Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
A Mere 8 Days After Breach, Anthem Healthcare Notifies Customers
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/26/2015 | 2:16:49 PM
Re: Quick notice not surprising, considering...
Well, to be fair, it's not his fault that his health plan screwed up.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/25/2015 | 4:55:26 AM
Re: Quick notice not surprising, considering...
@ODA155: Yes, I saw that.  What's more, there's evidence that suggests that other researchers knew about the attack a few months ago (and at least one reported on the suspicious behavior).
Technocrati
50%
50%
Technocrati,
 User Rank: Ninja
2/11/2015 | 11:04:52 AM
Re: Quick notice not surprising, considering...

"...one of the affected customers was Michael Daniel -- the President's chief cybersecurity advisor."

 

How embarrassing.   Amazing when reality ( you don't know what you doing... ) meets fantasy ( everything is under control ).  

Let's see if he keeps his job, probably that seems to be the customary track for "experts" who fall short.

Technocrati
50%
50%
Technocrati,
 User Rank: Ninja
2/11/2015 | 11:00:24 AM
Re: Quick notice not surprising, considering...

@Joe   I am not particularly impressed about the early notice either.  I am sure they have been reading about Sony and all the rest.  80 mil records compromised !  

A new record.

 

Hackers seem to be well ahead of most company "experts".

ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/9/2015 | 1:28:22 PM
Re: Quick notice not surprising, considering...
Brian Krebs is suggesting this hack could have started as far back as April 2014!
GonzSTL
50%
50%
GonzSTL,
 User Rank: Ninja
2/9/2015 | 12:02:06 PM
Re: Quick notice not surprising, considering...
@ODA155: Scary, isn't it? And we wonder why breaches occur ... In all the breaches to date, one glaring fact stands out – a gap in secure computing practices. Of course, that is a classic understatement. Take your post regarding HIPAA and PCI (I am fully aware that encryption is not mandated); they, in and of themselves, do not constitute a fully secure environment. What really gets me is that there are guidelines for these secure practices, and organizations still fail to properly implement them. Personally, I am a big proponent of implementing the SANS Critical Security Controls; properly implemented, they provide a very serious secure computing environment. Take the Anthem breach - although possession of Anthem admin credentials may have negated the security of encryption, a full implementation of Critical Security Control 17 (Data Protection) could have probably saved Anthem. This control specifies the adoption of data encryption, both in transit and at rest. Additionally, it also asks for data loss prevention protection for data in use, motion, and at rest. This control in itself could have possibly mitigated the exfiltration of Anthem data.

Many years ago, the mantra that IT needs to align itself with business goals was the big thing, and for the most part, IT organizations have followed this strategy. I believe the big thing now is that IT security needs to align itself with IT, which by extension, aligns itself with the business goals. This is the message that fails on executive ears; IT security has a communications gap that needs to be fully addressed. One of the main obstacles to achieving this goal is the line of reporting usually governing IT security. Even now, the percentage of IT security reporting to the CIO is too large for comfort. The potential for a violation of the separation of duties to forestall an undesirable result of a conflict of interest is ripe in that environment. I have seen it myself. I have heard many CIOs state that when they have control of, and responsibility for both IT and Security, they are able to make the correct judgment call that serves to benefit the organization as a whole. The fallacy of that line of thought is painfully obvious (see the Target breach), and continues to be supported by C-level executives. That is what needs to stop if IT security is to gain the proper voice and support required to align itself with the business goals of any organization, and provide an effective security environment.
ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/9/2015 | 11:09:00 AM
Re: Quick notice not surprising, considering...
@GonzSTL... I was just preparing this when you posted... All... I need to correct a statement that I made last week. I was under the assumption, as I'm sure that most of us are, that HIPPA and PCI REQUIREs data encryption. I think if anyone has this same assumption as I did, you should look at what I found this weekend when I was "Googling" around.

Since I can't post links in here you'll need to search them yourself.

This question and answer comes directly from U.S. Department of Health & Human Services website.

Is the use of encryption mandatory in the Security Rule?
Answer:
No. The final Security Rule made the use of encryption an addressable implementation specification. See 45 CFR § 164.312(a)(2)(iv) and (e)(2)(ii). The encryption implementation specification is addressable, and must therefore be implemented if, after a risk assessment, the entity has determined that the specification is a reasonable and appropriate safeguard in its risk management of the confidentiality, integrity and availability of e-PHI. If the entity decides that the addressable implementation specification is not reasonable and appropriate, it must document that determination and implement an equivalent alternative measure, presuming that the alternative is reasonable and appropriate. If the standard can otherwise be met, the covered entity may choose to not implement the implementation specification or any equivalent alternative measure and document the rationale for this decision.

Next, Google this phrase... "PCI Data Storage Do's and Don'ts" ... and read the document, it's a pretty short document from the PCI Council and the very first statement says "Requirement 3 of the Payment Card Industry's Data Security Standard (PCI DSS) is to "protect stored cardholder data.""... nowhere in this document does it say that PCI data is REQUIRED to be encrypted, it is "suggested" as an option.

Now I'm sure that the QSA's and other PCI and HIPAA experts will come out here and try to qualify what these statements mean, but I have to say that after reading them it's very clear what they're saying, at least to me it is.
GonzSTL
50%
50%
GonzSTL,
 User Rank: Ninja
2/9/2015 | 11:05:15 AM
Re: Quick notice not surprising, considering...
It is quite scary that Anthem chose not to encrypt their data, but even scarier is that encryption is not required under HIPAA. The most worrisome parts of this breach are that there were queries running with admin privileges, and that the attacker(s) were able to exfiltrate data. One would think that a large provider such as Anthem would have measures in place to detect and prevent this type of activity.
ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/7/2015 | 2:01:33 PM
Re: Quick notice not surprising, considering...
Joe... I just heard a report that said Anthem did NOT encrypt the data...at all! I also read that in an article from WSJ. And... some experts are tying this data breach at anthem, to tax return fraud with TurboTax. Minnesota has suspended accepting any state tax returns from Turbo tax... and over at databreachtoday dot com there is an article, "Anthem Breach: Chinese Hackers Involved?" that is rather interesting.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/7/2015 | 12:28:00 AM
Quick notice not surprising, considering...
Okay, sure, they notified their customers WELL before they were legally obligated, but that's not particularly surprising considering that one of the affected customers was Michael Daniel -- the President's chief cybersecurity advisor.
Page 1 / 2   >   >>


44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8818
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore...
CVE-2020-8819
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass ...
CVE-2020-9385
PUBLISHED: 2020-02-25
A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EAN barcode generation.
CVE-2020-9382
PUBLISHED: 2020-02-24
An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's } parser function.
CVE-2020-1938
PUBLISHED: 2020-02-24
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that ...