we should be able to support them 100% remote

[00:07:19] from there.

[00:07:20] Got it.

[00:07:20] Got it.

[00:07:21] That's cool.

[00:07:21] Okay.

[00:07:22] So let's get into the ugly stuff.

[00:07:24] We can't put it up any longer.

[00:07:26] Let's go.

[00:07:27] Paint a picture for me.

[00:07:28] How does a ransomware attack happen?

[00:07:30] Like how does it, how does it unfold in a dental office and like where do they get

[00:07:35] in and what are the tactics and like, so what is it, what is it, a ransomware attack

[00:07:40] look like in a dental office?

[00:07:44] 91% is via email.

[00:07:46] Okay.

[00:07:47] Right.

[00:07:47] So we're assuming that if that email is in someone's inbox, that it got past us security

[00:07:56] filter, spam filter, if there even was one.

[00:07:58] Mm-hmm.

[00:07:59] So right now, let's say before the detonation, it's sitting in a doctor, a front desk, an office

[00:08:08] manager's inbox before they've clicked on anything.

[00:08:10] Okay.

[00:08:12] The reason that ransomware is such a big deal and all, it goes to practice management

[00:08:18] softwares and how they're written.

[00:08:21] So Alan, what PMS do you use?

[00:08:23] Right now, Dentrix.

[00:08:25] Dentrix.

[00:08:26] So Dentrix is very similar to Eagle's Law to Open Dental.

[00:08:30] It's a local server application.

[00:08:31] Yep.

[00:08:32] If you're using G7, it needs full admin rates to your server.

[00:08:38] Yep.

[00:08:38] To work.

[00:08:39] Yep.

[00:08:40] That is why ransomware is such a big deal in dental.

[00:08:43] Interesting.

[00:08:44] That's why when someone clicks on something, it goes everywhere.

[00:08:48] Yeah.

[00:08:48] Right?

[00:08:48] It can't really be contained to a single computer.

[00:08:50] Okay.

[00:08:51] You're reading your email on a computer.

[00:08:54] I mean, you're getting email on a computer that's connected to your internet or connected

[00:08:59] to your network, which of course has internet access.

[00:09:02] And of course, if you've got an ethernet connection, it's much faster and much more reliable,

[00:09:05] blah, blah, blah.

[00:09:06] Someone opens an email because we get tons of email from all over the place.

[00:09:10] They don't realize that they click on the link that's the, and that can go directly

[00:09:14] to the server from there.

[00:09:16] Is that what you're saying?

[00:09:17] Yeah.

[00:09:17] Cause what you're doing all day long in Dentrix or your front desk, right?

[00:09:21] They're scheduling appointments, whether they're conceptualizing or not.

[00:09:25] Every time they're clicking, it's pinging the server and coming back, right?

[00:09:29] It's doing a round trick and back.

[00:09:30] Got it.

[00:09:30] So they click on that link.

[00:09:32] It runs a program.

[00:09:34] This program, the ransomware is going to be like, wow, where are all my shares?

[00:09:39] And it goes and hits every thing.

[00:09:42] Yep.

[00:09:43] Now that is disruptive enough by itself.

[00:09:45] Yeah.

[00:09:47] If you have backups, you're still down for a while until those backups kick in.

[00:09:52] But if you don't have backups, and this is your friend's situation, or your backups were

[00:09:59] encrypted because they were locally connected to the server or the computer, right?

[00:10:03] So they're also compromised.

[00:10:05] Mm-hmm.

[00:10:06] So then you're deciding whether to pay or negotiate with the threat actors.

[00:10:12] Yeah.

[00:10:13] Yeah.

[00:10:13] To get your data back or start from scratch.

[00:10:15] Yeah.

[00:10:15] And typically, it sounds like what they do, there's two different things.

[00:10:20] First off, people think about it as, oh, they stole my data.

[00:10:24] They took my data.

[00:10:25] And the reality is, it sounds like what they really do is they throw encryption on your

[00:10:29] data locally so you just can't get into it.

[00:10:31] And they've got a key that basically, if you buy the key, you'll, I mean, allegedly,

[00:10:36] that you get the key and then you'll be able to get back in.

[00:10:39] So, and then, but the other thing is, is you're like, oh my God, did they take my data?

[00:10:44] And do they have my data locally to them so that they can spread it to the world?

[00:10:49] So there's two different things kind of going on there.

[00:10:51] Dig into that a little.

[00:10:53] Yeah.

[00:10:53] That is a really great thing to talk about because we're talking about exfiltration or what

[00:11:00] constitutes a breach.

[00:11:02] And that's a whole nother world.

[00:11:04] Yeah.

[00:11:05] Then your data was just modified on a local.

[00:11:08] Yeah.

[00:11:09] But the hackers don't actually have the files.

[00:11:12] Yeah.

[00:11:13] Right.

[00:11:13] So I've helped a couple of solo dentists here this year in addition to a 100 site DSO

[00:11:22] in ransomware events.

[00:11:25] And the number one thing is, do you have a firewall that can log what happened?

[00:11:33] Yep.

[00:11:34] Right.

[00:11:35] So this dentist I was helping in El Paso, he had a,

[00:11:39] a ubiquity firewall.

[00:11:41] We were able to confirm your Eagle soft database is 10 gigabytes.

[00:11:47] Yeah.

[00:11:47] But on Sunday, when the ransomware hit, we only have traffic going outside the office of two.

[00:11:55] Yeah.

[00:11:56] There's no, no possible way your database is outside your office.

[00:12:03] Mm-hmm.

[00:12:03] So now we know it's just a, it's the same thing as if your building burned down and he didn't

[00:12:11] have any backups.

[00:12:11] Okay.

[00:12:12] Okay.

[00:12:12] Okay.

[00:12:13] Okay.

[00:12:13] That's right.

[00:12:23] That's right.

[00:12:24] That's right.

[00:12:26] That's right.

[00:12:29] And one of the things that you guys have to determine for these situations is do they actually

[00:12:34] have the data?

[00:12:34] Because that is, I mean, like it's a whole different animal with the, and we'll talk

[00:12:38] about what you, what you have to do after an attack.

[00:12:40] So basically you said 91% of the time it comes through an email and an, and the email has

[00:12:44] a link that someone clicks accidentally not realizing.

[00:12:48] So, uh, you know, so there's team training stuff that comes into this obviously as well,

[00:12:52] but so in no, no, my suspicion is nobody ever says, oh yeah, I clicked this suspicious

[00:12:59] link and caused this problem.

[00:13:00] No one, no one ever knows exactly how I don't know what to do.

[00:13:03] So many got compromised on an update your Adobe reader link.

[00:13:07] Yeah.

[00:13:08] Yeah.

[00:13:09] That's, that's devious.

[00:13:10] That's devious.

[00:13:11] Really.

[00:13:12] I mean, but the, but the reality is, I mean, when you think about it, the stuff is ubiquitous.

[00:13:16] You're just, here's a little, here's a little tip from Al.

[00:13:19] I am not an IT guy.

[00:13:21] If an email looks even the slightest bit weird, delete it and report it.

[00:13:26] Cause if the person really needs to get in touch with you and it was legitimate, guess

[00:13:29] what?

[00:13:30] They'll find you another way or they'll get you another way.

[00:13:32] If it's legitimate and they really want to get in touch with you, they will.

[00:13:34] It's, there's no reason to, I mean like.

[00:13:37] It's no way to go through life expecting that everyone is trying to hack you, but everyone's

[00:13:42] trying to hack you until proven otherwise.

[00:13:44] That's what I'm going to say right now.

[00:13:45] I mean, it's like, it, it, this, oh, it just makes me sick to my stomach because everyone

[00:13:49] is just trying to get their day done.

[00:13:51] You know, they're not there.

[00:13:52] So I know there's obviously a big training aspect of this too.

[00:13:56] So basically what an AI is making it worse.

[00:13:59] Oh, perfect.

[00:13:59] Is that a Nigerian Prince email.

