After a ransomware incident, a clinic does not reopen the same day.
Medical data needs different handling from ordinary business data - in permissions, in retention and in record keeping. We put that in place calmly and in order, working to ISO 27001 and 27799 and to Israeli privacy law.
Order first, products second
Many security projects begin with a purchase. Ours begin with a question: who needs access to what, and where does the data actually sit. In most practices we walk into the real risk sits in the same three places: permissions left open after someone resigned, equipment sharing a network with the office, and a backup nobody has ever restored from.
Once that order exists, every tool you add genuinely works. We are a Netgate Channel Partner in Israel and use it as the network defence layer, and it goes in after the mapping, based on what the mapping found.
Israeli privacy law places clear obligations on anyone holding medical data. We know them, and we translate them into a task list with an owner and a date. Without drama.
What actually gets built
- NetworkSeparation between equipment, office and guests. A scanner has no reason to see the reception PC or the open internet.
- PermissionsRole-based access. Technicians, physicians, front desk and management get what they need - and when someone leaves, access closes the same day.
- IdentityTwo-factor authentication for every external connection. Management included, suppliers included, us included.
- EncryptionEncrypted in transit and at rest. Including the disks in workstations and laptops that leave the building.
- MonitoringEvent monitoring and alerting. An unusual access attempt raises an alert that reaches a person there and then.
- ProcedureWritten procedures. Who approves access, what happens during an incident, and who reports to whom. Without them you cannot prove anything on the day you are asked.
From survey to a steady state
Full mapping of data, permissions and network, with gaps ranked by real risk.
Every gap gets a fix, a cost, an owner and a date. You decide what goes in and when.
Phased delivery. Network or permission changes happen in an agreed window, with a way back.
Periodic review, security updates, permission audits, and an incident exercise once a year.
What goes into the agreement
Security posture, what was handled, what is open and what we recommend - in a document you can show the board.
We go through the user list and confirm each person still needs what they have.
A clinical server is patched in a window set in advance, with a backup taken first and a way back ready.
If something happens there is a procedure, someone who attends, and a proper report at the end.
Want to know where you stand?
The survey gives you a clear picture and a ranked list of gaps, even if you end up working with someone else.