Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Anthem Breach Should Convince Healthcare To Double Down On Security
Newest First  |  Oldest First  |  Threaded View
anzar.hasan@verizon.com
[email protected],
 User Rank: Apprentice
2/9/2015 | 11:01:45 AM
Re: Clarification on your statements
I agree with you TMCCAIN800.
RyanSepe
RyanSepe,
 User Rank: Ninja
2/9/2015 | 10:06:35 AM
Re: Its Too Easy to Get Off the Hook
@RiskIQBlogger. I very much agree with your last point. Security vendors are way behind in terms of keeping up with their malicious counterpart. This environment is rapidly changing and we need solutions that have changed with it. Analyzing the most exploited attack vectors is a good start and creating new technologies to alleviate the risk in those vectors. Otherwise making changes to an already inadequate solution will only produce a solution that is less inadequate. In terms of quantifying progress, it could be counterproductive to enhance solutions that have become overly exploitable as time is being wasted that could be spent towards innovation.
GonzSTL
GonzSTL,
 User Rank: Ninja
2/9/2015 | 10:01:46 AM
Anthem Breach Should Convince Healthcare To Double Down On Security
"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," It is a given that the majority of medical providers who connect to this tangled web are woefully understaffed and do not have the budgets to adequately address cyber security. The mistakes of the past should be learned well and not repeated. For instance, remember that the Target breach was accomplished by targeting one of their business partners and from there launched an attack to infiltrate the Target network. Penetrating a small medical provider network should be almost a trivial exercise, and once in as a trusted partner, the attacker can concentrate on attacking the larger organizations in that healthcare web. As that quote above states, a simple configuration oversight will cause the whole web security to unravel.

What about the Affordable Care Act? The huge monstrosity that is now colloquially called "Obamacare" is ripe for a huge security debacle. If you think the Anthem breach is huge, wait until healthcare.gov is breached. That network could potentially include every segment of the healthcare industry, all interconnected in a single place. Now then if the IRS is the instrument of ensuring compliance to the insurance mandate, it stands to reason that somewhere down the line, some form of integration will also be in place to connect healthcare insurance data to the IRS systems. Imagine breaching a network that has not only personal and medical records, but also earnings and financial data for every single wage earner or retiree in this country, accessible within a single interconnected web.

Now maybe I'm just another guy screaming doom and gloom, like Chicken Little. Maybe I should have more trust in the federal government ensuring cyber security in their systems <snicker>. Maybe I should read Alice in Wonderland again, and not worry about this topic at all. This started off as a random thought, but the more I think about it, the more concerned I become. Someone please tell me if I'm totally off base on this subject, and explain why.
Ericka Chickowski
Ericka Chickowski,
 User Rank: Moderator
2/9/2015 | 7:52:17 AM
Re: Clarification on your statements
Thanks for the catch on the typo. Took care of it!
TMCCAIN800
TMCCAIN800,
 User Rank: Apprentice
2/7/2015 | 10:44:14 AM
Clarification on your statements
Please note for the readers that you should have stated "HITECH" versus "HITRUST". HITECH is a legislative mandate, whereas HITRUST is not. More over, HITRUST is a rigid, and overly complicated, attestation that serves to only distract from the issue. The medical community has a complex IT environment(s) and are typically understaffed. Furthermore, inflated claims on the worth of data that cannot be used in a "not present" transaction only leads the medical leadership to marginalize our consult. Medical data is being breached because it's easy and it retains the same capabilities for identity theft as other, more secure data, and not because someone is trying to get free medical services. Simple economics. If we can move the conversation to ensuring reasonable security is in place, based upon practical risks, we can start seeing better valuation in the board room.
PZav
PZav,
 User Rank: Author
2/6/2015 | 2:25:59 PM
Its Too Easy to Get Off the Hook
The sad part about this breach is that healthcare has had ample warning that its a target. In this breach we're not talking about a regional subsidiary either, this is Anthem. 

The good money is that other attacks of this nature are underway in this sector. The only thing anyone seems to be doing about it is improving their PR response post breach. 

Investment into solutions still seems to be standard. Even with overwhelming data, there doesn't seem to be much action. At least nothing being made public. 

We need companies in all sectors to seriously look at their cyber risks and push for innovations to start creating solutions. They should demand new technology and back it up with investment.

Security vendors need to step their game up as well. There needs to be investment in developing solutions that will provide specialized solutions for attack vectors rather than focusing on pushing new devices like firewalls and IDS that will lower risk by .0009% each time a new model comes out.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &acirc;&euro;&tilde;pec_coupon[code]&acirc;&euro;&trade; parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&amp;date_from=2023-02-17&amp;date_to=2023-03-17 of the component Report Handler. The manipula...