[00:14:02] Yeah.

[00:14:02] Yeah.

[00:14:02] It's now not all caps and not poorly written anymore.

[00:14:07] It is a very, well, you know, they're, it's very personalized.

[00:14:11] Right.

[00:14:12] Cause they've scraped the data.

[00:14:13] Yeah.

[00:14:14] Written something that is in your language, in the tone of the person that you think this

[00:14:19] email would come from.

[00:14:20] So it is getting more sophisticated.

[00:14:22] Yeah.

[00:14:22] Yeah.

[00:14:23] It's not just like, Oh, chat GPT helped me write a resume.

[00:14:26] It's also being weaponized.

[00:14:28] Oh, chat GPT.

[00:14:29] I'm a Nigerian Prince that yeah, exactly.

[00:14:32] And what is funny, just having played around with some of this AI stuff, you can give it

[00:14:36] some really specific like indications in wow.

[00:14:41] Is it good?

[00:14:42] It's like, I was just thinking about this, you know, you're, you talk about all of this

[00:14:45] AI, you know, you're not supposed to use it in school.

[00:14:47] Kids can't use it in school.

[00:14:48] I'm like, guess what?

[00:14:49] No one's going to be able to, it's good enough.

[00:14:51] Now the only way that a teacher knows that a kid is using AI is cause just way better than

[00:14:56] that kid can actually do.

[00:14:58] Like that kid is just not that good is what it comes down to.

[00:15:00] I, I, I used to think, Oh, there's a lot of ways to, I think there's no way to tell.

[00:15:05] So you're right.

[00:15:05] I mean, this, you just have to be super wary.

[00:15:07] And I'm, I think the training aspect comes into it.

[00:15:10] I definitely want to talk about that again.

[00:15:11] So 91% comes through email.

[00:15:13] Where just out of curiosity, where's the rest of that 9%?

[00:15:15] How else are they doing it?

[00:15:16] Uh, so you will have, so think about like a larger company that maybe has IP has some

[00:15:23] very sensitive data.

[00:15:25] Yep.

[00:15:25] It comes from employee sabotage.

[00:15:27] Okay.

[00:15:28] Okay.

[00:15:28] So an inside job.

[00:15:29] Okay.

[00:15:29] Okay.

[00:15:30] Inside job.

[00:15:30] So if you're sophisticated, I mean like I'm a fairly sophisticated person, but it's does

[00:15:36] not take someone like me.

[00:15:39] It's called ransomware as a service.

[00:15:41] Sure.

[00:15:42] Yeah.

[00:15:42] Software as a service.

[00:15:43] You can literally go.

[00:15:45] Ransomware as a service.

[00:15:46] Crime as a service.

[00:15:48] I love this.

[00:15:48] Okay.

[00:15:49] Basically put it on a USB flash drive, walk into your place of business and plug it into

[00:15:53] a computer and plug it in a computer.

[00:15:55] And if they pay the ransom, it goes to your Bitcoin address and you make money.

[00:15:59] Yeah.

[00:15:59] This is great.

[00:16:00] I mean, I feel like, I feel like, you know, this is fantastic.

[00:16:03] If, if podcasting doesn't work out for me, I have, I have some new revenue sources,

[00:16:07] just plugging USB drives and God, that is so devious.

[00:16:11] I get it.

[00:16:11] It's very profitable.

[00:16:12] Yeah.

[00:16:12] I'm sure.

[00:16:13] Okay.

[00:16:14] So, uh, besides the financial loss and, and let's be perfectly honest, the ransom, the

[00:16:19] ransom aspect for my friend was he, he couldn't get into his data one morning and then got an

[00:16:26] email from, from the, the bad actor who basically said we, and of course they said that they have

[00:16:33] his data.

[00:16:33] I don't know that they have his data, but they have his data.

[00:16:36] Uh, it's going to cost him X amount.

[00:16:37] It's like $50,000, something like that in Bitcoin, which is untraceable.

[00:16:42] They're starting offer.

[00:16:43] Yeah.

[00:16:43] They're starting offer.

[00:16:44] And, and so obviously they want to sell you back that, that key.

[00:16:47] And that's, that's a whole bunch of money, but like beyond, let's just pretend, okay,

[00:16:51] there's that, let's just say that you're going to pay the ransom.

[00:16:54] I know that there's probably a whole podcast on whether you do that or not, but what other

[00:16:57] impacts like it's not just the ransom.

[00:17:01] It's not like, okay, I'm throwing this guy 50 K in Bitcoin.

[00:17:04] He's going to give me the key and I'll be fine.

[00:17:06] What are the other aspects that you got to look at from a practice that's had this happen

[00:17:10] to them?

[00:17:11] Well, there's a brand new government organization that does not want to pay the ransom.

[00:17:18] Yeah.

[00:17:19] Perfect.

[00:17:19] Under the, you know, Department of Homeland Security, cybersecurity, it's called CISA.

[00:17:23] Yeah.

[00:17:24] And I, I don't read this as black and white where it's a supporting carriers by paying

[00:17:32] ransomware that is still being figured out.

[00:17:35] But of course the U S government does not want you to spend money to Russia, North Korea,

[00:17:40] sure.

[00:17:40] Any China, any of our adversaries.

[00:17:43] Uh, the other thing you have to think about is you have patients showing up tomorrow and

[00:17:47] you have no x-rays.

[00:17:49] Yeah.

[00:17:50] Yeah.

[00:17:50] No medical history.

[00:17:51] Yeah.

[00:17:51] And how are you going to communicate to them?

[00:17:53] Yeah.

[00:17:54] So the, the negotiation process takes a while.

[00:17:56] Yeah.

[00:17:57] Especially if you don't want to pay $50,000 and you're like, Hey, Ruben, I'd rather pay

[00:18:02] 12.

[00:18:02] Yeah.

[00:18:03] Yeah.

[00:18:04] So that back and forth and they're like, yeah, but we, you're a dentist.

[00:18:07] We think you can afford it.

[00:18:08] Yeah.

[00:18:09] That takes a while.

[00:18:10] Um, but what you really have to, um, think about, and this has changed over time as well,

[00:18:19] just like we're talking about, exfiltration is actually fairly new is that you might not

[00:18:25] get your data back.

[00:18:26] Yeah.

[00:18:27] Up until about 2021, 2022, every single time I've seen someone pay a ransom, they gave

[00:18:35] the key back the, and the data was decrypted.

[00:18:38] Yeah.

[00:18:38] What I saw in El Paso was the first time I'd seen it.

[00:18:42] They sent back the file after this doctor paid a 15,000.

[00:18:46] Yeah.

[00:18:47] It's like, that's what I'm going to do.

[00:18:49] Yeah.

[00:18:49] Great.

[00:18:49] We negotiated, sent the money via Coinbase and we got the key back.

[00:18:54] It ran for 25% of these files and then stopped.

[00:19:02] And then we got an email from the threat actors.

[00:19:04] Yeah.

[00:19:05] You want the rest of your files?

[00:19:07] Yeah.

[00:19:08] They asked more money.

[00:19:09] Oh my God.

[00:19:11] So it's way worse.

[00:19:12] And the reality is, the reality is if particularly if they have your files, they can do whatever

[00:19:17] they want.

[00:19:17] They could also just take your money and give you nothing.

[00:19:19] There's that too.

[00:19:20] I mean, like, it's some, I mean, I mean, uh, you'd like to think these criminals have

[00:19:25] some integrity, but let's be honest, you know, they kind of, I'm sure that what, what's crazy

[00:19:30] about it too, is that, okay, I got so many questions here.

[00:19:34] Are they okay.

[00:19:34] I need a part two.

[00:19:35] So yeah, we were probably.

[00:19:37] So CESA says that basically it's, it's to interpretation a bit, but the reality is,

[00:19:42] is it's also illegal or they're trying to say it's illegal to pay this.

[00:19:45] So, but on, so on top of that, you're like, oh my God.

