Comments
The 6 Worst Insider Attacks of 2018 So Far
Newest First  |  Oldest First  |  Threaded View
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
7/13/2018 | 9:58:34 AM
Yet Another Healthcare Breach - A Solution Soon?
Nuance is yet another healthcare breach that begs the question: When are Electronic Health Record (EHR) and medical application vendors going to wise up? In the EHR world (and even in the paper record world) de-identified patient data is an important step in the records workflow. Patient health information (PHI) from a medical record is stripped of all direct identifiers that can be used to identify the patient the record belongs to. Here's an idea inspired by that process that might actually work:

1. Any healthcare software vendor that houses patient data would be regulated to do the following:

a. Write into their PHI-housing software a feature that 1) encrypts PHI upon entry to the application, 2) ONLY decrypts the information for viewing and editing within the application based upon Multi-Factor Authentication (MFA) that could include user credentials, network IP signatures and local system certificates, etc. and 3) any attempt to extract the encrypted data outside the application database would results in a useless blob of encrypted information.

2. Any healthcare software vendor who did not execute #1 would be fined and withheld from Federal money until they achieved that task; perhaps incentives could be offered to encourage them, too.

This model is possible and while it took a long time just to move to EHRs, having the EHR and all the other medical software applications saves no money at all if they keep getting breached. The model above would protect PHI even from insider attacks because in order for anyone to read the PHI they would have to have all the required elements, including the application server, app client, local certificates, user logins, IP signatures and so on for the data to decrypt for viewing. Potentially massive PHI data breaches could be a thing of the past with something like this in place.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/13/2018 | 8:26:25 AM
Re: Whistleblowing
SUNTRUST had a horrible reputation in the IT field for firing a ton of workers to train Indian replacements and sign non-disclosures.  Theyhave zero respect for IT as it relates to corp and fully deserve what they bought. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/3/2018 | 6:03:06 AM
Whistleblowing
Frankly, given the CEO's penchant for bombast, overstatement, and self-aggrandizement, I'm not entirely sure I personally find the Tesla employee's claims as untrustworthy here.

Moreover, employers tend to find whistleblowing to be just as much sabotage as actual wrench-throwing.



Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
Why the CISSP Remains Relevant to Cybersecurity After 28 Years
Steven Paul Romero, SANS Instructor and Sr. SCADA Network Engineer, Chevron,  11/6/2018
5 Reasons Why Threat Intelligence Doesn't Work
Jonathan Zhang, CEO/Founder of WhoisXML API and TIP,  11/7/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1786
PUBLISHED: 2018-11-12
IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.
CVE-2018-1798
PUBLISHED: 2018-11-12
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...
CVE-2018-1884
PUBLISHED: 2018-11-12
IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerabile to a "zip slip" vulnerability which could allow a remote attacker to execute code using directory traversal techniques. IBM X-Force ID: 151970.
CVE-2018-19203
PUBLISHED: 2018-11-12
PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request.
CVE-2018-19204
PUBLISHED: 2018-11-12
PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport_' is mishandled. The attacker can cr...