Category: Cybersecurity & Compliance

Threat protection, EDR/MDR, MFA, and compliance guidance (HIPAA, SOC 2, CMMC, PCI, FTC Safeguards) for Los Angeles businesses.

Wire Fraud Is Targeting LA Real Estate and Construction: The BEC Defense Playbook

Posted on by ychoi

The costliest cyberattack hitting Los Angeles real estate and construction firms isn’t ransomware — it’s a well-timed email. Business email compromise (BEC) wire fraud works because it exploits the exact moment your industry moves large sums on tight deadlines: escrow closings, progress payments, subcontractor invoices. One convincing “updated wiring instructions” email, and six or seven figures leave for an account you’ll likely never claw back.

How the scam actually works

Attackers don’t hack your bank. They compromise (or convincingly spoof) an email account somewhere in the transaction chain — an agent, escrow officer, project manager, or sub — then watch quietly. They learn the deal cadence, the names, the invoice formats. Then, at the moment a payment is expected, they send wiring instructions that look exactly like every legitimate email before it, often from the real account of someone you trust.

Real estate closings and construction draws are targeted specifically because the amounts are large, the deadlines are firm, and the parties often communicate across many small firms with uneven security.

The defense playbook

1. Kill the reused-password problem with MFA

Most BEC starts with a compromised mailbox, and most mailbox compromises start with a phished or reused password. Enforced multi-factor authentication on email — every user, no exceptions, including field staff and part-timers — removes the easiest path.

2. Enterprise email security, not default filtering

Default spam filters catch pharmacy spam, not lookalike-domain spear phishing. Enterprise email protection flags external senders, detects newly registered lookalike domains, and quarantines impersonation attempts before they reach the person who releases payments.

3. Verification callbacks — as policy, not habit

Any new or changed wiring instructions get verified by phone, using a number you already had on file (never one from the email). Write it into your closing and payment procedures, train on it, and make it non-overridable — even when the email says “urgent.”

4. Watch for the quiet signs of mailbox compromise

Attackers set up forwarding rules and folder tricks so the real account owner never sees the fraudulent thread. Monitoring for suspicious inbox rules, impossible-travel logins, and new device sign-ins catches the intrusion during the surveillance phase — before the money moves. This is part of what 24/7 monitoring in our managed security stack exists to do.

5. Train the people who touch payments

Phishing simulation and security awareness training focused on your actual workflows: escrow coordinators, accounting, PMs approving draws. Generic annual training doesn’t change behavior; scenario-based practice does.

6. Segregate and cap payment authority

Dual approval above a threshold, separation between whoever sets up a payee and whoever releases funds, and a hard rule that authority never transfers over email alone.

What this looks like in practice

We built exactly this defense for X3 Build, a 45-person Santa Monica construction firm — enterprise email security and MFA against BEC, managed field devices, and monitored endpoints — and for Younan Properties, a 120-user commercial real estate firm we moved to a fully managed, monitored cloud environment. Neither firm has to hope the next wiring email is real; the layers assume some won’t be.

Frequently asked questions

Can wired funds be recovered?

Sometimes — if you act within hours. Contact your bank and the FBI’s IC3 immediately; recovery odds drop steeply after the first 24–48 hours as funds are moved through mule accounts.

Does cyber insurance cover wire fraud?

Only if you have the right endorsement — social engineering / funds transfer fraud coverage is a separate, often sub-limited line item. Check your policy before you need it, and expect the carrier to ask whether the controls above were in place.

We’re a small firm. Are we really a target?

Small firms in the transaction chain are the preferred entry point — attackers compromise the least-defended party to attack everyone else in the deal. Being small makes you more attractive, not less.

Move money on deadlines? Book a free assessment and we’ll check your email security, MFA coverage, and payment-fraud exposure — before someone else does.

HIPAA Risk Assessment: What LA Practices Should Expect (With Real Findings)

Posted on by ychoi

If your practice hasn’t had a HIPAA risk assessment in the last twelve months, you’re not just behind on paperwork — you’re carrying findings you don’t know about. We’ve run these assessments for LA medical groups, dental practices, and an 850-staff hospital, and the same issues surface over and over. Here’s what the process actually involves, and the findings we see most.

What a HIPAA risk assessment actually is

The Security Rule requires covered entities to conduct an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.” In practice, that means someone technical inventories every place ePHI lives — EHR, imaging systems, email, file shares, backups, connected devices — and evaluates the controls protecting each one, then documents the gaps and a remediation plan.

It is not a questionnaire your office manager fills out in an afternoon, and it is not something OCR accepts on good faith after a breach. The first thing investigators request is your most recent risk assessment and evidence you acted on it.

The findings we see most in LA practices

1. Flat networks

Front-desk workstations, guest Wi-Fi, imaging equipment, and the EHR server all on one network segment. One phished receptionist becomes a path to everything. Network segmentation was the single biggest fix in our Beverly Hospital engagement — an 850-staff hospital running un-segmented before the rebuild.

