Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Healthcare Organizations Twice As Likely To Experience Data Theft
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
UlfM645
50%
50%
UlfM645,
 User Rank: Apprentice
9/25/2015 | 12:30:51 PM
Healthcare is unique
I agree that Medical records are very desirable on the black market, because medical records, themselves, may be a treasure trove of PII, financial information, and insurance numbers."

I think that healthcare is unique in that there are a greater number of people who come in contact with sensitive information during the course of normal business operations than in other industries.

So, when you combine the number of people involved with handling multiple forms of PHI records, along with the immaturity of the data security systems and practices that are in place, there are so many opportunities for mistakes or

intentional breaches to take place.

The attraction of PHI is that its value does not degrade as rapidly as credit card data, which can be changed or updated quickly.

I recently read a study from Aberdeen Group that revealed "a steady increase in enterprise use of tokenization as an alternative to encryption for protecting sensitive data" and that half of the organizations are using data tokenization

for PII and PHI data. The name of the study is "Tokenization Gets Traction".

This is a short list of effective measures that I suggest organizations should take:

1. Fine-grained de-identification of both PII (Personally Identifiable Information) and PHI.
2. Fine-grained tokenization of PHI, to alleviate the need for plain-text data and exposure in-memory across the entire data flow.
3. Strong credentials, including password improvement and rotation, plus separation of duties to prevent privileged users, such as database administrators or system administrators, from accessing sensitive data.
   
Secure the data to the point that it is useless to a potential thief. Modern solutions such as tokenization provide better security than encryption, while retaining usability for analytics and monetization.

Ulf Mattsson, CTO Protegrity
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
9/27/2015 | 11:11:46 PM
Re: Healthcare is unique
Indeed, two years ago, Dell SecureWorks reported that full PHI records netted about $20 per on the black market -- much more valuable than simple credit cards (except high-balance cards and the like).
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
9/29/2015 | 12:33:39 PM
Healthcare privacy
 

Healthcare data is target simply because it is kept private, if it was a public record it would not be  a target.

 

 
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
9/29/2015 | 12:36:47 PM
Re: Healthcare is unique
Agree. It is actually sad that there is a black market on health data. If it was just a public record there would have been much less prpblem.
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
9/29/2015 | 12:39:27 PM
Re: Healthcare is unique
One solution to this problem it to identify players in the black market, if I am guessing I will goes that we may find big insurance companies behind it.
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
9/29/2015 | 12:42:40 PM
Re: Healthcare is unique
One more thing, one way to make it uses for the hackers is to encrypt it at rest, they may get the data but not be able to decrypt and utilize it.  Unless you are NSA of course :--))).
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
9/30/2015 | 9:13:28 PM
Re: Healthcare is unique
> One solution to this problem it to identify players in the black market,

Indeed, that seems to be the perennial goal...

> if I am guessing I will goes that we may find big insurance companies behind it.

...although I don't carry quite the same conspiracy theory.  :)
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
9/30/2015 | 9:15:39 PM
Re: Healthcare is unique
Worth pointing out that encryption at rest, while useful, is hardly a complete solution -- as security pundits pointed out in the wake of the Anthem brouhaha.  After all, if access and keys are compromised, so too is the encryption, and -- with it -- the data.
lynnbr2
50%
50%
lynnbr2,
 User Rank: Strategist
10/1/2015 | 9:57:09 AM
Re: Healthcare is unique
Well, if you want to believe that healthcare is unique, go right ahead if that makes you feel better. But next time you go to the doctor's office or hospital, don't look too closely at that stack of six or nine papers they make you sign before you get to go past that locked door in the waiting room and actually see the doc.

Spoiler alert! Big Data is all about your healthcare records, already. Best that you don't look into MIB, Optum, Milliman, and their ilk, and their associated "members". This means there is already online, daily, trending to near real time, inter-company trading of your healthcare "data."

I like how MIB has a rebuttal statement pre-prepared at their website - cause they're just waiting for you to check them out - "...relying on unverifiable statements that may or may not have been made in the 1970's, 80's and 90's...we ask that you "take them with a grain of salt."" While Millimam's US home page even shows up with a website https certificate error.

Welcome to the 21st century of healthcare.

 
Enrico Fontan
50%
50%
Enrico Fontan,
 User Rank: Strategist
10/1/2015 | 12:03:02 PM
A cost effective approach
I think the article perfectly focused the point:

"The end result is that attackers are far more willing to invest in stealing medical records than healthcare institutions are willing to invest in protecting them from being stolen."

Attackers are always looking for a cost effective approach. Healthcare institutions have to focus on system security and staff training (secure the human) if they plan to minimize such attacks.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Data Breaches Affect the Enterprise
Data breaches continue to cause negative outcomes for companies worldwide. However, many organizations report that major impacts have declined significantly compared with a year ago, suggesting that many have gotten better at containing breach fallout. Download Dark Reading's Report "How Data Breaches Affect the Enterprise" to delve more into this timely topic.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-4020
PUBLISHED: 2021-11-27
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-23654
PUBLISHED: 2021-11-26
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via C...
CVE-2021-43785
PUBLISHED: 2021-11-26
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious...
CVE-2021-43776
PUBLISHED: 2021-11-26
Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other se...
CVE-2021-41243
PUBLISHED: 2021-11-26
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be add...