Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/1/2011
03:37 PM
50%
50%

Tennessee BlueCross BlueShield Encrypts All Its Data

The insurer claims to be first anywhere to encrypt all "at-rest" data across the enterprise, a project that was put on the fast track after an embarrassing data breach.

Healthcare IT Vendor Directory
Slideshow: Healthcare IT Vendor Directory
(click image for larger view and for slideshow)
BlueCross BlueShield of Tennessee (BCBST) claims to be the first private company in the healthcare industry--and possibly in any industry--to encrypt all at-rest data across its entire enterprise, the culmination of a project accelerated by a high-profile data theft nearly two years ago.

Tennessee Blues last week announced the completion of its $6 million encryption effort that included the securing of 885 terabytes of mass data storage, the equivalent of 35,000 single-layer Blu-ray discs, the locking down of 1,000 Windows, AIX, SQL, VMWare, and Xen server hard drives, 6,000 additional workstation and removable hard drives, and 136,000 volumes of backup tape, according to the Chattanooga, Tenn.-based company. BlueCross BlueShield of Tennessee also is securing recordings of 25,000 voice calls per day.

In all, the project took 5,000 hours of work, the company said. "The piece that we think is unique is that we have done all at-rest data in the enterprise," Michael Lawley, BlueCross' VP of technology shared services, told InformationWeek Healthcare. He defined "at-rest" data as anything that can be placed on a storage device. "We searched the country and were unable to find another company that has achieved this level of data encryption."

The company, the largest commercial health insurer in the state, was planning to encrypt many of its data stores, but accelerated and augmented its plan after an October 2009 theft of 57 hard drives from a training facility in Chattanooga. The drives held audio and video recordings of provider and member calls to Blues customer-service representatives, and included personal information on about 1 million insured people, according to the Blues.

"At this point, we have no evidence that any of the data was accessed," said Lawley, who believes that some of his own personal information was on the stolen drives. But the company did take a pounding in the court of public opinion. "Our business is built off trust," Lawley said. Plus, any data loss today would open the company up to greater liability under the tougher HIPAA provisions called for in the 2009 American Recovery and Reinvestment Act.

"What this [theft] did is it sped up a program that we had already started," Lawley said. "We thought it would take three to five years. It took just under two years."

According to Lawley, the encryption encompasses off-the-shelf technology from multiple vendors, with custom engineering by BCBST to assure that there would be little or no performance loss. "When going to encryption," Lawley said, "there's the possibility of performance hits."

He said that the company engineered methods to access the encrypted data in ways that would not slow down authorized users.

"Data encryption is achieved through the use of algorithms, which convert normal, readable information into an indecipherable format, and secure keys, which allow only authorized users to convert the information back into a format they can use. This means that even in the event of a theft or some other security breach, no one would be able to read the data contained on BlueCross hardware, whether it was a computer, server or flash drive," the company said in a press release.

BCBST has posted more information for the public, including a video, at http://www.bcbst.com/data.

Find out how health IT leaders are dealing with the industry's pain points, from allowing unfettered patient data access to sharing electronic records. Also in the new, all-digital issue of InformationWeek Healthcare: There needs to be better e-communication between technologists and clinicians. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.