Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
A Mere 8 Days After Breach, Anthem Healthcare Notifies Customers
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/26/2015 | 2:16:49 PM
Re: Quick notice not surprising, considering...
Well, to be fair, it's not his fault that his health plan screwed up.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/25/2015 | 4:55:26 AM
Re: Quick notice not surprising, considering...
@ODA155: Yes, I saw that.  What's more, there's evidence that suggests that other researchers knew about the attack a few months ago (and at least one reported on the suspicious behavior).
Technocrati
50%
50%
Technocrati,
 User Rank: Ninja
2/11/2015 | 11:04:52 AM
Re: Quick notice not surprising, considering...

"...one of the affected customers was Michael Daniel -- the President's chief cybersecurity advisor."

 

How embarrassing.   Amazing when reality ( you don't know what you doing... ) meets fantasy ( everything is under control ).  

Let's see if he keeps his job, probably that seems to be the customary track for "experts" who fall short.

Technocrati
50%
50%
Technocrati,
 User Rank: Ninja
2/11/2015 | 11:00:24 AM
Re: Quick notice not surprising, considering...

@Joe   I am not particularly impressed about the early notice either.  I am sure they have been reading about Sony and all the rest.  80 mil records compromised !  

A new record.

 

Hackers seem to be well ahead of most company "experts".

ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/9/2015 | 1:28:22 PM
Re: Quick notice not surprising, considering...
Brian Krebs is suggesting this hack could have started as far back as April 2014!
GonzSTL
50%
50%
GonzSTL,
 User Rank: Ninja
2/9/2015 | 12:02:06 PM
Re: Quick notice not surprising, considering...
@ODA155: Scary, isn't it? And we wonder why breaches occur ... In all the breaches to date, one glaring fact stands out – a gap in secure computing practices. Of course, that is a classic understatement. Take your post regarding HIPAA and PCI (I am fully aware that encryption is not mandated); they, in and of themselves, do not constitute a fully secure environment. What really gets me is that there are guidelines for these secure practices, and organizations still fail to properly implement them. Personally, I am a big proponent of implementing the SANS Critical Security Controls; properly implemented, they provide a very serious secure computing environment. Take the Anthem breach - although possession of Anthem admin credentials may have negated the security of encryption, a full implementation of Critical Security Control 17 (Data Protection) could have probably saved Anthem. This control specifies the adoption of data encryption, both in transit and at rest. Additionally, it also asks for data loss prevention protection for data in use, motion, and at rest. This control in itself could have possibly mitigated the exfiltration of Anthem data.

Many years ago, the mantra that IT needs to align itself with business goals was the big thing, and for the most part, IT organizations have followed this strategy. I believe the big thing now is that IT security needs to align itself with IT, which by extension, aligns itself with the business goals. This is the message that fails on executive ears; IT security has a communications gap that needs to be fully addressed. One of the main obstacles to achieving this goal is the line of reporting usually governing IT security. Even now, the percentage of IT security reporting to the CIO is too large for comfort. The potential for a violation of the separation of duties to forestall an undesirable result of a conflict of interest is ripe in that environment. I have seen it myself. I have heard many CIOs state that when they have control of, and responsibility for both IT and Security, they are able to make the correct judgment call that serves to benefit the organization as a whole. The fallacy of that line of thought is painfully obvious (see the Target breach), and continues to be supported by C-level executives. That is what needs to stop if IT security is to gain the proper voice and support required to align itself with the business goals of any organization, and provide an effective security environment.
ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/9/2015 | 11:09:00 AM
Re: Quick notice not surprising, considering...
@GonzSTL... I was just preparing this when you posted... All... I need to correct a statement that I made last week. I was under the assumption, as I'm sure that most of us are, that HIPPA and PCI REQUIREs data encryption. I think if anyone has this same assumption as I did, you should look at what I found this weekend when I was "Googling" around.

Since I can't post links in here you'll need to search them yourself.

This question and answer comes directly from U.S. Department of Health & Human Services website.

Is the use of encryption mandatory in the Security Rule?
Answer:
No. The final Security Rule made the use of encryption an addressable implementation specification. See 45 CFR § 164.312(a)(2)(iv) and (e)(2)(ii). The encryption implementation specification is addressable, and must therefore be implemented if, after a risk assessment, the entity has determined that the specification is a reasonable and appropriate safeguard in its risk management of the confidentiality, integrity and availability of e-PHI. If the entity decides that the addressable implementation specification is not reasonable and appropriate, it must document that determination and implement an equivalent alternative measure, presuming that the alternative is reasonable and appropriate. If the standard can otherwise be met, the covered entity may choose to not implement the implementation specification or any equivalent alternative measure and document the rationale for this decision.

Next, Google this phrase... "PCI Data Storage Do's and Don'ts" ... and read the document, it's a pretty short document from the PCI Council and the very first statement says "Requirement 3 of the Payment Card Industry's Data Security Standard (PCI DSS) is to "protect stored cardholder data.""... nowhere in this document does it say that PCI data is REQUIRED to be encrypted, it is "suggested" as an option.

Now I'm sure that the QSA's and other PCI and HIPAA experts will come out here and try to qualify what these statements mean, but I have to say that after reading them it's very clear what they're saying, at least to me it is.
GonzSTL
50%
50%
GonzSTL,
 User Rank: Ninja
2/9/2015 | 11:05:15 AM
Re: Quick notice not surprising, considering...
It is quite scary that Anthem chose not to encrypt their data, but even scarier is that encryption is not required under HIPAA. The most worrisome parts of this breach are that there were queries running with admin privileges, and that the attacker(s) were able to exfiltrate data. One would think that a large provider such as Anthem would have measures in place to detect and prevent this type of activity.
ODA155
50%
50%
ODA155,
 User Rank: Ninja
2/7/2015 | 2:01:33 PM
Re: Quick notice not surprising, considering...
Joe... I just heard a report that said Anthem did NOT encrypt the data...at all! I also read that in an article from WSJ. And... some experts are tying this data breach at anthem, to tax return fraud with TurboTax. Minnesota has suspended accepting any state tax returns from Turbo tax... and over at databreachtoday dot com there is an article, "Anthem Breach: Chinese Hackers Involved?" that is rather interesting.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/7/2015 | 12:28:00 AM
Quick notice not surprising, considering...
Okay, sure, they notified their customers WELL before they were legally obligated, but that's not particularly surprising considering that one of the affected customers was Michael Daniel -- the President's chief cybersecurity advisor.
Page 1 / 2   >   >>


Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21360
PUBLISHED: 2021-03-09
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic ...
CVE-2021-21361
PUBLISHED: 2021-03-09
The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed...
CVE-2021-24033
PUBLISHED: 2021-03-09
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoke...
CVE-2021-21510
PUBLISHED: 2021-03-08
Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary ‘Host’ header values to poison a web-cache or trigger redirections.
CVE-2020-27575
PUBLISHED: 2021-03-08
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation.