Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/6/2015
12:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Anthem Breach Should Convince Healthcare To Double Down On Security

Mega breach brings focus back on inadequacies of healthcare security.

As the fallout continues to emerge around a breach of tens of millions of records held by Anthem, security pundits hope it'll shine a spotlight on the weaknesses in healthcare cybersecurity. They believe this mega breach is just the start of a trend of increasingly larger healthcare breaches as attackers move from harder-to-attack financial targets to still-lucrative lower-hanging fruit. And with so many stores of valuable patient information, an industry based in information-sharing among large and small businesses and a culture that doesn't prioritize IT security, healthcare is a very juicy piece of fruit.

Healthcare organizations make for attractive targets, not just for the health and medical information they store—which is as much as 10 times as valuable as credit card numbers on the black market due to the opportunity for insurance fraud—but also for the reams of other data they collect for identification and payment purposes.

"The other personal data they collect, like social security numbers, are very valuable to criminals," says Tim Erlin, director of IT security and risk strategy for Tripwire.

This is hardly a new revelation—healthcare breaches have consistently contributed disproportionately to the overall breach toll across industries. According to the Identity Theft Resource Center, for the past three years, the number of breaches in the healthcare industry have outpaced those in other industries, with healthcare organizations making up 43 percent of breaches in 2014. But the Anthem breach may be a red flag for bigger, more harmful breaches in healthcare's future. The typical healthcare breaches have been within smaller organizations and often didn't top more than 100,000 records. Prior to the Anthem breach, which could affect 80 million individuals, the worst case was a compromise last year of 4.5 million records held by Community Health Systems in Tennessee.

But the small-potatoes healthcare breaches may be growing much larger as attackers start poking around within healthcare's numerous soft spots.

"As banks spend more on IT security, they naturally become more difficult targets for hackers," explains John Gunn, vice president of communications for VASCO Data Security International. "As banks become more secure, alternative targets such as healthcare and insurance providers become much more attractive targets for hackers."

Meanwhile, healthcare organizations still aren't prioritizing security, says Andrew Hicks, healthcare practice director for Coalfire, who believes that many healthcare executives view HIPAA and HITECH security mandates as optional due to an inconsistent track record of enforcement.

"Given the fact that the Office for Civil Rights (OCR) is under budgeted and understaffed, their role is more focused on reactionary measures, including breach investigation and enforcement activities. As a result, their preventative activities, such as the 2011 and 2014 audit programs, are consistently delayed," Hicks says. "This has given healthcare organizations the perception that the OCR is 'soft' and compliance initiatives are optional.  In my opinion, the OCR should team with independent assessor organizations to perform mandatory assessments on an annual basis." 

And even when large healthcare organizations do prioritize security, the bad guys can still find lots of footholds to start large-scale attacks against them due to the way that healthcare organizations do business with one another, says Ivan Shefrin, vice president of security solutions for TaaSera.

"The health insurance industry reflects a deeply interconnected web of companies, including hospitals, doctors, practices, secondary insurance providers, and government programs like Medicare and Medicaid," he says. "Most large companies in the insurance payment sector have a strong team of in-house cyber security exports. However, the majority of companies with which they connect are small, understaffed with limited budgets for cyber security."

For example, in one assessment his firm did with a healthcare provider, they found that its primary database for patient records was under attack through an exploit in a remote desktop protocol on a system operated by the vendor responsible for the patient medical records application it used.

"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," Shefrin says.

It's why healthcare needs to rededicate its efforts to move beyond compliance alone and start working on the fundamentals of security.

"Healthcare companies should be especially vigilant about implementing the critical security controls outlined by SANS institute," says Craig Young, senior security researcher for Tripwire. "In my opinion, companies with such vast loads of confidential information should also perform no-holds-barred red team penetration testing on a regular basis to proactively identify and reinforce the weak spots in their infrastructure.  Many high-profile breaches could have been avoided with better employee education regarding recognizing and reporting social engineering strategies."

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
PZav
100%
0%
PZav,
User Rank: Author
2/6/2015 | 2:25:59 PM
Its Too Easy to Get Off the Hook
The sad part about this breach is that healthcare has had ample warning that its a target. In this breach we're not talking about a regional subsidiary either, this is Anthem. 