[00:19:50] So you could be in trouble if you do pay it and get your data back.

[00:19:53] You could pay it and not get all your data back.

[00:19:56] You could pay it, get none of your data back.

[00:19:57] You could pay it, get all your data back.

[00:19:59] Everything's fine.

[00:20:00] There's like a million ways this can go.

[00:20:01] And frankly, I mean, but what's funny is a dentist, you're also paying someone who knows about how

[00:20:06] this works to figure out all these different things that could happen essentially.

[00:20:11] Right.

[00:20:12] I mean, and okay.

[00:20:15] So do you do negotiations with these guys?

[00:20:17] Do you work with a lawyer who does negotiate?

[00:20:19] How do you, how does it work?

[00:20:21] I usually personally negotiate for them.

[00:20:23] I'm sorry.

[00:20:24] Did I say that out loud?

[00:20:25] Well, yeah.

[00:20:26] Actually, I don't mind being in those situations.

[00:20:32] Yeah.

[00:20:33] So I will always ask the doctor, like your friend, are you okay with me negotiating?

[00:20:40] And the second thing I asked them is like, and of course,

[00:20:44] What's your number?

[00:20:44] It's changed after the El Paso situation is not how much are you willing to pay?

[00:20:50] How much are you willing to pay knowing you might get nothing?

[00:20:53] Yeah.

[00:20:54] Yeah.

[00:20:54] So it's changed.

[00:20:55] Yeah.

[00:20:56] And so that number for your, you know, your friend was 12, $15,000.

[00:21:01] I'm willing to throw out there.

[00:21:03] Yeah.

[00:21:04] And see what comes back.

[00:21:05] Yeah.

[00:21:06] And that's where we are in that process right now.

[00:21:09] Yeah.

[00:21:11] Is trying to get to that 12 number so that we can find out if we can get the data back.

[00:21:15] Yeah.

[00:21:16] So, okay.

[00:21:17] So this just, how good are we at, at, uh, these people are getting away with murder and

[00:21:24] there's, they, they do it with, they essentially do it without even worrying about it because they're

[00:21:28] not getting caught.

[00:21:29] Is that essentially right?

[00:21:32] No, I see the Bitcoin love in all these dental Facebook groups.

[00:21:37] Bitcoin's the only reason this works.

[00:21:38] Okay.

[00:21:39] Interesting.

[00:21:39] It's an anonymous transaction platform that allows ransomware to exist.

[00:21:45] You remove Bitcoin, it will cease to exist.

[00:21:50] Okay.

[00:21:51] So crypto, crypto things that are anonymous like this, make this, make this a profitable

[00:21:56] and easy.

[00:21:56] Have you heard of, have you heard of, first off, are most of these international

[00:22:00] actors?

[00:22:01] So the reality is it'd be really hard to catch them.

[00:22:03] Anyhow is that?

[00:22:04] That's, that's, yeah.

[00:22:05] God, that just.

[00:22:05] So the transactions are public.

[00:22:08] Mm-hmm.

[00:22:08] Like you can literally see Bitcoin transaction wallet to wallet.

[00:22:12] Yeah.

[00:22:12] But the wallet anonymous.

[00:22:13] Yeah.

[00:22:14] So the FBI has, has had some success identifying the wallet who's behind them.

[00:22:19] Like you can say, oh, there's another ransomware transaction.

[00:22:22] Yeah.

[00:22:22] Yeah.

[00:22:22] I'm sure that's gotta be a funny thing to watch.

[00:22:24] You just see it.

[00:22:25] Yeah.

[00:22:26] Yeah.

[00:22:27] Um, but yeah, it was Bitcoin is the back.

[00:22:30] It's backbone of all of this.

[00:22:32] Okay.

[00:22:32] God, that's, that's horrifying.

[00:22:35] I mean, I, none of it, none of it surprises me, but so, so I mean, how in dental offices

[00:22:42] probably have to be an awesome target for these people.

[00:22:47] Awesome.

[00:22:47] Uh, but I mean, God, it just, I mean, there's so much to go over there.

[00:22:52] Okay.

[00:22:52] So I'm, I'm going to, I'm going to get myself back on track cause I'm literally, I'm just

[00:22:55] sort of reeling here.

[00:22:57] So, and you, you've got the legal implications.

[00:22:59] You've got, if they do have your data and they spread out, you've got a huge HIPAA violation

[00:23:03] that, you know, that you didn't protect your data.

[00:23:05] It's exfiltrated.

[00:23:06] Yeah, exactly.

[00:23:07] And it's two different worlds, right?

[00:23:09] There is a stolen it's on the dark web side.

[00:23:12] Yeah.

[00:23:12] And there is still some HIPAA considerations for you just lost someone's health records.

[00:23:18] Yeah.

[00:23:20] Right.

[00:23:20] So does it mean any, does it make anyone feel any better?

[00:23:23] The fact that I literally get like letters and emails from companies I work with almost

[00:23:28] constantly saying, Oh, by the way, we had a data breach and your data is probably, you're

[00:23:31] like, I know, I know that part of, part of the rule is you just have to tell them.

[00:23:34] You don't necessarily have to do it depending on, you know, and it's lots of different things.

[00:23:38] You might have to, you might have to pay them for LifeLock or something, which is awesome.

[00:23:42] LifeLock is killing it on this deal.

[00:23:43] I mean, cause that, that seems to be, I've had multiple companies that have had to, Hey,

[00:23:48] we'll pay for your LifeLock.

[00:23:49] I'm like, thanks for nothing.

[00:23:51] Yeah.

[00:23:51] The data is already out there.

[00:23:52] So, yeah.

[00:23:53] I mean, think about if you have, let's say it's a big practice, 8,000 patients and LifeLock

[00:24:00] is $9 a month.

[00:24:01] Yeah.

[00:24:02] So 20,000 times nine.

[00:24:03] Yeah.

[00:24:05] 24.

[00:24:05] Yeah.

[00:24:06] That's $4.3 million.

[00:24:07] Sure.

[00:24:08] Sure.

[00:24:09] In LifeLock.

[00:24:10] In my, what I like about it is in LifeLock, if LifeLock loses your stuff, they aren't liable

[00:24:17] either.

[00:24:17] They're not liable either.

[00:24:19] That's the other thing that I've known just enough about LifeLock to know that like,

[00:24:22] it sounds really good.

[00:24:23] It sounds awesome, but Oh, I'm completely protected, but my data is still out there.

[00:24:27] So who cares?

[00:24:28] I feel like I owe your listeners some positive news.

[00:24:31] Yeah.

[00:24:31] We're talking about like all the bad stuff.

[00:24:34] Yeah.

[00:24:35] Big companies, when you think there's that DSO, we're helping out, right?

[00:24:39] Almost a hundred sites.

[00:24:40] They're going through a lot of pain.

[00:24:43] Aspen Dental, over a thousand locations got hit last year.

[00:24:46] Yep.

[00:24:46] Henry Sean got hit three times.

[00:24:48] Yeah.

[00:24:49] Yeah.

[00:24:49] Right.

[00:24:50] To the tune of like $200 million or something like that.

[00:24:54] If I remember.

[00:24:54] Healthcare.

[00:24:55] Exactly.

[00:24:55] Yeah.

[00:24:56] Paid the ransom.

[00:24:57] Yeah.

[00:24:58] Cause what else are you going to do?

[00:25:01] If you don't have backups.

[00:25:02] Yeah.

[00:25:03] You have to pay the ransom.

[00:25:04] Yeah.

[00:25:04] So that's like one of the main rules.

[00:25:07] Yeah.

[00:25:07] If you hear about anybody paying anything, their backups were compromised or they were not

[00:25:12] doing that.

[00:25:13] Yeah.

[00:25:14] Okay.

[00:25:14] Here's, here's a question.

[00:25:15] I got to say this.

[00:25:15] I know that a lot of people pay a lot of companies to do remote backups.

