Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
A Mere 8 Days After Breach, Anthem Healthcare Notifies Customers
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/26/2015 | 2:16:49 PM
Re: Quick notice not surprising, considering...
Well, to be fair, it's not his fault that his health plan screwed up.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/25/2015 | 4:55:26 AM
Re: Quick notice not surprising, considering...
@ODA155: Yes, I saw that.  What's more, there's evidence that suggests that other researchers knew about the attack a few months ago (and at least one reported on the suspicious behavior).
Technocrati
50%
50%
Technocrati,
 User Rank: Ninja
2/11/2015 | 11:04:52 AM
Re: Quick notice not surprising, considering...

"...one of the affected customers was Michael Daniel -- the President's chief cybersecurity advisor."

 

How embarrassing.   Amazing when reality ( you don't know what you doing... ) meets fantasy ( everything is under control ).  

Let's see if he keeps his job, probably that seems to be the customary track for "experts" who fall short.

Technocrati
50%
50%
Technocrati,
 User Rank: Ninja
2/11/2015 | 11:00:24 AM
Re: Quick notice not surprising, considering...

@Joe   I am not particularly impressed about the early notice either.  I am sure they have been reading about Sony and all the rest.  80 mil records compromised !  

A new record.

 

Hackers seem to be well ahead of most company "experts".

ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/9/2015 | 1:28:22 PM
Re: Quick notice not surprising, considering...
Brian Krebs is suggesting this hack could have started as far back as April 2014!
GonzSTL
50%
50%
GonzSTL,
 User Rank: Ninja
2/9/2015 | 12:02:06 PM
Re: Quick notice not surprising, considering...
@ODA155: Scary, isn't it? And we wonder why breaches occur ... In all the breaches to date, one glaring fact stands out – a gap in secure computing practices. Of course, that is a classic understatement. Take your post regarding HIPAA and PCI (I am fully aware that encryption is not mandated); they, in and of themselves, do not constitute a fully secure environment. What really gets me is that there are guidelines for these secure practices, and organizations still fail to properly implement them. Personally, I am a big proponent of implementing the SANS Critical Security Controls; properly implemented, they provide a very serious secure computing environment. Take the Anthem breach - although possession of Anthem admin credentials may have negated the security of encryption, a full implementation of Critical Security Control 17 (Data Protection) could have probably saved Anthem. This control specifies the adoption of data encryption, both in transit and at rest. Additionally, it also asks for data loss prevention protection for data in use, motion, and at rest. This control in itself could have possibly mitigated the exfiltration of Anthem data.

Many years ago, the mantra that IT needs to align itself with business goals was the big thing, and for the most part, IT organizations have followed this strategy. I believe the big thing now is that IT security needs to align itself with IT, which by extension, aligns itself with the business goals. This is the message that fails on executive ears; IT security has a communications gap that needs to be fully addressed. One of the main obstacles to achieving this goal is the line of reporting usually governing IT security. Even now, the percentage of IT security reporting to the CIO is too large for comfort. The potential for a violation of the separation of duties to forestall an undesirable result of a conflict of interest is ripe in that environment. I have seen it myself. I have heard many CIOs state that when they have control of, and responsibility for both IT and Security, they are able to make the correct judgment call that serves to benefit the organization as a whole. The fallacy of that line of thought is painfully obvious (see the Target breach), and continues to be supported by C-level executives. That is what needs to stop if IT security is to gain the proper voice and support required to align itself with the business goals of any organization, and provide an effective security environment.
ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/9/2015 | 11:09:00 AM
Re: Quick notice not surprising, considering...
@GonzSTL... I was just preparing this when you posted... All... I need to correct a statement that I made last week. I was under the assumption, as I'm sure that most of us are, that HIPPA and PCI REQUIREs data encryption. I think if anyone has this same assumption as I did, you should look at what I found this weekend when I was "Googling" around.

Since I can't post links in here you'll need to search them yourself.

This question and answer comes directly from U.S. Department of Health & Human Services website.

Is the use of encryption mandatory in the Security Rule?
Answer:
No. The final Security Rule made the use of encryption an addressable implementation specification. See 45 CFR § 164.312(a)(2)(iv) and (e)(2)(ii). The encryption implementation specification is addressable, and must therefore be implemented if, after a risk assessment, the entity has determined that the specification is a reasonable and appropriate safeguard in its risk management of the confidentiality, integrity and availability of e-PHI. If the entity decides that the addressable implementation specification is not reasonable and appropriate, it must document that determination and implement an equivalent alternative measure, presuming that the alternative is reasonable and appropriate. If the standard can otherwise be met, the covered entity may choose to not implement the implementation specification or any equivalent alternative measure and document the rationale for this decision.

Next, Google this phrase... "PCI Data Storage Do's and Don'ts" ... and read the document, it's a pretty short document from the PCI Council and the very first statement says "Requirement 3 of the Payment Card Industry's Data Security Standard (PCI DSS) is to "protect stored cardholder data.""... nowhere in this document does it say that PCI data is REQUIRED to be encrypted, it is "suggested" as an option.

Now I'm sure that the QSA's and other PCI and HIPAA experts will come out here and try to qualify what these statements mean, but I have to say that after reading them it's very clear what they're saying, at least to me it is.
GonzSTL
50%
50%
GonzSTL,
 User Rank: Ninja
2/9/2015 | 11:05:15 AM
Re: Quick notice not surprising, considering...
It is quite scary that Anthem chose not to encrypt their data, but even scarier is that encryption is not required under HIPAA. The most worrisome parts of this breach are that there were queries running with admin privileges, and that the attacker(s) were able to exfiltrate data. One would think that a large provider such as Anthem would have measures in place to detect and prevent this type of activity.
ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/7/2015 | 2:01:33 PM
Re: Quick notice not surprising, considering...
Joe... I just heard a report that said Anthem did NOT encrypt the data...at all! I also read that in an article from WSJ. And... some experts are tying this data breach at anthem, to tax return fraud with TurboTax. Minnesota has suspended accepting any state tax returns from Turbo tax... and over at databreachtoday dot com there is an article, "Anthem Breach: Chinese Hackers Involved?" that is rather interesting.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/7/2015 | 12:28:00 AM
Quick notice not surprising, considering...
Okay, sure, they notified their customers WELL before they were legally obligated, but that's not particularly surprising considering that one of the affected customers was Michael Daniel -- the President's chief cybersecurity advisor.
Page 1 / 2   >   >>


Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Looks like the Trojans are evolving into a more focused attack mode."
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industry’s conventional wisdom. Here’s a look at what they’re thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.