Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Anthem Breach Should Convince Healthcare To Double Down On Security
Newest First  |  Oldest First  |  Threaded View
anzar.hasan@verizon.com
50%
50%
[email protected],
User Rank: Apprentice
2/9/2015 | 11:01:45 AM
Re: Clarification on your statements
I agree with you TMCCAIN800.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/9/2015 | 10:06:35 AM
Re: Its Too Easy to Get Off the Hook
@RiskIQBlogger. I very much agree with your last point. Security vendors are way behind in terms of keeping up with their malicious counterpart. This environment is rapidly changing and we need solutions that have changed with it. Analyzing the most exploited attack vectors is a good start and creating new technologies to alleviate the risk in those vectors. Otherwise making changes to an already inadequate solution will only produce a solution that is less inadequate. In terms of quantifying progress, it could be counterproductive to enhance solutions that have become overly exploitable as time is being wasted that could be spent towards innovation.
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
2/9/2015 | 10:01:46 AM
Anthem Breach Should Convince Healthcare To Double Down On Security
"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," It is a given that the majority of medical providers who connect to this tangled web are woefully understaffed and do not have the budgets to adequately address cyber security. The mistakes of the past should be learned well and not repeated. For instance, remember that the Target breach was accomplished by targeting one of their business partners and from there launched an attack to infiltrate the Target network. Penetrating a small medical provider network should be almost a trivial exercise, and once in as a trusted partner, the attacker can concentrate on attacking the larger organizations in that healthcare web. As that quote above states, a simple configuration oversight will cause the whole web security to unravel.

What about the Affordable Care Act? The huge monstrosity that is now colloquially called "Obamacare" is ripe for a huge security debacle. If you think the Anthem breach is huge, wait until healthcare.gov is breached. That network could potentially include every segment of the healthcare industry, all interconnected in a single place. Now then if the IRS is the instrument of ensuring compliance to the insurance mandate, it stands to reason that somewhere down the line, some form of integration will also be in place to connect healthcare insurance data to the IRS systems. Imagine breaching a network that has not only personal and medical records, but also earnings and financial data for every single wage earner or retiree in this country, accessible within a single interconnected web.

Now maybe I'm just another guy screaming doom and gloom, like Chicken Little. Maybe I should have more trust in the federal government ensuring cyber security in their systems <snicker>. Maybe I should read Alice in Wonderland again, and not worry about this topic at all. This started off as a random thought, but the more I think about it, the more concerned I become. Someone please tell me if I'm totally off base on this subject, and explain why.
Ericka Chickowski
50%
50%
Ericka Chickowski,
User Rank: Moderator
2/9/2015 | 7:52:17 AM
Re: Clarification on your statements
Thanks for the catch on the typo. Took care of it!
TMCCAIN800
100%
0%
TMCCAIN800,
User Rank: Apprentice
2/7/2015 | 10:44:14 AM
Clarification on your statements
Please note for the readers that you should have stated "HITECH" versus "HITRUST". HITECH is a legislative mandate, whereas HITRUST is not. More over, HITRUST is a rigid, and overly complicated, attestation that serves to only distract from the issue. The medical community has a complex IT environment(s) and are typically understaffed. Furthermore, inflated claims on the worth of data that cannot be used in a "not present" transaction only leads the medical leadership to marginalize our consult. Medical data is being breached because it's easy and it retains the same capabilities for identity theft as other, more secure data, and not because someone is trying to get free medical services. Simple economics. If we can move the conversation to ensuring reasonable security is in place, based upon practical risks, we can start seeing better valuation in the board room.
PZav
100%
0%
PZav,
User Rank: Author
2/6/2015 | 2:25:59 PM
Its Too Easy to Get Off the Hook
The sad part about this breach is that healthcare has had ample warning that its a target. In this breach we're not talking about a regional subsidiary either, this is Anthem. 

The good money is that other attacks of this nature are underway in this sector. The only thing anyone seems to be doing about it is improving their PR response post breach. 

Investment into solutions still seems to be standard. Even with overwhelming data, there doesn't seem to be much action. At least nothing being made public. 

We need companies in all sectors to seriously look at their cyber risks and push for innovations to start creating solutions. They should demand new technology and back it up with investment.

Security vendors need to step their game up as well. There needs to be investment in developing solutions that will provide specialized solutions for attack vectors rather than focusing on pushing new devices like firewalls and IDS that will lower risk by .0009% each time a new model comes out.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...