Suite #1130, 189 Queen St, Melbourne
+61-361-613-320
info@terusolutions.com.au
Book a free assessment Book a free assessment Book a free assessment

Threat Detection

"Prevention is cheaper than a breach"

Project Overview

TERU Solutions began working with a Melbourne chiropractic practice to strengthen the security of its systems.

The practice held clinical notes, diagnostic imaging and payment details for  patients. Endpoint protection was limited to whatever was switched on by default, nothing centrally managed, nothing monitored. Alerts, where they appeared at all, showed up on individual machines and were dismissed by whoever happened to be sitting there.

As a health service provider, the practice was covered by the Privacy Act regardless of turnover, and by the Notifiable Data Breaches scheme which requires an entity to assess a suspected breach within 30 days of becoming aware of it. The practice had no realistic way of becoming aware of anything.

The objective was to give it detection it could act on, and the evidence to prove it if asked.

Challenges

1
Unmanaged, inconsistent antivirus across workstations, with no central visibility and no alerts reaching anyone accountable.
2
Reception staff opened attachments from unknown senders all day as a core part of their job, new patient enquiries, referrals, invoices with no email filtering or impersonation protection on the practice domain.
3
Diagnostic imaging ran on an ageing machine on an unsupported operating system, unpatchable because the imaging vendor's software would not run on anything newer.
4
A single shared login was used by all front desk staff, making it impossible to attribute any activity to a person or revoke access when someone left.
5
No audit logging or retention. A suspected breach could not be investigated, let alone assessed within the 30 days the Notifiable Data Breaches scheme allows.

Solutions

1
Microsoft Defender for Business deployed across every endpoint, centrally managed, with alerts routed to a monitored channel and triaged during business hours.
2
Email protection applied to the practice domain: anti-phishing, attachment and link scanning, and impersonation protection for the practitioners' names most likely to be spoofed.
3
The legacy imaging machine isolated on its own restricted network segment with tightly limited access, containing a risk that could not be patched away.
4
Individual accounts with multi-factor authentication replaced the shared reception login, giving the practice attribution and same-day access revocation.
5
Audit logging enabled and retained for some months, with a documented assessment process so a suspected breach can be investigated and reported inside the statutory window.
Scroll to top