The good money is that other attacks of this nature are underway in this sector. The only thing anyone seems to be doing about it is improving their PR response post breach. 

Investment into solutions still seems to be standard. Even with overwhelming data, there doesn't seem to be much action. At least nothing being made public. 

We need companies in all sectors to seriously look at their cyber risks and push for innovations to start creating solutions. They should demand new technology and back it up with investment.

Security vendors need to step their game up as well. There needs to be investment in developing solutions that will provide specialized solutions for attack vectors rather than focusing on pushing new devices like firewalls and IDS that will lower risk by .0009% each time a new model comes out.
TMCCAIN800
100%
0%
TMCCAIN800,
User Rank: Apprentice
2/7/2015 | 10:44:14 AM
Clarification on your statements
Please note for the readers that you should have stated "HITECH" versus "HITRUST". HITECH is a legislative mandate, whereas HITRUST is not. More over, HITRUST is a rigid, and overly complicated, attestation that serves to only distract from the issue. The medical community has a complex IT environment(s) and are typically understaffed. Furthermore, inflated claims on the worth of data that cannot be used in a "not present" transaction only leads the medical leadership to marginalize our consult. Medical data is being breached because it's easy and it retains the same capabilities for identity theft as other, more secure data, and not because someone is trying to get free medical services. Simple economics. If we can move the conversation to ensuring reasonable security is in place, based upon practical risks, we can start seeing better valuation in the board room.
Ericka Chickowski
50%
50%
Ericka Chickowski,
User Rank: Moderator
2/9/2015 | 7:52:17 AM
Re: Clarification on your statements
Thanks for the catch on the typo. Took care of it!
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
2/9/2015 | 10:01:46 AM
Anthem Breach Should Convince Healthcare To Double Down On Security
"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," It is a given that the majority of medical providers who connect to this tangled web are woefully understaffed and do not have the budgets to adequately address cyber security. The mistakes of the past should be learned well and not repeated. For instance, remember that the Target breach was accomplished by targeting one of their business partners and from there launched an attack to infiltrate the Target network. Penetrating a small medical provider network should be almost a trivial exercise, and once in as a trusted partner, the attacker can concentrate on attacking the larger organizations in that healthcare web. As that quote above states, a simple configuration oversight will cause the whole web security to unravel.

What about the Affordable Care Act? The huge monstrosity that is now colloquially called "Obamacare" is ripe for a huge security debacle. If you think the Anthem breach is huge, wait until healthcare.gov is breached. That network could potentially include every segment of the healthcare industry, all interconnected in a single place. Now then if the IRS is the instrument of ensuring compliance to the insurance mandate, it stands to reason that somewhere down the line, some form of integration will also be in place to connect healthcare insurance data to the IRS systems. Imagine breaching a network that has not only personal and medical records, but also earnings and financial data for every single wage earner or retiree in this country, accessible within a single interconnected web.

Now maybe I'm just another guy screaming doom and gloom, like Chicken Little. Maybe I should have more trust in the federal government ensuring cyber security in their systems <snicker>. Maybe I should read Alice in Wonderland again, and not worry about this topic at all. This started off as a random thought, but the more I think about it, the more concerned I become. Someone please tell me if I'm totally off base on this subject, and explain why.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/9/2015 | 10:06:35 AM
Re: Its Too Easy to Get Off the Hook
@RiskIQBlogger. I very much agree with your last point. Security vendors are way behind in terms of keeping up with their malicious counterpart. This environment is rapidly changing and we need solutions that have changed with it. Analyzing the most exploited attack vectors is a good start and creating new technologies to alleviate the risk in those vectors. Otherwise making changes to an already inadequate solution will only produce a solution that is less inadequate. In terms of quantifying progress, it could be counterproductive to enhance solutions that have become overly exploitable as time is being wasted that could be spent towards innovation.
anzar.hasan@verizon.com
50%
50%
[email protected],
User Rank: Apprentice
2/9/2015 | 11:01:45 AM
Re: Clarification on your statements
I agree with you TMCCAIN800.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/3/2020
Data Loss Spikes Under COVID-19 Lockdowns
Seth Rosenblatt, Contributing Writer,  5/28/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10548
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10549
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10546
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10547
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-11094
PUBLISHED: 2020-06-04
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as ...