[00:25:21] And, and the problem is with that is that, okay, if, if the remote backup backs up your

[00:25:28] encrypted data, then, then their backup is kind of screwed too.

[00:25:33] Is that right?

[00:25:34] That's right.

[00:25:35] So there's two different backup technologies and the best analogy is like a glass of water.

[00:25:41] Yeah.

[00:25:42] Versus building blocks.

[00:25:44] Yeah.

[00:25:45] If you're the old school glass of water backups, one drop of poison poisons the entire thing.

[00:25:52] Yeah.

[00:25:52] Right.

[00:25:53] Building blocks.

[00:25:54] You just kick off the last block that was on there.

[00:25:57] So, but that leaves all of the other blocks clean.

[00:26:00] Yeah.

[00:26:00] So that means if you get ransomware on Friday, the Friday backups run.

[00:26:05] Yeah.

[00:26:05] You can just kick off Friday and everything before that is clean.

[00:26:08] Yeah.

[00:26:09] So that's called blockchain technology.

[00:26:11] Yeah.

[00:26:12] So if, if, if, if you're paying someone to do remote backups, the assumption would be, and I have to, I, I sound stupid.

[00:26:20] Cause I don't even know.

[00:26:21] I know we do remote backups.

[00:26:23] I know we do remote backups.

[00:26:23] Uh, but also I'm like, how many, how many remote backups is typical for them?

[00:26:28] How many, how many do they keep?

[00:26:29] You know, in other words, it's like, do they, do they keep multiple in this for this very reason or not really?

[00:26:34] And this is of course, obviously standard for healthcare, seven years retention.

[00:26:39] Yeah.

[00:26:39] And that doesn't mean like you have seven years of daily backups.

[00:26:42] Yeah.

[00:26:43] Uh, so usually we go, uh, dailies.

[00:26:48] Yeah.

[00:26:48] Sometimes we do hourly, depending on, um, it's just like an office and how much downtime.

[00:26:54] Like if your server goes down, we don't want to go all the way back to eight.

[00:26:57] Right.

[00:26:57] We want to go to one hour.

[00:26:58] Yeah.

[00:26:59] Um, so those days at the end of the weekend compiled into a weekly month, get compiled into a monthly.

[00:27:07] Okay.

[00:27:08] So they all get consolidated, but you are able to go back seven years and see, Hey, this user deleted this file.

[00:27:18] Okay.

[00:27:19] And that's perfect.

[00:27:20] But we have to have seven years of retention.

[00:27:22] Got it.

[00:27:23] So, okay.

[00:27:25] The next question I have is how do you know they're getting good backups?

[00:27:29] Like how, like, I have to say that we have our backup system.

[00:27:31] We can literally look at, and they're like, we just got it.

[00:27:34] Like, like you said, they, there are days where they'll do three or four of them.

[00:27:37] And there it is like, so I, and I know that according to them, they're getting them, but

[00:27:41] God, you know, the, the, here's the, so before we were doing this years and years ago, we used

[00:27:46] to have, you know, we, we have rotating hard drives where we'd go and we'd take, we'd take

[00:27:50] it back up at the end of it.

[00:27:51] And I'm not even sure.

[00:27:52] It says Monday, Tuesday.

[00:27:53] And, and better than that, because we didn't want the, we didn't want the building to burn

[00:27:57] down with them in there.

[00:27:58] So we always took one of someone took the, one of them at home.

[00:28:00] It was in it.

[00:28:01] That was, that was what, so, and then you'd go back and you took my hard drive offsite.

[00:28:09] Yeah, exactly.

[00:28:10] So here's the thing.

[00:28:11] Then you go back like months later, you say, well, let's just see what this backup looks

[00:28:15] like.

[00:28:15] And you realize you've been, you don't have, like, it's not backing up the right stuff

[00:28:19] or like there's, you know, cause human error is such a thing.

[00:28:22] You're like, okay, so we have, we have literally, you know, months of backup.

[00:28:25] That's not accurate.

[00:28:26] Like, I feel like what you really would like to do is, is watch them like rebuild your data

[00:28:32] in front of your very eyes to know, to know that it's working.

[00:28:35] How do you, what's the best way to, for backups?

[00:28:37] Yeah.

[00:28:38] So the old way where it mostly failed is people back up all the files, but forget that Dentrix

[00:28:44] is a database.

[00:28:45] Yeah.

[00:28:46] And you have to stop it.

[00:28:47] Yeah.

[00:28:48] To be able to actually back it up.

[00:28:49] So you would go in, like, I have all my files, but I have no way to read them.

[00:28:53] Yeah.

[00:28:53] So it's useless.

[00:28:54] Yeah.

[00:28:56] Uh, so what they have now built into most of the products is called screenshot verification.

[00:29:02] Okay.

[00:29:03] And we can have those send to clients if they want.

[00:29:07] It basically says, Hey, Dr. Allen, here is a screenshot of your server booted up in a virtual

[00:29:14] environment.

[00:29:15] We're ready to go.

[00:29:17] And then, so basically what it's doing, the backup is running.

[00:29:22] It's spinning it up in a virtual environment, making sure it works and then shutting it back

[00:29:26] down and sending the client a screenshot.

[00:29:28] It's doing that every single backup.

[00:29:30] Okay.

[00:29:31] That's awesome.

[00:29:31] That's good to know for a dummy like me.

[00:29:33] That's good to know.

[00:29:34] And guess what?

[00:29:36] Yeah.

[00:29:51] Yeah.

[00:29:55] Yeah.

[00:29:58] Yeah.

[00:29:58] Yeah.

[00:30:28] The trunk and stealing.

[00:30:29] Good point.

[00:30:30] Ruben.

[00:30:31] Well thought of.

[00:30:32] So if you're going to do that, you got to hire some, an armed guard to just hold on

[00:30:37] to your backup.

[00:30:38] I like that.

[00:30:39] I'm sorry.

[00:30:39] Go ahead.

[00:30:40] No, but for your office, we have what's called the backup appliance.

[00:30:44] So if your server goes down, we can actually turn that appliance into your server.

[00:30:49] Okay.

[00:30:49] And you have a limited downtime, 15, 20 minutes in the office.

[00:30:53] Okay.

[00:30:54] Okay.

[00:30:54] So that stays in the office though, because.

[00:30:56] Stays in the office.

[00:30:56] It's encrypted.

[00:30:57] So someone broke in, stole it.

[00:31:00] We don't even have to tell HIPAA.

[00:31:01] Okay.

[00:31:02] But that device also replicates to the cloud.

[00:31:04] Okay.

[00:31:04] Right.

[00:31:05] So there has to be some sort of flood fire theft.

[00:31:08] Yeah.

[00:31:09] Backup, which is that cloud backup.

[00:31:11] Okay.

[00:31:12] This is, this is awesome stuff.

[00:31:13] I love this.

[00:31:14] So, and then, I mean, you literally just said it.

[00:31:16] We got to get to this.

[00:31:17] When do you have to tell HIPAA?

[00:31:20] At what point, and how do you know as, as someone who's trying to pick up the pieces,

[00:31:25] like when, when the, when you, when you've had the HIPAA violation?

[00:31:29] I, the letter of the law says you have 60 days to tell your patients and HIPAA.

[00:31:38] Sure.

[00:31:38] Is, is it what I mean?

[00:31:39] So, you know, Aspen Dental wakes up.

[00:31:41] Yeah.

[00:31:42] And oh crap.

[00:31:43] We're hacked.

[00:31:44] They don't have to say anything for 60 days.

[00:31:47] Uh huh.

[00:31:48] So, well, but the other thing is, is that it's going to, it might take you 60 days to

[00:31:51] figure out what, what got out.

[00:31:53] Right.

[00:31:53] I mean, cause.

[00:31:54] And that's why that law exists.

[00:31:56] In some cases you're hacked, you're screwed.

[00:31:59] You can't get into your data, but the data hasn't actually been leaked because it wasn't

[00:32:02] exfiltrated.