2. Access that outlives employment

Former staff with live EHR or email credentials weeks after departure. No documented offboarding checklist, no access reviews. This is among the most common OCR findings nationally, and the cheapest to fix.

3. Unencrypted devices

Laptops that leave the building without full-disk encryption. A stolen unencrypted laptop is a reportable breach; a stolen encrypted one generally is not. The difference is a checkbox — enforced, verified, and documented.

4. Missing audit logging

The Security Rule expects you to know who accessed what. Many practices have logging technically available in their EHR but never enabled, never reviewed, and never retained.

5. Backups nobody has tested

Ransomware turns “we have backups” into “we think we have backups” at the worst possible moment. Tested, separated, documented restores are both a HIPAA expectation and the thing that determines whether an attack is a bad day or a closure event.

6. No business associate agreements

IT vendors, billing services, transcription, cloud tools — each needs a BAA. We routinely find practices where the IT provider itself never signed one.

What to expect from the process

A proper assessment for a small-to-mid practice takes two to four weeks: discovery and scanning, staff interviews, control review against the Security Rule safeguards, then a findings report ranked by risk with a remediation roadmap. The report is written evidence — date-stamped, methodical, and specific — which is exactly what an auditor, an insurer, or a plaintiff’s attorney will ask to see. Our HIPAA compliance consulting covers the assessment and the remediation, and our HIPAA IT services keep the controls maintained year-round.

Frequently asked questions

How often is a risk assessment required?

HHS guidance expects it to be ongoing, with a formal refresh at least annually and after any material change — new EHR, new location, merger, or a security incident.

Does a small practice really need this?

Yes — enforcement actions regularly hit practices under 25 staff, and the settlements routinely exceed what a decade of proper IT would have cost. Cyber insurance carriers increasingly require the same evidence.

Can our EHR vendor’s compliance attestation cover us?

No. Your EHR being HIPAA-capable says nothing about your network, devices, access controls, staff, or backups. The risk assessment obligation is yours.

Not sure where your practice stands? Book a free 10-minute call — we’ll tell you what an assessment would cover for your environment and what it typically surfaces.

Cybersecurity for LA Law Firms: A 2026 Compliance Checklist

Posted on by ychoi

CYBERSECURITY · LEGAL Law Firm Cybersecurity A 2026 Checklist Protecting client confidentiality in Los Angeles AADVANCED NETWORKS

Cybersecurity · Legal

Few industries hold as much sensitive information as a law firm. Client communications, financial records, intellectual property, and privileged case material all live on your network, and that makes law firms one of the most attractive targets for cybercriminals. For Los Angeles firms, the stakes are compounded by ethical obligations around client confidentiality and a growing patchwork of data-protection expectations.

The good news: strong security doesn’t require turning your firm into a fortress overnight. It requires getting the fundamentals right and reviewing them regularly. Use the checklist below as a starting point for where your firm stands heading into 2026.

Why law firms are prime targets

Attackers know that firms hold valuable data and often run lean on IT. A single successful phishing email can expose privileged client information, trigger an ethics inquiry, and do lasting reputational damage. Beyond the direct financial cost of an incident, the loss of client trust is frequently the harder blow to recover from.

The confidentiality obligation

Attorneys have a professional duty to take reasonable steps to safeguard client information, and “reasonable” now clearly includes competent cybersecurity practices. Failing to secure client data isn’t just an IT problem; it can become an ethics and malpractice problem. Treat security as part of your professional responsibility, not an optional IT upgrade.

Your 2026 cybersecurity checklist

  • Multi-factor authentication (MFA) on email, your practice-management system, and remote access, without exception.
  • Encrypted email and file sharing for any privileged or sensitive client material.
  • Endpoint protection and 24/7 monitoring on every device, including laptops used from home or court.
  • Tested, off-site backups with a documented recovery plan, so a ransomware attack can’t hold your matters hostage.
  • Regular patching of operating systems and applications to close known vulnerabilities.
  • Email filtering and anti-phishing to stop the most common entry point before it reaches an inbox.
  • Security awareness training so every attorney and staff member can recognize a phishing attempt.
  • Access controls that limit who can reach which files, so a single compromised account doesn’t expose everything.
  • A written incident response plan that spells out who does what in the first hours of a breach.
  • Vendor and cloud due diligence to confirm your third-party tools meet the same standard you do.

Where most firms fall short

In our experience, it’s rarely the exotic threats that cause problems, it’s the basics left undone: MFA that was never fully rolled out, backups that were never actually tested, or staff who were never trained to spot a convincing phishing email. A short, honest assessment usually surfaces two or three gaps that account for most of a firm’s real risk.

Turning the checklist into a plan

If you went through the list above and hit a few “not sure,” that’s the most valuable thing you can learn today, because it tells you exactly where to focus. The firms that handle security well don’t do everything at once; they prioritize the highest-risk gaps first and build from there with a partner who understands both legal workflows and IT.

Not sure where your firm’s gaps are?
Advanced Networks provides specialized IT support and cybersecurity for law firms across Los Angeles and Orange County. Request a confidential security assessment →