In our previous posts (Part 1 and Part 2), we introduced you to a healthcare organization that had its entire IT environment resting on the shoulders of a single Help Desk guy. We saw the warning signs, the aging infrastructure, the failed backup, and the security issues that kept piling up while management continued taking a reactive approach. Now we step into how medical practices can maintain compliance and prevent data breaches.
Eventually, the storm arrived. And, as it turns out, getting everyone on board with how to navigate that storm isn’t always easy.
Table of Contents
The Danger Isn’t Over Just Because Things Look Fine
When a breach hits, time is of the essence. After receiving the late-night panic call, the Network Antics team advised the company’s team on immediate containment steps: resetting MFA, locking out suspicious sessions, and isolating compromised endpoints so the environment could be secured systematically.
The situation was serious, we had to maintain compliance at all costs, but we had a plan and the tools to help execute it.
A short while later, the company’s response was essentially:
“Yeah, I think we’re good now.”
Just because you can no longer see something suspicious happening on your computer doesn’t mean the threat has disappeared. An attacker gaining access to an account or device is one problem. Understanding how they got in, determining what they accessed, and making sure they can’t get back in are entirely different matters.
The Aftermath: When the Invoice Arrives
As we discussed in Part 1, this organization was on a retainer arrangement with Network Antics. We had concerns about invoice fatigue from the beginning. Given the state of the infrastructure, we knew a major incident could require a substantial amount of emergency work, and we worried that the resulting costs would become a problem for the relationship.
We wanted to address the underlying issues before something happened. The organization, however, preferred a more reactive approach.
Now, the very scenario we had been concerned about had arrived. We had to maintain compliance no matter what.
Network Antics had to respond to the immediate security threat while also investigating the environment, addressing security gaps, and working out how to protect the company’s data despite the failed backup system. This was no longer a matter of fixing an occasional ticket and moving on to the next one.
The scope of the work had changed dramatically and so had the urgency.
Unfortunately, rather than focusing entirely on what needed to be done to secure the environment, internal discussions began shifting toward responsibility, authorization, and the accumulated billable time. Management questioned the emergency procedures Network Antics had been authorized to carry out and disputed the amount of work required to address the situation. They even started to accuse us of being the ones who caused the whole breach in the first place. Probably the higher-ups trying to save face or trying to find a reason to not pay the bill.
We understand that businesses need to manage their budgets. Nobody enjoys an unexpected bill, especially when it comes with a cybersecurity incident attached.
This is one of the reasons we were concerned about invoice fatigue in the first place. When an organization declines proactive work to save money, it may end up facing a much larger bill when something goes wrong. To maintain compliance isn’t something entirely easy. And if that bill becomes the main focus, there is a risk that the improvements needed to prevent another incident will be pushed aside yet again. So much of this could have been avoided by being in a managed IT contract rather than a retainer.
Fixing the Symptoms Instead of the Problem
You would hope that a serious security incident would be the wake-up call a business needs to finally address its underlying IT problems.
In this case, the organization opted to remove most of our stack and rely on short-term fixes rather than fully pursuing the longer-term improvements we believed were necessary.
This was particularly concerning because the problems extended well beyond the incident itself. None of the issues would magically disappear just because the immediate security threat had been contained.
We had been given greater freedom to act during the emergency, which allowed us to deploy tools and address problems that had previously been difficult to tackle. But securing an environment during an incident and establishing a sustainable approach to IT management are different things.
And that’s where proactive Managed IT comes in to help maintain compliance.
A proper Managed IT arrangement is about monitoring systems, maintaining infrastructure, reviewing security controls, keeping documentation up to date, forming a thorough IT disaster recovery plan and identifying problems before they become emergencies.
We can’t force a company to take a proactive approach to IT. We can explain the risks, recommend solutions, and help implement improvements when we’re authorized to do so. But ultimately, management has to be willing to act on that advice.
Lessons Learned the Hard Way on how to Maintain Compliance
1. Stop Chasing “IT Unicorns”
Expecting a single entry-level helpdesk guy to manage helpdesk tickets, maintain server architecture, enforce HIPAA compliance, monitor the firewall, and execute incident response for over 200 employees is unrealistic. It’s one of those departments that you should not be trying to keep the budget as low as possible, because that’ll lead to the kind of problems that will put your company out of business.
If you really can’t afford a whole dedicated department with top-notch professionals, a co-managed IT model where internal staff handles day-to-day user requests while a dedicated MSP manages infrastructure, security, and compliance, provides complete coverage at a fraction of the cost.
2. Security Tools Are Only Useful When They’re Properly Managed
Having MFA enabled, endpoint protection installed, and security software running is a good start. But those tools need to be configured correctly, monitored, and maintained.
In this case, endpoint protection existed, yet alerts weren’t being properly monitored. Microsoft 365 security needed improvement, and accounts had excessive privileges.
Businesses should regularly review their access controls, enforce MFA, implement appropriate Conditional Access policies, monitor security alerts, and ensure users only have the permissions they actually need.
Former employee accounts should also be disabled promptly, and access should be reviewed whenever employees change roles or leave the organization.
3. If Your Backups Aren’t Tested, You May As Well Not Have Them
This one deserves repeating because it was one of the biggest warning signs we found.
The organization had a backup system in place, but it had stopped working approximately six months earlier. For all that time, the business was operating without the protection it believed it had.
A backup job reporting success isn’t enough on its own, either. Businesses need to monitor backup jobs, investigate failures, test restores, and verify that the data they need can actually be recovered. Without a functioning backup, you aren’t maintaining compliance.
A proper backup and disaster recovery strategy should be established and tested before an emergency occurs, not improvised after one has already begun.
4. Proactive IT Is Cheaper Than Waiting for Disaster
Network Antics identified serious problems with the organization’s infrastructure and security practices. We recommended improvements, but the business preferred to handle issues as they appeared rather than invest in fixing the underlying causes.
Proactive IT management helps identify vulnerabilities, maintain systems, monitor security alerts, and address problems before they develop into major incidents. It also makes it easier to plan budgets and schedule improvements instead of trying to solve everything at once during an emergency.
If your IT provider raises concerns about your environment, take them seriously. Ask questions, request supporting evidence, and get a second opinion if you believe the recommendations don’t make sense.
Just don’t ignore the problem because fixing it sounds expensive. Dealing with the consequences is always far more expensive. It’s far easier and cheaper to maintain compliance than it is to deal with the issues that arise from not being compliant.
The Adventure May End, But the Threats Are Always Out There
Whether you’re looking to modernize aging infrastructure, improve your cybersecurity practices, maintain compliance, or give your internal IT team the support it needs, Network Antics is here to help.
Our Managed IT and Compliance services can help you identify risks, address vulnerabilities, and build an IT environment that supports your business instead of holding it back.
Get in touch with us today to make sure you’re not the next business going through this kind of terrifying situation.
This blog post is the third in our new series called “Adventures in IT”, in which we relive some of the juicier and more impactful real-life stories we’ve experienced in the managed IT business that left a lasting impression on us. This is so that you, the reader, may learn not just from your own mistakes, but also from the mistakes of others. If you just landed on this page without reading part 1 and part 2, make sure to go check them out!