[00:32:02] Is that right?

[00:32:03] Okay.

[00:32:04] And that's the, I mean, honestly, that's the best case scenario in a situation like this.

[00:32:09] If you're just like looking, I'll pay the ransom and all that stuff.

[00:32:12] Cause they didn't get to it.

[00:32:13] Um, which is really great because not only they're actually using your, the data that

[00:32:20] you're paying for from your, from your, your internet provider to upload.

[00:32:24] This is excellent.

[00:32:26] I mean, if you're going to be a criminal, this is such a clean and beautiful way to do

[00:32:29] it.

[00:32:29] Just.

[00:32:30] Oh, I agree.

[00:32:31] Oh my God.

[00:32:32] That's why it's so prolific.

[00:32:33] Yeah.

[00:32:33] Yeah.

[00:32:33] But you know, if your friend pays the ransom, gets his data back.

[00:32:38] Now we've just identified that it's a he.

[00:32:41] So that's the last piece of information I'll give about your friend.

[00:32:44] Yeah, no, that's all right.

[00:32:45] That's all right.

[00:32:45] That's all right.

[00:32:47] Um, and we know that no data left the office.

[00:32:50] He does not have to tell his patients.

[00:32:52] He does not have to tell HIPAA.

[00:32:54] Uh huh.

[00:32:54] And that's one of the reasons the 60 days is important because yes, the clock is ticking,

[00:32:58] but also you need to know whether or not.

[00:33:00] And so, and you can tell from, from that firewall, like you said, and you, when you

[00:33:05] mean firewall, you mean like a hardware firewall, I'm assuming.

[00:33:08] Is that right?

[00:33:08] Yeah.

[00:33:09] Um, which by the way I have, do you think maybe I looked at some of this stuff after

[00:33:15] I, after I talked to him?

[00:33:18] Yeah.

[00:33:18] After I, uh, after I put on new shorts, I, uh, I went and looked at my protocol.

[00:33:23] It turns out, it turns out that my, uh, that I, I pay for this, the firewall service

[00:33:29] and the update and all that stuff.

[00:33:31] Um, I literally like two weeks after his break, I got my three year bill for it.

[00:33:37] I've never been so excited to pay, you know, 15, 1500 bucks for anything.

[00:33:42] Cause I mean, so, I mean, there's obviously if you're doing this stuff, there's a lot

[00:33:46] less worry.

[00:33:47] It's not impossible, but it's, it's pretty unlikely.

[00:33:49] Cause tell me what is, what does a firewall do for someone for an office like this?

[00:33:53] What, like if it, if it's running correctly and it's all software's up to date and you're

[00:33:56] going to, what does it do?

[00:33:58] Absolutely.

[00:33:58] So you get a modem from your internet service provider, your ISP.

[00:34:01] Mm-hmm .

[00:34:02] That's a very inexpensive, cheap device with almost no built in security.

[00:34:06] It's really just trying to give you a fire hose of internet.

[00:34:10] Yep.

[00:34:11] Yep.

[00:34:11] The firewall is the thing that sits between the outside world and your patient health

[00:34:18] information.

[00:34:18] Mm-hmm .

[00:34:19] So it's there to filter and spec detect stop.

[00:34:25] That's its role.

[00:34:26] Mm-hmm .

[00:34:26] If it's not updated, it might as well not be a firewall.

[00:34:30] Ugh.

[00:34:31] Right.

[00:34:31] Right.

[00:34:31] Because the reason we do update reason Microsoft does all these, uh, programs, even on your

[00:34:38] iPhone or your Android, you know, application updates.

[00:34:41] It's because someone found a hole.

[00:34:43] Yeah.

[00:34:44] A way in to get that ransomware into your office.

[00:34:48] And we're, let's say, SonicWall or Cisco, right?

[00:34:51] They've released an update to close that hole.

[00:34:54] Yeah.

[00:34:54] So the longer you leave your device out of, uh, you know, the latest update.

[00:35:00] Yep.

[00:35:00] The just more time you're hanging out there, wait, waiting for someone to get right through

[00:35:06] that hole.

[00:35:06] Yeah.

[00:35:07] Yeah.

[00:35:08] That's, that's, you know, it's funny because as a consumer, I always thought the update

[00:35:12] thing was kind of just a little, a little notification that's kind of a hassle.

[00:35:16] And all of a sudden you're like, no, no, no, no, they're doing, they're not doing this

[00:35:18] just because they like doing updates.

[00:35:20] They they're doing it because they're, they're patching a hole and that's in.

[00:35:23] And so, and you're actually talking about like, I mean, updating.

[00:35:28] Okay.

[00:35:28] So the software on your, on your hardware, uh, firewall needs to be updated, but your system

[00:35:34] software needs to be updated.

[00:35:36] You're you're, you know, all that stuff.

[00:35:38] And that's, those are essentially constantly coming in.

[00:35:41] I mean, that's, it's like, you can barely miss it.

[00:35:43] They're constantly like computers, every computer in your office that, that you're running software

[00:35:49] on needs at your server, all that stuff.

[00:35:51] It's constantly coming in.

[00:35:52] And I, and so how, what, what strategies do you like to tell people about, about, do

[00:35:55] you, do you like try and set aside at morning every month or week or whatever that

[00:36:00] you're doing this just to make sure, or, or do you set them on automatic or do you guys

[00:36:03] remote in and do that?

[00:36:04] I'm curious how that works.

[00:36:05] It has to be done as quickly as possible.

[00:36:07] Yeah.

[00:36:08] You can't do that.

[00:36:09] Like, I know there's some cybersecurity companies, uh, companies out there that do scans once

[00:36:15] a month.

[00:36:16] Yeah.

[00:36:16] That doesn't do anything.

[00:36:17] Yeah.

[00:36:17] That's, that's, that's, you're going to catch the hacker right in that moment.

[00:36:21] Yeah.

[00:36:21] That's not going to happen.

[00:36:22] Yeah.

[00:36:23] So it has to be done within 72 hours.

[00:36:27] Yeah.

[00:36:27] That is per HIPAA policy of a update being published.

[00:36:30] Okay.

[00:36:31] Right.

[00:36:31] So windows updates come out on Tuesday.

[00:36:33] They better be on there on Thursday.

[00:36:35] Okay.

[00:36:35] Right.

[00:36:35] We're going to make sure they don't break your sensor, break your pan, break something

[00:36:39] you rely on to run your practice.

[00:36:41] Yeah.

[00:36:42] But it's got to be done as quickly as possible.

[00:36:44] Okay.

[00:36:45] Um, I, we skip past the good news.

[00:36:48] Let's let's hear the good news.

[00:36:49] As smaller organization organizations, you can do their minimum and probably will have

[00:36:58] any incidents at all.

[00:37:01] Yeah.

[00:37:01] The problem is all these dentists that are getting hacked and it's about seven to 9% of

[00:37:05] all dentists on an annual basis are dealing with ransomware.

[00:37:08] Yeah.

[00:37:09] That's by the way, don't have a firewall.

[00:37:11] Say that again.

[00:37:12] Seven to nine dentists annually are dealing with ransomware.

[00:37:17] That is a horrifying number.

[00:37:18] That is wild.

[00:37:20] Oh my God.

[00:37:21] Get out that calculator again.

[00:37:22] 225,000 dentists in the U S 9%.

[00:37:26] Yeah.

[00:37:27] We're at 20,000 plus dentists dealing with ransomware on an annual basis.

[00:37:32] Yeah.

[00:37:32] Yeah.

[00:37:33] And I know a lot of people that have gotten hit multiple times.

[00:37:36] Yeah.

[00:37:36] Like, Oh, I got hit once.

[00:37:37] What's the chance?

[00:37:38] Yeah.

[00:37:39] I'm going to get hit again.

[00:37:40] Well, they're probably still in your system.

[00:37:42] Just like Henry Schein went through it.

[00:37:44] Uh, yeah.

[00:37:45] Okay.

