In this issue of HERO News, we cover a little bit about Harmony security. Security matters, and Harmony has what you need.
Some security options are a matter of preference, others are required by your insurance or simply good sense.
We answer some questions from users, and provide an article.
Enjoy!
– The HERO PM Team
Did you know?
Harmony gives you flexibility to balance your security needs with ease of use. While your data and connection are always secure (with an “A+” rating; others in our industry get an “A” rating or worse), how tightly you lock down access is configurable – and it’s important you understand your options.
Community Mailbag
I’m told I was pwned, and a hacker got my email address and password from another site. What should I do?
The only way a hacker can access your Harmony account with your username and password is if they also have your MFA device, or if you have MFA turned off.
In simple terms, MFA (or 2FA) means that, in addition to a username and password, a person needs a one-time password (token) that is delivered either to your email, to your phone, or in an authenticator app.
If you do not have MFA enabled in Harmony, or set token delivery to “email” but your email is compromised, fix this quickly to prevent unauthorized access.
I lost my phone, and I’m worried a hacker will access my Harmony account. How do I stop them?
First of all, remember that a person must have three pieces of information to access your Harmony account: your login email, your password, and your one-time password token that’s generated with each login attempt.
If they got your phone, they may have access to two of the three. If you recorded your password somewhere, or you used the same password elsewhere, it may be exposed.
In this case, simply switch to MFA by authenticator app, and recycle your authenticator secret. (In Harmony, this is labeled “Burn Secret” in your settings.) Then, even if they have your username, password, and phone with authenticator app, they still won’t be able to get in.
I want to ensure my portal users are configured with best practices for secure access – how do I do this?
While a Harmony portal account can be set up without identity authentication, this is not considered best practice.
To enforce authentication, simply add an Authorization Code in their profile Access/Authorization section, in Portal settings. This switches their account into a higher level of security that protects you and them. It also opens up account management options that are not available in unauthenticated mode.
We just fired Oswald and are concerned he got access to SSNs from owners and applicants through Harmony. Is this a valid concern?
In Harmony, TINs (SSNs, EINs, and ITINs) are always double-encrypted.
This means that a Harmony user will never see the actual number, unless they have administrator access to unlock and decrypt it – by clicking the key beside the number. As long as Oswald was not a money admin or screening admin in Harmony, he would never be able to see stored TINs on an application or profile.
Of course, it’s up to you to ensure that TINs are never recorded in a place where they don’t belong, like a saved document, or a post-it note on your monitor!
Featured Harmony U Article: What the MFA?!?
We take the security of your Harmony account and data seriously.
Statistically, your biggest security risk comes from poorly protected passwords (including sharing passwords, and using the same password across multiple sites), and shared user accounts.
You should never allow two different people to share one user account. In Harmony, you can have as many user accounts as you wish, each with their own security and authorization profile. Assign a user account to each person in your company who will access Harmony. Set them up with the level of access they’ll need to do their job. Then be sure to suspend their account immediately when they move on (or you move them on).
Occasionally you may want to check in on your users, to see who is logging in when and from where, just to confirm that nobody is accessing your account that shouldn’t be.
