Anthem Breach Should Convince Healthcare To Double Down On Security

As the fallout continues to emerge around a breach of tens of millions of records held by Anthem, security pundits hope it'll shine a spotlight on the weaknesses in healthcare cybersecurity. They believe this mega breach is just the start of a trend of increasingly larger healthcare breaches as attackers move from harder-to-attack financial targets to still-lucrative lower-hanging fruit. And with so many stores of valuable patient information, an industry based in information-sharing among large and small businesses and a culture that doesn't prioritize IT security, healthcare is a very juicy piece of fruit.

Healthcare organizations make for attractive targets, not just for the health and medical information they store—which is as much as 10 times as valuable as credit card numbers on the black market due to the opportunity for insurance fraud—but also for the reams of other data they collect for identification and payment purposes.

"The other personal data they collect, like social security numbers, are very valuable to criminals," says Tim Erlin, director of IT security and risk strategy for Tripwire.

This is hardly a new revelation—healthcare breaches have consistently contributed disproportionately to the overall breach toll across industries. According to the Identity Theft Resource Center, for the past three years, the number of breaches in the healthcare industry have outpaced those in other industries, with healthcare organizations making up 43 percent of breaches in 2014. But the Anthem breach may be a red flag for bigger, more harmful breaches in healthcare's future. The typical healthcare breaches have been within smaller organizations and often didn't top more than 100,000 records. Prior to the Anthem breach, which could affect 80 million individuals, the worst case was a compromise last year of 4.5 million records held by Community Health Systems in Tennessee.

But the small-potatoes healthcare breaches may be growing much larger as attackers start poking around within healthcare's numerous soft spots.

"As banks spend more on IT security, they naturally become more difficult targets for hackers," explains John Gunn, vice president of communications for VASCO Data Security International. "As banks become more secure, alternative targets such as healthcare and insurance providers become much more attractive targets for hackers."

Meanwhile, healthcare organizations still aren't prioritizing security, says Andrew Hicks, healthcare practice director for Coalfire, who believes that many healthcare executives view HIPAA and HITECH security mandates as optional due to an inconsistent track record of enforcement.

"Given the fact that the Office for Civil Rights (OCR) is under budgeted and understaffed, their role is more focused on reactionary measures, including breach investigation and enforcement activities. As a result, their preventative activities, such as the 2011 and 2014 audit programs, are consistently delayed," Hicks says. "This has given healthcare organizations the perception that the OCR is 'soft' and compliance initiatives are optional.  In my opinion, the OCR should team with independent assessor organizations to perform mandatory assessments on an annual basis." 

And even when large healthcare organizations do prioritize security, the bad guys can still find lots of footholds to start large-scale attacks against them due to the way that healthcare organizations do business with one another, says Ivan Shefrin, vice president of security solutions for TaaSera.

"The health insurance industry reflects a deeply interconnected web of companies, including hospitals, doctors, practices, secondary insurance providers, and government programs like Medicare and Medicaid," he says. "Most large companies in the insurance payment sector have a strong team of in-house cyber security exports. However, the majority of companies with which they connect are small, understaffed with limited budgets for cyber security."

For example, in one assessment his firm did with a healthcare provider, they found that its primary database for patient records was under attack through an exploit in a remote desktop protocol on a system operated by the vendor responsible for the patient medical records application it used.

"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," Shefrin says.

It's why healthcare needs to rededicate its efforts to move beyond compliance alone and start working on the fundamentals of security.

"Healthcare companies should be especially vigilant about implementing the critical security controls outlined by SANS institute," says Craig Young, senior security researcher for Tripwire. "In my opinion, companies with such vast loads of confidential information should also perform no-holds-barred red team penetration testing on a regular basis to proactively identify and reinforce the weak spots in their infrastructure.  Many high-profile breaches could have been avoided with better employee education regarding recognizing and reporting social engineering strategies."