[00:37:46] I mean, I, in the, okay.

[00:37:48] So, so you got to do your updates.

[00:37:51] You got to have the firewall.

[00:37:52] You got to have the security.

[00:37:53] And here's the other thing that, that everyone who's ever used a personal computer antivirus

[00:37:59] software, which probably is kind of goes along with this stuff.

[00:38:02] Everyone hates antivirus software because they feel like it slows performance.

[00:38:05] I think maybe that's less of a big deal now than it used to be.

[00:38:08] I don't know that, but antivirus is part of this deal as well.

[00:38:12] So talk, talk, talk about that a little bit.

[00:38:14] Yeah.

[00:38:14] So we really want to talk about old school antivirus, AVG, Avast, you're free off the

[00:38:21] shelves from the next gen.

[00:38:23] The major difference is when you click on that ransomware link in the email, your AVG,

[00:38:30] your Avast, it's a cat and mouse game.

[00:38:32] Yeah.

[00:38:32] Ransomware is running rampant on your network.

[00:38:34] It's trying to catch up and show.

[00:38:36] Yep.

[00:38:37] The newer technologies like we use, we use a product called Hontress.

[00:38:40] Yep.

[00:38:41] When you click on that link and the program runs, it actually isolates and quarantines

[00:38:46] it in what's called a sandbox.

[00:38:48] Okay.

[00:38:48] And detects if it's ransomware first.

[00:38:51] And if it is, it will shut it down.

[00:38:53] Okay.

[00:38:53] Before it does anything on your network.

[00:38:55] Okay.

[00:38:55] This is one of the major reasons why the dark horse clients, we have over 1,220 clients.

[00:39:03] They do not do.

[00:39:04] Okay.

[00:39:05] Okay.

[00:39:06] Because they are doing the bare minimum, which happens to be what you have to do for

[00:39:10] HIPAA compliance anyway.

[00:39:11] Yeah.

[00:39:11] Yeah.

[00:39:12] Yeah.

[00:39:12] Yeah.

[00:39:12] So if you just do that, this is the good news.

[00:39:15] If you just do the bare minimum and secure your patient's health information with a firewall

[00:39:20] on antivirus and email security and keeping your windows up to date or some other things.

[00:39:25] Yep.

[00:39:26] You're probably not going to have to deal with this.

[00:39:28] Yeah.

[00:39:28] Yeah.

[00:39:29] Don't be that seven to 9%.

[00:39:30] No, I know.

[00:39:31] Well, and the reality is what I know about my friend's situation is there was, it's amazing

[00:39:54] you think they're fine.

[00:39:55] I hate to say that.

[00:39:56] And honestly, no dentist out there is really excited to pay that extra.

[00:40:03] You know, like that's just one more.

[00:40:04] Everyone's taking a swipe all the time from your credit card for your practice, all that

[00:40:08] stuff.

[00:40:08] But this is like, this is, I mean, this is an increasing weakness all over the place.

[00:40:14] And, and this is probably when, when people talk about we've, everyone does HIPAA training

[00:40:18] and everyone thinks about don't let patients see your computer monitor with other patients'

[00:40:23] names on them.

[00:40:23] Like, yeah, that's, that's part of it.

[00:40:25] But the reality is this is, this is probably more of a, more of a thing on some level.

[00:40:30] Just like when you think about your entire database getting out on that.

[00:40:34] Yeah.

[00:40:34] I'm just like, Oh my God.

[00:40:35] One of the most dangerous things is you use Dan, the local IT guy.

[00:40:42] Right.

[00:40:42] But Dan is really good at installing computer mounting monitors, mounting TVs, the kind

[00:40:49] of the physical basic IT stuff.

[00:40:50] Yep.

[00:40:51] But it has complete line to HIPAA compliance and service.

[00:40:56] Sure.

[00:40:57] That is one because the doctor trusts in that doctor probably is doing the HIPAA compliance

[00:41:03] stuff.

[00:41:04] And Dan's probably, yeah, I got you back.

[00:41:06] But Dan's not doing that.

[00:41:08] Yeah.

[00:41:09] And on some level, it sounds like you would be fine as, as the, the HIPAA compliance specialist

[00:41:16] working with Dan, Dan can take care of the physical stuff on the ground and all that sort

[00:41:20] of thing.

[00:41:20] As far as, you know, that, you know, mounting monitors and stuff like that.

[00:41:23] The reality is, is we, you probably need to be making sure that your security protocols

[00:41:27] are up to speed because you're, you're required to have them up to speed, you know, whether

[00:41:31] you realize that or not, but that's sort of, that's sort of the, that's sort of how it goes.

[00:41:36] I got, I got a couple more.

[00:41:38] I mean, I have so many questions that we're going to have to do this again, but okay.

[00:41:40] So you talk about stuff, software updates, talk about staff training.

[00:41:45] What, like what kind of staff training requirements and what kind of, what kind of, you know, in,

[00:41:50] in the, in there's ongoing staff training.

[00:41:52] It's not like you do a HIPAA and you're like, okay, now we got HIPAA.

[00:41:55] It sounds like there's requirements for ongoing staff training.

[00:41:58] And my guess is that ongoing staff training is don't touch that link is, is in, I mean,

[00:42:03] over and over again, I suspect.

[00:42:04] But what, tell me about the training aspects.

[00:42:07] Yeah.

[00:42:07] So there's two training segments.

[00:42:11] There's HIPAA compliance.

[00:42:13] You're going to go into why HIPAA exists, what information you can share, when a patient

[00:42:18] requests it, what do you have to do, all that stuff.

[00:42:21] Cybersecurity awareness training.

[00:42:23] That's the newer training.

[00:42:24] That's the link, how, you know, having your guard up, maybe, you know, you hire me to do

[00:42:32] like a campaign and send emails to your staff.

[00:42:36] If they click on it, that goes great.

[00:42:38] You won the opportunity to take a cybersecurity training.

[00:42:40] Ta-da!

[00:42:41] You failed.

[00:42:43] Yeah.

[00:42:44] So those are the two.

[00:42:45] It's kind of like HIPAA, which is, which is, has some IT and data security.

[00:42:50] Yeah.

[00:42:51] But you know, it's really about, as we mentioned, making sure your software's on HIPAA mode,

[00:42:55] the schedules of another patient, data, data integrity, data security, what you can share,

[00:43:03] how you can share.

[00:43:03] And then cybersecurity is how do you keep your network safe?

[00:43:07] Okay.

[00:43:07] Okay.

[00:43:08] So, and this is just part of the training stuff you got to do.

[00:43:11] And I mean, the reality is the more aware your team is of this stuff, the more likely

[00:43:15] they're going to walk away from that.

[00:43:16] And here's a question.

[00:43:17] When you send those emails, that tests whether the people click on this, but also does that

[00:43:22] test your firewall?

[00:43:22] Does it like, I mean, are you sending emails that are going to get through the firewall?

[00:43:27] No.

[00:43:27] So the, the emails aren't necessarily going right through the firewall.

[00:43:32] Okay.

[00:43:33] So files, data transfer directly are going through the firewall, but if something is sitting

[00:43:39] in a Microsoft email server, it's coming through encrypted and it's, and the firewall

[00:43:43] is not really able to see it.

[00:43:45] Okay.

[00:43:45] Okay.

[00:43:46] So that is going to be email filtering.

[00:43:50] Yeah.

[00:43:50] Right.

[00:43:51] That is, that really, that is really helpful.

[00:43:54] If your staff ever even got a chance to see or click on the email, that's an awesome scenario.

[00:44:01] Yeah.

[00:44:02] Yeah.

[00:44:03] That's like, what, when you say, what is email filtering that's different from what we've

[00:44:08] talked about as far as, as far as antivirus and firewalls, is there a separate software

[00:44:12] that you're talking about, or is it just settings in any, whatever email, you know, it's a, would

[00:44:16] you, would it be better to, for them to be using a piece of software versus a web browser?

