Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Healthcare Organizations Twice As Likely To Experience Data Theft
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
9/27/2015 | 11:11:46 PM
Re: Healthcare is unique
Indeed, two years ago, Dell SecureWorks reported that full PHI records netted about $20 per on the black market -- much more valuable than simple credit cards (except high-balance cards and the like).
UlfM645
50%
50%
UlfM645,
User Rank: Apprentice
9/25/2015 | 12:30:51 PM
Healthcare is unique
I agree that Medical records are very desirable on the black market, because medical records, themselves, may be a treasure trove of PII, financial information, and insurance numbers."

I think that healthcare is unique in that there are a greater number of people who come in contact with sensitive information during the course of normal business operations than in other industries.

So, when you combine the number of people involved with handling multiple forms of PHI records, along with the immaturity of the data security systems and practices that are in place, there are so many opportunities for mistakes or

intentional breaches to take place.

The attraction of PHI is that its value does not degrade as rapidly as credit card data, which can be changed or updated quickly.

I recently read a study from Aberdeen Group that revealed "a steady increase in enterprise use of tokenization as an alternative to encryption for protecting sensitive data" and that half of the organizations are using data tokenization

for PII and PHI data. The name of the study is "Tokenization Gets Traction".

This is a short list of effective measures that I suggest organizations should take:

1. Fine-grained de-identification of both PII (Personally Identifiable Information) and PHI.
2. Fine-grained tokenization of PHI, to alleviate the need for plain-text data and exposure in-memory across the entire data flow.
3. Strong credentials, including password improvement and rotation, plus separation of duties to prevent privileged users, such as database administrators or system administrators, from accessing sensitive data.
   
Secure the data to the point that it is useless to a potential thief. Modern solutions such as tokenization provide better security than encryption, while retaining usability for analytics and monetization.

Ulf Mattsson, CTO Protegrity
<<   <   Page 2 / 2


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20034
PUBLISHED: 2021-09-27
An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
CVE-2021-20035
PUBLISHED: 2021-09-27
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
CVE-2021-41097
PUBLISHED: 2021-09-27
aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be...
CVE-2021-23445
PUBLISHED: 2021-09-27
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
CVE-2021-36134
PUBLISHED: 2021-09-27
Out of bounds write vulnerability in the JPEG parsing code of Netop Vision Pro up to and including 9.7.2 allows an adjacent unauthenticated attacker to write to arbitrary memory potentially leading to a Denial of Service (DoS).