Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/6/2015
12:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Anthem Breach Should Convince Healthcare To Double Down On Security

Mega breach brings focus back on inadequacies of healthcare security.

As the fallout continues to emerge around a breach of tens of millions of records held by Anthem, security pundits hope it'll shine a spotlight on the weaknesses in healthcare cybersecurity. They believe this mega breach is just the start of a trend of increasingly larger healthcare breaches as attackers move from harder-to-attack financial targets to still-lucrative lower-hanging fruit. And with so many stores of valuable patient information, an industry based in information-sharing among large and small businesses and a culture that doesn't prioritize IT security, healthcare is a very juicy piece of fruit.

Healthcare organizations make for attractive targets, not just for the health and medical information they store—which is as much as 10 times as valuable as credit card numbers on the black market due to the opportunity for insurance fraud—but also for the reams of other data they collect for identification and payment purposes.

"The other personal data they collect, like social security numbers, are very valuable to criminals," says Tim Erlin, director of IT security and risk strategy for Tripwire.

This is hardly a new revelation—healthcare breaches have consistently contributed disproportionately to the overall breach toll across industries. According to the Identity Theft Resource Center, for the past three years, the number of breaches in the healthcare industry have outpaced those in other industries, with healthcare organizations making up 43 percent of breaches in 2014. But the Anthem breach may be a red flag for bigger, more harmful breaches in healthcare's future. The typical healthcare breaches have been within smaller organizations and often didn't top more than 100,000 records. Prior to the Anthem breach, which could affect 80 million individuals, the worst case was a compromise last year of 4.5 million records held by Community Health Systems in Tennessee.

But the small-potatoes healthcare breaches may be growing much larger as attackers start poking around within healthcare's numerous soft spots.

"As banks spend more on IT security, they naturally become more difficult targets for hackers," explains John Gunn, vice president of communications for VASCO Data Security International. "As banks become more secure, alternative targets such as healthcare and insurance providers become much more attractive targets for hackers."

Meanwhile, healthcare organizations still aren't prioritizing security, says Andrew Hicks, healthcare practice director for Coalfire, who believes that many healthcare executives view HIPAA and HITECH security mandates as optional due to an inconsistent track record of enforcement.

"Given the fact that the Office for Civil Rights (OCR) is under budgeted and understaffed, their role is more focused on reactionary measures, including breach investigation and enforcement activities. As a result, their preventative activities, such as the 2011 and 2014 audit programs, are consistently delayed," Hicks says. "This has given healthcare organizations the perception that the OCR is 'soft' and compliance initiatives are optional.  In my opinion, the OCR should team with independent assessor organizations to perform mandatory assessments on an annual basis." 

And even when large healthcare organizations do prioritize security, the bad guys can still find lots of footholds to start large-scale attacks against them due to the way that healthcare organizations do business with one another, says Ivan Shefrin, vice president of security solutions for TaaSera.

"The health insurance industry reflects a deeply interconnected web of companies, including hospitals, doctors, practices, secondary insurance providers, and government programs like Medicare and Medicaid," he says. "Most large companies in the insurance payment sector have a strong team of in-house cyber security exports. However, the majority of companies with which they connect are small, understaffed with limited budgets for cyber security."

For example, in one assessment his firm did with a healthcare provider, they found that its primary database for patient records was under attack through an exploit in a remote desktop protocol on a system operated by the vendor responsible for the patient medical records application it used.

"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," Shefrin says.

It's why healthcare needs to rededicate its efforts to move beyond compliance alone and start working on the fundamentals of security.

"Healthcare companies should be especially vigilant about implementing the critical security controls outlined by SANS institute," says Craig Young, senior security researcher for Tripwire. "In my opinion, companies with such vast loads of confidential information should also perform no-holds-barred red team penetration testing on a regular basis to proactively identify and reinforce the weak spots in their infrastructure.  Many high-profile breaches could have been avoided with better employee education regarding recognizing and reporting social engineering strategies."