[00:44:20] What, you know, like what sort of like, uh, that sort of thing.

[00:44:23] Yeah.

[00:44:24] So let's say you go and you get Microsoft 365.

[00:44:27] Mm-hmm .

[00:44:28] You, there's a couple of different licenses.

[00:44:30] There's the basic, but there's all the way up to the premium.

[00:44:33] Mm-hmm .

[00:44:33] And it has a complete different set of options as far as email filtering and security goes.

[00:44:39] Mm-hmm .

[00:44:39] Right.

[00:44:40] And you can turn it up.

[00:44:40] You could turn it down.

[00:44:41] Right.

[00:44:41] You turn up really high.

[00:44:43] You might have a lot of good emails.

[00:44:45] Yeah.

[00:44:46] Sent to your junk folder.

[00:44:47] Yeah.

[00:44:47] And you have to be diligent.

[00:44:48] Yep.

[00:44:50] Uh, that is how things get stopped before they even get into your inbox.

[00:44:54] Okay.

[00:44:54] But the quality of filtering differs drastically from free Gmail, none.

[00:45:02] Yeah.

[00:45:03] To Google workspace, to Microsoft 365, to, I mean, there's a lot of email providers out there.

[00:45:09] Okay.

[00:45:09] And then we add on to Microsoft.

[00:45:13] Okay.

[00:45:14] So we'll get a base license there and then we'll use a company we trust that just does

[00:45:19] email filtering.

[00:45:20] And it sits basically in between Microsoft and the user.

[00:45:23] Got it.

[00:45:24] Got it.

[00:45:24] All right.

[00:45:25] One, another question that's sort of close to my heart.

[00:45:30] I mean, I, I've used Dentrix since 1998.

[00:45:33] Tell me about cloud-based software.

[00:45:36] Like cloud-based practice management software.

[00:45:38] Are there, are there benefits from security aspects for cloud-based?

[00:45:41] I mean, the fact that technically your entire, you're not, you don't have a server sitting

[00:45:45] in your office.

[00:45:46] So you're, I mean, are there advantages or is it, or is it still really susceptible?

[00:45:49] What do you think?

[00:45:50] Still very young in dental.

[00:45:52] Yeah, it is.

[00:45:53] Cloud that is.

[00:45:54] Mm-hmm.

[00:45:55] Most of the cloud that we see, I would say still over 90% of our clients are local servers.

[00:46:01] Okay.

[00:46:01] Just like you, Dentrix, EagleSoft, OpenDental, name your software.

[00:46:07] Ortho is the exception.

[00:46:08] They have some pretty sophisticated softwares out there that are mature.

[00:46:13] Ortho2Edge is one of those.

[00:46:15] Free shout out to them.

[00:46:16] Mm-hmm.

[00:46:18] But most of the general dentistry, pediatric, and like they're all pretty primitive.

[00:46:23] Yeah.

[00:46:23] Right now?

[00:46:26] Primitive, but also, also just not, there's not a lot of uptake yet.

[00:46:29] I mean, I think people are moving that.

[00:46:31] I mean, I can see a lot of advantages to it, but I'm curious as far as the security aspect,

[00:46:35] are you seeing that, that there's a big advantage there or not really?

[00:46:39] It shifts the security responsibility to a company.

[00:46:43] Mm-hmm.

[00:46:43] So think, you know, we talked about Aspen Dental.

[00:46:46] Yeah.

[00:46:47] Because of all thousand of their offices were stored in a central location.

[00:46:52] Yep.

[00:46:53] When they got hit, it was a big deal.

[00:46:55] Yeah.

[00:46:56] So there is less you have to do at the practice level.

[00:47:00] Yeah.

[00:47:01] Right?

[00:47:01] I, if you no longer have a server.

[00:47:03] Yeah.

[00:47:04] Then we don't have to back it up and you're going to save costs there.

[00:47:07] Yeah.

[00:47:07] That is now on the, on the software provider.

[00:47:09] Yeah.

[00:47:09] But now they're a bigger target.

[00:47:11] Yeah, they are.

[00:47:12] So if the software, okay, this is, and this is maybe a lawyer question.

[00:47:16] The software company gets hit big time.

[00:47:18] And I'm just thinking how many practices my, do I still have liability?

[00:47:24] Cause I chose a software company.

[00:47:26] They got hit.

[00:47:26] How does that even work?

[00:47:27] Like, I mean, and the other thing is if they, if they can, if they can, if they can

[00:47:31] encrypt my software on that guy's server, it's still encrypted.

[00:47:35] I still can't get to it.

[00:47:36] You know?

[00:47:37] So, so that's a little scary.

[00:47:39] That's, have you heard of, have you heard of cloud-based softwares getting hit yet with

[00:47:43] this stuff?

[00:47:43] I would assume that they have, they are pretty serious about their security for that.

[00:47:47] Cause that would basically wreck a business overnight.

[00:47:50] Yeah, no, I have.

[00:47:52] They're not going to tell your patients that they lost their social security number and it's

[00:47:59] out there.

[00:47:59] You still have to do that.

[00:48:00] Yeah.

[00:48:02] Right.

[00:48:02] Here's a, here's a pile of cash while we figure out what we're going to do with you.

[00:48:07] Yeah.

[00:48:07] But go ahead and tell your patients that their information is leaked out there and see what

[00:48:12] that does to your business.

[00:48:13] Yeah.

[00:48:13] That is by far the most detrimental disruptive part of this is reputation.

[00:48:19] Yeah.

[00:48:19] That lost trust with the, with the patient.

[00:48:22] Yeah.

[00:48:23] Like I said before though, here's a little bright spot on the reputation.

[00:48:26] Everyone gets these notices all the freaking time.

[00:48:29] Cause, cause everyone's losing data everywhere.

[00:48:31] And so there it's gotten to a point where like, eh, you know, I, I know that's terrible and

[00:48:36] it's, it's kind of funny.

[00:48:37] It's also awful that I'm actually joking about it, but like that may even become, yeah, obviously

[00:48:42] this is, this is a concern and that's what everyone's thinking.

[00:48:44] Like, I mean like that.

[00:48:45] And that's the other thing is that it's bad enough that you're like, oh my God, I don't

[00:48:48] have data.

[00:48:49] I can't see patients.

[00:48:50] I don't even know what my schedule looks like.

[00:48:52] Uh, but then down the road, I'm, oh, by the way, I got to tell everyone and maybe, maybe

[00:48:57] shell out a ton of money.

[00:48:58] So there's the reality is what you're saying is good news is that, that this is mostly

[00:49:03] preventable with this combination of security training, all this sort of thing.

[00:49:07] And I mean, there are lots of companies out there that, that do this.

[00:49:10] I'm talking with Ruben dark horse tech.

[00:49:13] I'm going to put the links in the show notes.

[00:49:14] I feel like, I feel like if you're even nervous about this at all, you need to at least talk

[00:49:18] to them to know, you know, Ruben will probably tell you, no, you're golden.

[00:49:21] You've, you've found people that can do this for you because you need to do it.

[00:49:26] I hate this by the way.

[00:49:27] I freaking hate it.

[00:49:28] It's like the same thing with OSHA compliance.

[00:49:30] It's just one of those things that you're like, I went to dental school to learn how to like

[00:49:34] help people with their teeth and oral health and stuff.

[00:49:37] I didn't go to dental school so I could be doing HIPAA trainings yet.

[00:49:40] Here we are.

[00:49:41] Okay.

[00:49:41] Here we are like being, if you can't do it, just be an employee, let your employer do it.

[00:49:46] Someone's going to be doing it at this point.

[00:49:48] And so, yeah, it's, it's wild.

[00:49:50] Ruben, this was really helpful.

[00:49:52] This was really helpful.

[00:49:52] I suspect I'm going to try and have you on again because my guess is everyone, everyone's

[00:49:57] going to hear this.

