Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/26/2008
11:59 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Security Breach: More Laws Needed. Let's Add Health Care

Earlier this week, colleague Thomas Claburn covered the unfortunate trend that the tally of data breaches this year already has surpassed all breaches recorded for the entire year in 2007. This isn't entirely bad news, as I'll explain.

Earlier this week, colleague Thomas Claburn covered the unfortunate trend that the tally of data breaches this year already has surpassed all breaches recorded for the entire year in 2007. This isn't entirely bad news, as I'll explain.From the story, "This Year's Data Breaches Surpass 2007 Totals":

With four months to go in 2008, the number of data breaches on the Identity Theft Resource Center's 2008 breach list has already surpassed the 446 breaches reported by the organization for all of 2007.

As of the morning of Aug. 22, the number of data breaches reported had reached 449.

I agree with much of what the story goes on to say, especially that auditors are finding more breaches today than ever before. There are more eyes looking at IT systems now: internal security teams and auditors, as well as external auditors and business partners. And, as a result of this first database breach disclosure law, and the many similar state laws that followed, the public finally got a view into the severity of the data security program, and how poorly the applications, networks, and systems that store and manage their information are designed, coded, and maintained.

Yet, these publicly disclosed breaches are like light waves: we're only seeing a small part of the spectrum of breaches occurring every year.

From the same story:

The Identity Theft Resource Center points out that the actual number of breaches this year is probably higher than 449 so far because of underreporting and because breaches affecting multiple businesses tend to be reported as a single event. According to the ITRC, in 40% of breach events, the number of records affected is not reported or fully disclosed.

In June, following the release of a Verizon Business Security survey about data breaches, Bryan Sartin, VP of investigative response at Verizon, told InformationWeek that publicly reported breaches are "just the tip of iceberg." He said that less than 5% of the more than 500 cases covered in the Verizon study involved some form of disclosure.

In any event, it appears that hard numbers about data breaches are hard to come by. According to survey of about 300 attendees at this year's RSA Conference, more than 89% of security incidents went unreported in 2007.

This is why we need more data breach disclosure laws -- laws that go beyond financial account information. For instance, health care-related information is much more sensitive than financial information, and it would be great if Web sites had to report to visitors (as many as they can) that their site was compromised and spreading malware, like password sniffing Trojans. But under current law, there's no reason for them to tell anyone.

But let's just stick to health care. More than 1.5 million patient records at hospitals have been exposed by data breaches during 2006 and 2007, according to the 2008 HIMSS Analytics Report: Security of Patient Data, commissioned by Kroll Fraud Solutions. That begs the question: is the health care industry doing enough to protect the privacy of medical records?

The symptoms point to a diagnosis of no. According to the HIMSS report, those 1.5 million data leak victims don't include breaches at other health care companies, home care providers, physician offices, or pharmaceutical companies. So this report is likely only giving us a peak at a sliver of the problem.

If that doesn't send your blood pressure up, consider this: the hospitals surveyed are probably only aware of a small percentage of how many patients have been affected by lax hospital security, as only about 44% of hospitals that suffered a breach failed to let the patients know their records could be at risk to snoops.

Even more disturbing is what the hospitals didn't say: all of the hospitals that disclosed being breached mostly cited unauthorized use of information and wrongful access of paper records. None reported having been hacked. The odds are that that's simply not the reality: "Noticeably absent are breach sources associated with malicious intent, such as stolen laptops/computers, deliberate acts by unscrupulous employees, etc., supporting the lack of industry focus on fraudulent data breaches that masks the frequency and severity of the problem," the report states.

No doubt. The trouble is, without proper intrusion detection and prevention systems in place, access and database log monitoring, and other controls, most hospitals probably wouldn't know if they were successfully hacked.

There was plenty of silence when it came to financial breaches, prior to July 2003. That's not because banks, credit unions, and retailers weren't being hacked. It's because they weren't required to report any breaches until California enacted SB 1386, which required any company, where California residents were involved, to notify each of these victims if the firm suffered a security incident where certain kinds of financial information was, or could have been, exposed. Today, most states have similar laws in force.

Perhaps it's time the health care industry was forced to do the same.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: They said you could use Zoom anywhere.......
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14483
PUBLISHED: 2020-08-13
A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to corr...
CVE-2020-11733
PUBLISHED: 2020-08-13
An issue was discovered on Spirent TestCenter and Avalanche appliance admin interface firmware. An attacker, who already has access to an SSH restricted shell, can achieve root access via shell metacharacters. The attacker can then, for example, read sensitive files such as appliance admin configura...
CVE-2020-13281
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature
CVE-2020-13286
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery.
CVE-2020-15925
PUBLISHED: 2020-08-13
A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary SQL commands via the TPF_XPAR1 parameter.