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anzar.hasan@verizon.com
50%
50%
[email protected],
User Rank: Apprentice
2/9/2015 | 11:01:45 AM
Re: Clarification on your statements
I agree with you TMCCAIN800.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/9/2015 | 10:06:35 AM
Re: Its Too Easy to Get Off the Hook
@RiskIQBlogger. I very much agree with your last point. Security vendors are way behind in terms of keeping up with their malicious counterpart. This environment is rapidly changing and we need solutions that have changed with it. Analyzing the most exploited attack vectors is a good start and creating new technologies to alleviate the risk in those vectors. Otherwise making changes to an already inadequate solution will only produce a solution that is less inadequate. In terms of quantifying progress, it could be counterproductive to enhance solutions that have become overly exploitable as time is being wasted that could be spent towards innovation.
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
2/9/2015 | 10:01:46 AM
Anthem Breach Should Convince Healthcare To Double Down On Security
"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," It is a given that the majority of medical providers who connect to this tangled web are woefully understaffed and do not have the budgets to adequately address cyber security. The mistakes of the past should be learned well and not repeated. For instance, remember that the Target breach was accomplished by targeting one of their business partners and from there launched an attack to infiltrate the Target network. Penetrating a small medical provider network should be almost a trivial exercise, and once in as a trusted partner, the attacker can concentrate on attacking the larger organizations in that healthcare web. As that quote above states, a simple configuration oversight will cause the whole web security to unravel.

What about the Affordable Care Act? The huge monstrosity that is now colloquially called "Obamacare" is ripe for a huge security debacle. If you think the Anthem breach is huge, wait until healthcare.gov is breached. That network could potentially include every segment of the healthcare industry, all interconnected in a single place. Now then if the IRS is the instrument of ensuring compliance to the insurance mandate, it stands to reason that somewhere down the line, some form of integration will also be in place to connect healthcare insurance data to the IRS systems. Imagine breaching a network that has not only personal and medical records, but also earnings and financial data for every single wage earner or retiree in this country, accessible within a single interconnected web.

Now maybe I'm just another guy screaming doom and gloom, like Chicken Little. Maybe I should have more trust in the federal government ensuring cyber security in their systems <snicker>. Maybe I should read Alice in Wonderland again, and not worry about this topic at all. This started off as a random thought, but the more I think about it, the more concerned I become. Someone please tell me if I'm totally off base on this subject, and explain why.
Ericka Chickowski
50%
50%
Ericka Chickowski,
User Rank: Moderator
2/9/2015 | 7:52:17 AM
Re: Clarification on your statements
Thanks for the catch on the typo. Took care of it!
TMCCAIN800
100%
0%
TMCCAIN800,
User Rank: Apprentice
2/7/2015 | 10:44:14 AM
Clarification on your statements
Please note for the readers that you should have stated "HITECH" versus "HITRUST". HITECH is a legislative mandate, whereas HITRUST is not. More over, HITRUST is a rigid, and overly complicated, attestation that serves to only distract from the issue. The medical community has a complex IT environment(s) and are typically understaffed. Furthermore, inflated claims on the worth of data that cannot be used in a "not present" transaction only leads the medical leadership to marginalize our consult. Medical data is being breached because it's easy and it retains the same capabilities for identity theft as other, more secure data, and not because someone is trying to get free medical services. Simple economics. If we can move the conversation to ensuring reasonable security is in place, based upon practical risks, we can start seeing better valuation in the board room.
PZav
100%
0%
PZav,
User Rank: Author
2/6/2015 | 2:25:59 PM
Its Too Easy to Get Off the Hook
The sad part about this breach is that healthcare has had ample warning that its a target. In this breach we're not talking about a regional subsidiary either, this is Anthem. 

The good money is that other attacks of this nature are underway in this sector. The only thing anyone seems to be doing about it is improving their PR response post breach. 

Investment into solutions still seems to be standard. Even with overwhelming data, there doesn't seem to be much action. At least nothing being made public. 

We need companies in all sectors to seriously look at their cyber risks and push for innovations to start creating solutions. They should demand new technology and back it up with investment.

Security vendors need to step their game up as well. There needs to be investment in developing solutions that will provide specialized solutions for attack vectors rather than focusing on pushing new devices like firewalls and IDS that will lower risk by .0009% each time a new model comes out.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions &gt;1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.