From shared passwords to a defensible security posture in six weeks

The situation

The owner's mailbox had been compromised through a reused password; the attacker had set up forwarding rules and sent invoices to patients. The imaging sensors and the front-desk PCs sat on the same network as the public Wi-Fi. Their previous provider's documentation consisted of a sticky note. A cyber-insurance renewal questionnaire was due in two months and asked questions nobody could answer yes to.

What we did

Day one was containment: forwarding rules removed, sessions revoked, passwords rotated, MFA enforced on every mailbox, and a notice drafted for affected patients with their counsel. Week one added a password manager with per-person logins to the practice software (the vendor supported it; nobody had asked), DMARC moved to enforcement so the domain couldn't be spoofed, and endpoint protection on every PC.

Weeks two to four: network segmented so imaging equipment, workstations, phones and guest Wi-Fi couldn't see each other; encrypted backups of the practice database with an off-site copy; screen locks and disk encryption on every workstation. Weeks five and six: a short written security policy, a staff session on what the phishing email had looked like, and a risk assessment document in the form the HIPAA Security Rule expects — which also answered every question on the insurance form.