Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Ouch! Feeling The Pain Of Cybersecurity In Healthcare
Threaded  |  Newest First  |  Oldest First
Whoopty
Whoopty,
 User Rank: Ninja
8/26/2015 | 7:20:40 AM
Worries
Considering all of the big data breaches at government installations and major corporates as of late, I'm deeply worried that most of our health records have already been copied away by other countries with nefarious intentions. Presumably too, any information sent digitally has also been copied by the NSA and GCHQ, suggesting that our deepest personal medical details can be perused by contractors at these intelligence agencies. 

That makes me very uncomfortable. 
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/26/2015 | 11:43:04 PM
Re: Worries
Better start going to several different doctors and complaining of several different maladies, presenting with different medical histories, to each.  ;)

Of course, then you'd probably have to self-pay.  But then at least China won't really know what your health issues are.  ;)
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
8/28/2015 | 8:05:11 AM
Re: Worries
And if you self-pay, Joe, that's one less database your PII goes in! :-0 
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/29/2015 | 11:37:43 PM
Re: Worries
@Marilyn: This is really an excellent illustration of today's data economy.  Companies ask consumers/individuals for their data, and in exchange they get valuable services, goods, etc.; otherwise, you have to pay a premium.  Self-pay at medical centers and not going through or having health insurance can get to be a pretty steep price indeed for protecting one's data.
Dr.T
Dr.T,
 User Rank: Ninja
8/28/2015 | 7:01:07 PM
Re: Worries
That is not a bad strategy. I bet China would still figure out a way of cloning the person and identifying the health issue in that way. There is always ways to do that. :--))
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/29/2015 | 11:35:43 PM
Re: Worries
@Dr. T: I think you have a viable screenplay idea there.  ;)
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
8/28/2015 | 8:02:26 AM
Re: Worries
Whoopty,I think you are probably right. This is just the tip of the iceberg. We'll be seeing a lot more of this in the coming months.. and years..
Dr.T
Dr.T,
 User Rank: Ninja
8/28/2015 | 7:03:18 PM
Re: Worries
I agree future is more complex than what we see today. There will be improvement on the systems but security vulnerabilities will still be exploited since there will be more complex tools to do that.
Dr.T
Dr.T,
 User Rank: Ninja
8/28/2015 | 7:06:39 PM
Re: Worries
I hear you. Good point. On the other hand self-pay would either go to Apple Pay or Google Pay, and I wonder when we will hear the news that they are compromised.
Dr.T
Dr.T,
 User Rank: Ninja
8/28/2015 | 6:58:53 PM
Re: Worries
It makes me uncomfortable too. We have been hear more vulnerabilities in government systems than private sector. This by itself is a problematic situation. Why would a small private company spend money on security if government does not.
Dr.T
Dr.T,
 User Rank: Ninja
8/28/2015 | 6:55:52 PM
Overall Security strategy
I think its start from top to down: Strategy. Until companies get hit by themselves they do not think it will happen to them and they do not have any real security strategy to start with.

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file