Anthem Breach Should Convince Healthcare To Double Down On Security

Mega breach brings focus back on inadequacies of healthcare security.

As the fallout continues to emerge around a breach of tens of millions of records held by Anthem, security pundits hope itll shine a spotlight on the weaknesses in healthcare cybersecurity. They believe this mega breach is just the start of a trend of increasingly larger healthcare breaches as attackers move from harder-to-attack financial targets to still-lucrative lower-hanging fruit. And with so many stores of valuable patient information, an industry based in information-sharing among large and small businesses and a culture that doesnt prioritize IT security, healthcare is a very juicy piece of fruit.
Healthcare organizations make for attractive targets, not just for the health and medical information they store—which is as much as 10 times as valuable as credit card numbers on the black market due to the opportunity for insurance fraud—but also for the reams of other data they collect for identification and payment purposes.
The other personal data they collect, like social security numbers, are very valuable to criminals, says Tim Erlin, director of IT security and risk strategy for Tripwire.
This is hardly a new revelation—healthcare breaches have consistently contributed disproportionately to the overall breach toll across industries. According to the Identity Theft Resource Center, for the past three years, the number of breaches in the healthcare industry have outpaced those in other industries, with healthcare organizations making up 43 percent of breaches in 2014. But the Anthem breach may be a red flag for bigger, more harmful breaches in healthcares future. The typical healthcare breaches have been within smaller organizations and often didnt top more than 100,000 records. Prior to the Anthem breach, which could affect 80 million individuals, the worst case was a compromise last year of 4.5 million records held by Community Health Systems in Tennessee.
But the small-potatoes healthcare breaches may be growing much larger as attackers start poking around within healthcares numerous soft spots.
As banks spend more on IT security, they naturally become more difficult targets for hackers, explains John Gunn, vice president of communications for VASCO Data Security International. As banks become more secure, alternative targets such as healthcare and insurance providers become much more attractive targets for hackers.
Meanwhile, healthcare organizations still arent prioritizing security, says Andrew Hicks, healthcare practice director for Coalfire, who believes that many healthcare executives view HIPAA and HITECH security mandates as optional due to an inconsistent track record of enforcement.
Given the fact that the Office for Civil Rights (OCR) is under budgeted and understaffed, their role is more focused on reactionary measures, including breach investigation and enforcement activities. As a result, their preventative activities, such as the 2011 and 2014 audit programs, are consistently delayed, Hicks says. This has given healthcare organizations the perception that the OCR is soft and compliance initiatives are optional. In my opinion, the OCR should team with independent assessor organizations to perform mandatory assessments on an annual basis.
And even when large healthcare organizations do prioritize security, the bad guys can still find lots of footholds to start large-scale attacks against them due to the way that healthcare organizations do business with one another, says Ivan Shefrin, vice president of security solutions for TaaSera.
The health insurance industry reflects a deeply interconnected web of companies, including hospitals, doctors, practices, secondary insurance providers, and government programs like Medicare and Medicaid, he says. Most large companies in the insurance payment sector have a strong team of in-house cyber security exports. However, the majority of companies with which they connect are small, understaffed with limited budgets for cyber security.
For example, in one assessment his firm did with a healthcare provider, they found that its primary database for patient records was under attack through an exploit in a remote desktop protocol on a system operated by the vendor responsible for the patient medical records application it used.
Given the tangled web of connections among healthcare service organizations, payment, and insurance providers, its not hard to see how a simple configuration oversight can lead to a major data breach and HIPAA violation, Shefrin says.
Its why healthcare needs to rededicate its efforts to move beyond compliance alone and start working on the fundamentals of security.
Healthcare companies should be especially vigilant about implementing the critical security controls outlined by SANS institute, says Craig Young, senior security researcher for Tripwire. In my opinion, companies with such vast loads of confidential information should also perform no-holds-barred red team penetration testing on a regular basis to proactively identify and reinforce the weak spots in their infrastructure. Many high-profile breaches could have been avoided with better employee education regarding recognizing and reporting social engineering strategies.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Anthem Breach Should Convince Healthcare To Double Down On Security