Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Anthem Breach Should Convince Healthcare To Double Down On Security
Oldest First  |  Newest First  |  Threaded View
PZav
100%
0%
PZav,
 User Rank: Author
2/6/2015 | 2:25:59 PM
Its Too Easy to Get Off the Hook
The sad part about this breach is that healthcare has had ample warning that its a target. In this breach we're not talking about a regional subsidiary either, this is Anthem. 

The good money is that other attacks of this nature are underway in this sector. The only thing anyone seems to be doing about it is improving their PR response post breach. 

Investment into solutions still seems to be standard. Even with overwhelming data, there doesn't seem to be much action. At least nothing being made public. 

We need companies in all sectors to seriously look at their cyber risks and push for innovations to start creating solutions. They should demand new technology and back it up with investment.

Security vendors need to step their game up as well. There needs to be investment in developing solutions that will provide specialized solutions for attack vectors rather than focusing on pushing new devices like firewalls and IDS that will lower risk by .0009% each time a new model comes out.
TMCCAIN800
100%
0%
TMCCAIN800,
 User Rank: Apprentice
2/7/2015 | 10:44:14 AM
Clarification on your statements
Please note for the readers that you should have stated "HITECH" versus "HITRUST". HITECH is a legislative mandate, whereas HITRUST is not. More over, HITRUST is a rigid, and overly complicated, attestation that serves to only distract from the issue. The medical community has a complex IT environment(s) and are typically understaffed. Furthermore, inflated claims on the worth of data that cannot be used in a "not present" transaction only leads the medical leadership to marginalize our consult. Medical data is being breached because it's easy and it retains the same capabilities for identity theft as other, more secure data, and not because someone is trying to get free medical services. Simple economics. If we can move the conversation to ensuring reasonable security is in place, based upon practical risks, we can start seeing better valuation in the board room.
Ericka Chickowski
50%
50%
Ericka Chickowski,
 User Rank: Moderator
2/9/2015 | 7:52:17 AM
Re: Clarification on your statements
Thanks for the catch on the typo. Took care of it!
GonzSTL
100%
0%
GonzSTL,
 User Rank: Ninja
2/9/2015 | 10:01:46 AM
Anthem Breach Should Convince Healthcare To Double Down On Security
"Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, it's not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation," It is a given that the majority of medical providers who connect to this tangled web are woefully understaffed and do not have the budgets to adequately address cyber security. The mistakes of the past should be learned well and not repeated. For instance, remember that the Target breach was accomplished by targeting one of their business partners and from there launched an attack to infiltrate the Target network. Penetrating a small medical provider network should be almost a trivial exercise, and once in as a trusted partner, the attacker can concentrate on attacking the larger organizations in that healthcare web. As that quote above states, a simple configuration oversight will cause the whole web security to unravel.

What about the Affordable Care Act? The huge monstrosity that is now colloquially called "Obamacare" is ripe for a huge security debacle. If you think the Anthem breach is huge, wait until healthcare.gov is breached. That network could potentially include every segment of the healthcare industry, all interconnected in a single place. Now then if the IRS is the instrument of ensuring compliance to the insurance mandate, it stands to reason that somewhere down the line, some form of integration will also be in place to connect healthcare insurance data to the IRS systems. Imagine breaching a network that has not only personal and medical records, but also earnings and financial data for every single wage earner or retiree in this country, accessible within a single interconnected web.

Now maybe I'm just another guy screaming doom and gloom, like Chicken Little. Maybe I should have more trust in the federal government ensuring cyber security in their systems <snicker>. Maybe I should read Alice in Wonderland again, and not worry about this topic at all. This started off as a random thought, but the more I think about it, the more concerned I become. Someone please tell me if I'm totally off base on this subject, and explain why.
RyanSepe
50%
50%
RyanSepe,
 User Rank: Ninja
2/9/2015 | 10:06:35 AM
Re: Its Too Easy to Get Off the Hook
@RiskIQBlogger. I very much agree with your last point. Security vendors are way behind in terms of keeping up with their malicious counterpart. This environment is rapidly changing and we need solutions that have changed with it. Analyzing the most exploited attack vectors is a good start and creating new technologies to alleviate the risk in those vectors. Otherwise making changes to an already inadequate solution will only produce a solution that is less inadequate. In terms of quantifying progress, it could be counterproductive to enhance solutions that have become overly exploitable as time is being wasted that could be spent towards innovation.
anzar.hasan@verizon.com
50%
50%
[email protected],
 User Rank: Apprentice
2/9/2015 | 11:01:45 AM
Re: Clarification on your statements
I agree with you TMCCAIN800.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13757
PUBLISHED: 2020-06-01
Python-RSA 4.0 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing exces...
CVE-2020-13758
PUBLISHED: 2020-06-01
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
CVE-2020-9291
PUBLISHED: 2020-06-01
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
CVE-2019-15709
PUBLISHED: 2020-06-01
An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.
CVE-2020-13695
PUBLISHED: 2020-06-01
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file.