Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Healthcare Organizations Twice As Likely To Experience Data Theft
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/11/2015 | 8:16:13 PM
Re: A cost effective approach
"Attackers are always looking for a cost effective approach."

Indeed, security research indicates that attackers -- like "defenders" -- are lazy, and constantly recycle code.  One security research company in Israel focuses on using predictive analytics to predict -- and defend against -- new attacks based upon old attacks and old malware and old software.
lynnbr2
50%
50%
lynnbr2,
User Rank: Strategist
10/1/2015 | 1:22:21 PM
Re: A cost effective approach
I agree the article "perfectly focused the point," and it was in the very first sentence where Sara said that "healthcare not very willing to invest in defending it."

Look, if I'm the CIO or CISO and I go the CEO and say "the state of our security is an unknown-unknown" (to channel Don Rumsfeld), I'll likely be replaced in the next quarter after the CEO's executive search committee comes back with some candidates. Ok, suppose the CEO is a good guy, and allows the CISO to continue. (I'll defer the discussion of just how many CEOs are good guys to Matthew 19:24?) So next the CISO has to tell the CEO just how large a honeypot of $ he needs to secure things, and over what time period. Then the CEO has to get buy-in from the rest of the C-suite and the board. But time flies, and that money is spent and gone now, and regardless of whether the CISO squashed 15 vulns, 150 vulns, or 500 vulns, the state of security is still an unknown-unknown? Well, for sure the executive search committee is getting back in session. The CEO isn't ready yet to add this new, never ending, ever expanding cost into the companies' 10-K statements, when legal is telling him they're covered. One persons cost effective approach is another persons business tax.

 
Enrico Fontan
50%
50%
Enrico Fontan,
User Rank: Strategist
10/1/2015 | 12:03:02 PM
A cost effective approach
I think the article perfectly focused the point:

"The end result is that attackers are far more willing to invest in stealing medical records than healthcare institutions are willing to invest in protecting them from being stolen."

Attackers are always looking for a cost effective approach. Healthcare institutions have to focus on system security and staff training (secure the human) if they plan to minimize such attacks.
lynnbr2
50%
50%
lynnbr2,
User Rank: Strategist
10/1/2015 | 9:57:09 AM
Re: Healthcare is unique
Well, if you want to believe that healthcare is unique, go right ahead if that makes you feel better. But next time you go to the doctor's office or hospital, don't look too closely at that stack of six or nine papers they make you sign before you get to go past that locked door in the waiting room and actually see the doc.

Spoiler alert! Big Data is all about your healthcare records, already. Best that you don't look into MIB, Optum, Milliman, and their ilk, and their associated "members". This means there is already online, daily, trending to near real time, inter-company trading of your healthcare "data."

I like how MIB has a rebuttal statement pre-prepared at their website - cause they're just waiting for you to check them out - "...relying on unverifiable statements that may or may not have been made in the 1970's, 80's and 90's...we ask that you "take them with a grain of salt."" While Millimam's US home page even shows up with a website https certificate error.

Welcome to the 21st century of healthcare.

 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
9/30/2015 | 9:15:39 PM
Re: Healthcare is unique
Worth pointing out that encryption at rest, while useful, is hardly a complete solution -- as security pundits pointed out in the wake of the Anthem brouhaha.  After all, if access and keys are compromised, so too is the encryption, and -- with it -- the data.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
9/30/2015 | 9:13:28 PM
Re: Healthcare is unique
> One solution to this problem it to identify players in the black market,

Indeed, that seems to be the perennial goal...

> if I am guessing I will goes that we may find big insurance companies behind it.

...although I don't carry quite the same conspiracy theory.  :)
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:42:40 PM
Re: Healthcare is unique
One more thing, one way to make it uses for the hackers is to encrypt it at rest, they may get the data but not be able to decrypt and utilize it.  Unless you are NSA of course :--))).
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:39:27 PM
Re: Healthcare is unique
One solution to this problem it to identify players in the black market, if I am guessing I will goes that we may find big insurance companies behind it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:36:47 PM
Re: Healthcare is unique
Agree. It is actually sad that there is a black market on health data. If it was just a public record there would have been much less prpblem.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2015 | 12:33:39 PM
Healthcare privacy
 

Healthcare data is target simply because it is kept private, if it was a public record it would not be  a target.

 

 
Page 1 / 2   >   >>


7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...