Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Anthem Breach Should Convince Healthcare To Double Down On Security
Oldest First  |  Newest First  |  Threaded View
PZav
PZav,
 User Rank: Author
2/6/2015 | 2:25:59 PM
Its Too Easy to Get Off the Hook
The sad part about this breach is that healthcare has had ample warning that its a target. In this breach we're not talking about a regional subsidiary either, this is Anthem. 

The good money is that other attacks of this nature are underway in this sector. The only thing anyone seems to be doing about it is improving their PR response post breach. 

Investment into solutions still seems to be standard. Even with overwhelming data, there doesn't seem to be much action. At least nothing being made public. 

We need companies in all sectors to seriously look at their cyber risks and push for innovations to start creating solutions. They should demand new technology and back it up with investment.

Security vendors need to step their game up as well. There needs to be investment in developing solutions that will provide specialized solutions for attack vectors rather than focusing on pushing new devices like firewalls and IDS that will lower risk by .0009% each time a new model comes out.
TMCCAIN800
TMCCAIN800,
 User Rank: Apprentice
2/7/2015 | 10:44:14 AM
Clarification on your statements
Please note for the readers that you should have stated "HITECH" versus "HITRUST". HITECH is a legislative mandate, whereas HITRUST is not. More over, HITRUST is a rigid, and overly complicated, attestation that serves to only distract from the issue. The medical community has a complex IT environment(s) and are typically understaffed. Furthermore, inflated claims on the worth of data that cannot be used in a "not present" transaction only leads the medical leadership to marginalize our consult. Medical data is being breached because it's easy and it retains the same capabilities for identity theft as other, more secure data, and not because someone is trying to get free medical services. Simple economics. If we can move the conversation to ensuring reasonable security is in place, based upon practical risks, we can start seeing better valuation in the board room.
Ericka Chickowski
Ericka Chickowski,
 User Rank: Moderator
2/9/2015 | 7:52:17 AM
Re: Clarification on your statements
Thanks for the catch on the typo. Took care of it!
GonzSTL
GonzSTL,
 User Rank: Ninja
2/9/2015 | 10:01:46 AM
Anthem Breach Should Convince Healthcare To Double Down On Security
"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," It is a given that the majority of medical providers who connect to this tangled web are woefully understaffed and do not have the budgets to adequately address cyber security. The mistakes of the past should be learned well and not repeated. For instance, remember that the Target breach was accomplished by targeting one of their business partners and from there launched an attack to infiltrate the Target network. Penetrating a small medical provider network should be almost a trivial exercise, and once in as a trusted partner, the attacker can concentrate on attacking the larger organizations in that healthcare web. As that quote above states, a simple configuration oversight will cause the whole web security to unravel.

What about the Affordable Care Act? The huge monstrosity that is now colloquially called "Obamacare" is ripe for a huge security debacle. If you think the Anthem breach is huge, wait until healthcare.gov is breached. That network could potentially include every segment of the healthcare industry, all interconnected in a single place. Now then if the IRS is the instrument of ensuring compliance to the insurance mandate, it stands to reason that somewhere down the line, some form of integration will also be in place to connect healthcare insurance data to the IRS systems. Imagine breaching a network that has not only personal and medical records, but also earnings and financial data for every single wage earner or retiree in this country, accessible within a single interconnected web.

Now maybe I'm just another guy screaming doom and gloom, like Chicken Little. Maybe I should have more trust in the federal government ensuring cyber security in their systems <snicker>. Maybe I should read Alice in Wonderland again, and not worry about this topic at all. This started off as a random thought, but the more I think about it, the more concerned I become. Someone please tell me if I'm totally off base on this subject, and explain why.
RyanSepe
RyanSepe,
 User Rank: Ninja
2/9/2015 | 10:06:35 AM
Re: Its Too Easy to Get Off the Hook
@RiskIQBlogger. I very much agree with your last point. Security vendors are way behind in terms of keeping up with their malicious counterpart. This environment is rapidly changing and we need solutions that have changed with it. Analyzing the most exploited attack vectors is a good start and creating new technologies to alleviate the risk in those vectors. Otherwise making changes to an already inadequate solution will only produce a solution that is less inadequate. In terms of quantifying progress, it could be counterproductive to enhance solutions that have become overly exploitable as time is being wasted that could be spent towards innovation.
anzar.hasan@verizon.com
[email protected],
 User Rank: Apprentice
2/9/2015 | 11:01:45 AM
Re: Clarification on your statements
I agree with you TMCCAIN800.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35606
PUBLISHED: 2022-08-18
A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameter 'customerCode.'
CVE-2022-35598
PUBLISHED: 2022-08-18
A SQL injection vulnerability in ConnectionFactoryDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter username.
CVE-2022-35599
PUBLISHED: 2022-08-18
A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter productcode.
CVE-2022-35601
PUBLISHED: 2022-08-18
A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt.
CVE-2022-35602
PUBLISHED: 2022-08-18
A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter user.