[00:49:57] And just imagine, I think most of our listeners probably, probably listen to this while they're

[00:50:03] driving to work or at the gym and they've just heard this and they're, they're in a

[00:50:08] blind panic running to their office to see what kind of security they have there because

[00:50:12] they haven't given this very much thought.

[00:50:13] Cause I only say that because that's what happened to me.

[00:50:16] So I'd love to hear from your listeners if they have questions on how they can help their

[00:50:20] own practices.

[00:50:21] I'm sure we could fill up an hour on that.

[00:50:23] For sure.

[00:50:23] For sure.

[00:50:24] I'll get questions, but also if you've got anyone who's, who monitors your Facebook

[00:50:27] stuff, I'll invite them into the Facebook group.

[00:50:29] So people are going to ask them too.

[00:50:30] That'll be great.

[00:50:30] This is awesome.

[00:50:31] Again, we got show me directly.

[00:50:33] Yeah.

[00:50:33] Okay.

[00:50:34] So you can talk to, talk to Ruben.

[00:50:35] I'll get him in there.

[00:50:36] This was fantastic.

[00:50:38] I mean, again, Ruben, I would rather not talk to you.

[00:50:41] I'd rather, I'd rather have met you in some other situation.

[00:50:43] I'd rather not even know who you are, to be honest.

[00:50:46] I, I hate to be blunt about that, but it's true, but this is so real and, and it is happening

[00:50:51] to someone that you know right now, probably, and it, it can, and you know, 9%, 7 to 9%

[00:50:56] every, it's just nuts.

[00:50:57] So this is stuff we can't really ignore it.

[00:50:59] And I'm not going to lie to you.

[00:51:00] I wasn't ignoring it, but I was ignoring the fact that I wasn't ignoring it.

[00:51:04] Like I, I literally ran in to see, okay, oh my God, what are we doing here?

[00:51:07] I remember seeing that.

[00:51:08] I remember seeing the, the, uh, the firewall box go in and it's like, okay, I'm doing something.

[00:51:13] Oh wait, one last thing.

[00:51:14] I'm sorry.

[00:51:14] One last thing.

[00:51:16] Um, cybersecurity insurance policies.

[00:51:19] Are you big on those?

[00:51:20] Yes.

[00:51:20] Okay.

[00:51:20] Tell me about them.

[00:51:21] So I, why I like me personally, the number one reason is it gives us a chance to educate

[00:51:27] our customers that we're doing the things that they expect.

[00:51:31] Right.

[00:51:31] It's basically a test.

[00:51:32] Do you have a firewall?

[00:51:34] Yeah.

[00:51:34] Use encrypted email.

[00:51:35] We'd be like, Hey, we're doing everything that even a cyber liability company wants us

[00:51:42] to do.

[00:51:42] Yep.

[00:51:42] So it's a really good education.

[00:51:44] The client does everyone need it.

[00:51:49] It's a very personal decision.

[00:51:51] If you have an company that you trust is doing the right thing, you're really isolated down

[00:51:57] to one thing, which is employee sabotage.

[00:51:59] It's the 9%.

[00:52:00] Yeah.

[00:52:01] Yeah.

[00:52:01] So if you can live, if you can live with a 9% and you trust your IT company, it might

[00:52:05] be something you can live without.

[00:52:08] Yeah.

[00:52:09] But if there's even now in the back of your mind, sign up for it.

[00:52:13] Yeah.

[00:52:13] I'm not going to lie to you.

[00:52:14] I, I, I, one of the other things I did when I heard about this from my friend was I immediately

[00:52:19] got a quote.

[00:52:21] It's not that expensive, honestly.

[00:52:23] I mean, for all the other stupid insurance that we pay for, this is not that expensive.

[00:52:26] So maybe, maybe worth a look.

[00:52:28] I just, so again, and Ruben can probably help us, help us.

[00:52:31] But part of the deal is that that insurance isn't worth much at all.

[00:52:35] If you're not, you can't get the insurance and then not do what you need to do.

[00:52:39] That's the thing.

[00:52:40] If you, if you, if you get hacked because you haven't been doing all this stuff, well, that's,

[00:52:44] that's, that's the problem.

[00:52:45] But I.

[00:52:46] That's true.

[00:52:46] If you sign up for it, it's going to make you say, I do have a firewall.

[00:52:52] Yeah.

[00:52:53] So if you get hit and you don't have a firewall, they're not paying for it.

[00:52:57] Yeah.

[00:52:57] Now this is awesome.

[00:52:58] I mean, and, and it'll be, it'll be really interesting because I literally have spent a

[00:53:04] lot of time recently kind of looking at AI production hacks and using it.

[00:53:08] But, but the reality is this is also the bad guys have it too.

[00:53:10] This is an evolving thing.

[00:53:12] Like two years from now, Ruben's going to say, Oh my God, we got all new crime.

[00:53:16] Now what we were talking about two years ago, that's not even a big deal anymore.

[00:53:19] You know, I, that's my guess.

[00:53:20] It's insane.

[00:53:21] Yeah.

[00:53:21] I was out with the wife last night to dinner and we went to this restaurant where I was a

[00:53:28] dishwasher 15 years ago.

[00:53:30] I look at the menu.

[00:53:31] I'm like, it's the same menu.

[00:53:33] Yeah.

[00:53:34] I'm like, Shannon, could you imagine if we didn't have to change anything for 15 years?

[00:53:40] It is, it's just the pace of change is insane.

[00:53:44] Yeah, it is.

[00:53:45] It is.

[00:53:48] Uh, I, I got so much to say we're going to, we're going to, I'm gonna have you on again.

[00:53:50] This is too fun.

[00:53:51] This is, I mean, it's not fun, but it is actually, you're pretty okay.

[00:53:55] As a cybersecurity guy, you're pretty lighthearted.

[00:53:59] I, there, there's a lot of, there's a lot of sales on this stuff that is real scare tactics

[00:54:04] and it's, and it turns dentists off left and right.

[00:54:06] I get it.

[00:54:07] I am also turned off by that, but it's, it is something that we can't really ignore.

[00:54:11] So here's the number one sales pitch.

[00:54:13] Dark horse clients don't get hacked.

[00:54:15] That's a good pitch.

[00:54:16] Hard to argue with that really.

[00:54:19] All right, Ruben, this was awesome.

[00:54:22] We'll have you on again soon.

[00:54:23] And, uh, folks, if you have any questions or comments, uh, we'll have Ruben in the Facebook

[00:54:27] group.

[00:54:27] We'll get, we'll get the questions to him.

[00:54:29] Join the Facebook group.

[00:54:30] And if you want to be in the Facebook group, I only let listeners in.

[00:54:32] You got to have a password.

[00:54:33] It's, it's going to be, let's see, you got five passwords.

[00:54:36] You can pick one.

[00:54:37] Timmerman, McQuethy, Hornbrook, uh, Lipscomb and Papa Randy.

[00:54:41] All those five can get you in.

[00:54:42] And honestly, I have to tell you folks, I'm not letting anyone in without the passwords.

[00:54:46] So that's why the group grows so slowly.

[00:54:48] It's only people with the passwords.

[00:54:50] If you don't have a password you want in, find it.

[00:54:52] That's, that's my little cybersecurity, Ruben.

[00:54:55] Are you impressed?

[00:54:55] I mean, like, I like that.

[00:54:57] I only want people to listen to the podcast because these dental Facebook groups are a

[00:55:00] complete shit show.

[00:55:01] So I'm trying to keep this one less.

[00:55:03] So Ruben, thanks a ton.

[00:55:04] This was great.

[00:55:05] We'll have you on again.

[00:55:05] And, uh, all the information about Dark Horse is going to be on the show notes if you're

[00:55:09] interested guys.

[00:55:10] So thanks a ton.

[00:55:10] And we'll talk to you again soon.

[00:55:11] I'll see you later, guys.

[00:55:11] And then wait until 1 customers with me, guys, for the list.

[00:55:12] I just keep buying somebacks.

[00:55:12] Thanks, Allen.

[00:55:13] And, thanks to all.