Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/28/2014
12:23 PM
John B. Dickson
John B. Dickson
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv

What Scares Me About Healthcare & Electric Power Security

Both industries share many of the same issues as enterprises. But they also have a risk profile that makes them singularly unprepared for sophisticated threats

Comment  | 
Print  | 
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
10/28/2014 | 12:41:37 PM
Validation
Working for a healthcare enterprise I can vouch for many of these significant mismatches. Especailly "Too much vendor trust". However, at my organization we are starting to crack down on ensuring Business Associate Agreements are signed that mandate certain measures be performed by vendors that want to do business with us. This along with legal documentation need to be present ensure that vendors are providing due diligence for data security. Vendors are concerned mainly with functionality and due to this, security tends to fall by the wayside. I feel that if vendors are held to higher standards and industry starts cracking down on the stringence of their protocols that the security initiative will be represented much better.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 12:54:20 PM
Re: Validation
Interesting, ryan. What are some of the "measures" you are asking vendors about?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
10/28/2014 | 1:18:15 PM
Re: Validation
Vendors need to receive the same scrutiny that you would provide to your own enteprise. They are handling your data. If they store your data or are connected via VPN, your corporation is taking a risk which needs to be acknowledged. Their compromise and is your compromise. You need to ensure that they follow stringent standards that you hold your own enterprise, to safeguard the data. Cryptology methods need to safeguard data in transit and at rest. Firewalls and DMZ's positioned to secure different severities of data. Active scanning to determine that no outside malicious influence has already circumvented your perimeter. There are many others, but a good template is to follow best security practices for data handling.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/28/2014 | 3:34:30 PM
Re: Validation
Agree completely. During security reviews of potential vendors, I've asked for SAS 70 or SSAE 16 audit results if they have a current one, or a review of their security policies. Surprisingly, one potential vendor we looked into had none of those. Can you believe that? Not even security policies! So of course we expressed a lack of interest, and the next day, they miraculously came up with rudimentary security policies specific to our request. They indicated that they simply adopted the policies of one of their business partners who gave them permission to do so. One little problem – the policies reflected the name of their business partner, and not their own company. I couldn't believe how sloppy they were and naturally, my recommendation was "NO!!!"
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/28/2014 | 3:40:41 PM
public safety
What worries me is that the world outside of our security bubble won't truly take security seriously until there's a tangible attack that affects public safety, etc. The increasingly networked consumer space is bringing this issue to the fore--now it's time for the public to be better informed on this.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
10/28/2014 | 7:08:33 PM
Re: public safety
>now it's time for the public to be better informed on this.

If only the public cared. And for those who do, the healthcare market is so screwed up that it's unlikely consumers will be able to vote with their feet -- they'll have to wait until open enrollment periods to switch providers and then they're likely to face few real choices. And if you're electricity provider is lax in its security, you probably have nowhere else to go.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/29/2014 | 9:03:49 AM
Re: public safety
The theft of personal information in healthcare has been pretty well documented (the prices for PII on the black market are at a record high). But my guess it will ake some life threatening medical event to shake consumer confidence in Healthcare IT -- and spur more serious action . For the power grid, holding a nation to a ransom in order to turn the lights back on is a really scary scenario.
DBAJRACHARYAN/A
50%
50%
DBAJRACHARYAN/A,
User Rank: Apprentice
10/29/2014 | 9:55:04 AM
Accounting standard or security standard?
Is not SAS70 an auditing standard? Are you looking for data security standard or financial stability of the organization?
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/29/2014 | 11:29:30 AM
Re: Accounting standard or security standard?
Yes, SAS 70 is an auditing standard designed to perform an in-depth examination of control objectives and activities. During the performance of this audit by an independent accounting and auditing firm, an organization's written controls are verified by auditing the actual activities related to the controls. These controls also include those specific to Information Technology and related processes. What I wanted to see was whether or not potential business partners actually practiced the controls they had in place, especially those specific to IT.
Ed Telders
50%
50%
Ed Telders,
User Rank: Apprentice
10/29/2014 | 11:41:23 AM
Re: Accounting standard or security standard?
The SAS 70 was sunsetted in 2011 and replaced by the SSAE16 auditing standards.  They come in three flavors in the SOC1, SOC2, and SOC3 audit reports.  For each of them the reports can be a Type 1 or a Type 2.  In a Type 1 the audit simply looks at documentation and assesses them based on policies and statements, the Type 2 is where the controls are actually tested.  Naturally you want the Type 2.  Also the SOC1 is essentially the same as the old SAS 70 in that it is used to measure financial transactions and financial reporting.  Many have used that in the past as a means to assess vendors for security, although the SAS 70/SOC1 was never intended to be a security tool.  It does not assess the CIA triad nor does it look at actual enterprise security, only a subset of that.  The SOC2 Type 2 is the tool you want to look for to actually make a determination of the security posture and maturity of a vendor you're considering.  I would also recommend you review the detailed findings and managment responses to those findings to determine if any of them are of concern to you.  If for example, the audit has a finding detecting servers that are not patched, managment then responds that they have remediated them since the audit field work it sounds pretty reasonable.  Unless the number of servers found unpatched is larger than a reasonable number (ex. 100 out of 500 total) which would indicate a material procedural problem with that vendors processes.  The details can be a gold mine of information that can help you make a solid decision between vendors.  And yes the smaller "boutique" vendors and "startups" frequently haven't created this level of maturity that would be more typical of larger well-established providers, so buyer beware.
Page 1 / 2   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.