The Hacker Will See You Now

More than 1.8 million medical ID theft victims in 2013

That's a 19% increase over last year according to the 2013 Survey on Medical Identity Theft.  More than 300,000 new medical identity theft cases were reported during the one-year period, the study found.  The 4th annual survey, conducted by the Ponemon Institute, defined medical identity theft as a person using an individual's name or personal identity “to fraudulently receive medical service, prescription drugs and goods, including attempts to commit fraudulent billing.”

One of the biggest contributors to the increase was fake or spoofed medical websites and spam emails.  Medical identity theft victims who reported that a cyber schemes caused their troubles doubled from 4% in 2012 to 8% in 2013.  It is clear that the amount and frequency of spear phishing specifically targeting medical ID theft has gone up.  This is not the simple 'Buy this personal enhancement drug here' emails but authentic looking emails from a provider.  You click the malicious link and either malware is installed to your computer or you are directed to a website that looks exactly like your medical provider's and you enter (give away) your credentials there.  You might even be able to log into something that will request you update your personal information.  Perfect, I get your credentials along with some additional Rx information or mailing address or SSN or date of birth anything that I can use to impersonate you.

As far as data breaches as a cause, only 7% (up 1 tick from last year) felt a data breach by their insurer, health care provider or related was linked to the fraud.

A separate but related survey, a new Deloitte report says healthcare organizations are in various stages of mitigating the security risks of medical devices.  These include patient monitors, infusion pumps, ventilators, pacemakers and imaging devices.  Deloitte interviewed the medical device security leaders at nine large hospital systems and they indicated that their organizations have a long way to go and that they need more cooperation from device manufacturers. 

The Food and Drug Administration (FDA) recently released a guidance on the "content of premarket submissions for management of cyber security in medical devices."  The guidance suggested that device makers incorporate security features into their products to limit access to only trusted users, trusted content, and use fail-safe and recovery devices. They want manufacturers to consider threats like hacking, malware and other vulnerabilities of the device's software and to work with providers on addressable scenarios.  This is certainly an area of importance for both providers and the device manufactures.  Remember all the wrangling with PCI and those payment devices?  Granted, the FDA guidance is a recommendation and not a regulation like PCI so there is reluctance to include security measures in purchasing contracts.

The other issue healthcare organizations face is trying to secure older proprietary devices.  These closed systems make it almost impossible to scan for vulnerabilities but they are still in widespread use.  For other devices that run on well know commercial operating systems, they are vulnerable to the same threats that any device with that software has.

Deloitte also asked the medical device security heads where their organizations stood in several areas of cyber security.  These included: organizational leadership, risk framework, identification and evaluation, data flow, vulnerability management, vendor agreements and manufacturer engagement.   Ken Terry over at Information Week goes into detail of each.

So far there have been no documented instances of "intentional threats" to medical devices, according to the report but healthcare providers are not required to report security incidents to the FDA or the device manufacturer unless a death or serious injury has occurred.

ps

 

Related:

• 2013 Survey on Medical Identity Theft
• Medical Device Security: A Work In Progress
• Malware Threatens Medical Device Security
• Networked Medical Device Cybersecurity and Patient Safety: Perspectives of Health Care Information Security Executives
• Lost Records a Day Shows Doctors are Blasé
• Web 2.0 and your Health
• Identity Theft Roundup
• Useful IT. Bringing Health Record Transfer into the 21st Century.

 

Technorati Tags: healthcare,medical,identity theft,vulnerabilities,devices,medical devices,risk,security,fda,silva,malware,phishing

 

Connect with Peter:	Connect with F5:

Interop2013: BIG-IQ Cloud

I meet with Dan Kim, F5 Product Manager for Management Solutions, to learn more about BIG-IQ, BIG-IQ Cloud and the benefits of a management system that can span multiple cloud environments. BIG-IQ Cloud automates and orchestrates the deployment of application delivery services across both traditional and cloud infrastructures.

 

ps

Related:

• Interop2013: Find F5
• Interop2013: DDoS'ing the Interop Network
• Interop2013: F5 Certification Program
• F5's YouTube Channel
• In 5 Minutes or Less Series (23 videos – over 2 hours of In 5 Fun)
• Inside Look Series
• Life@F5

Technorati Tags: f5,interop,big-iq,big-iq cloud,cloud computing,management,security,big-ip,silva,video,interop NOC,vegas,2013

Connect with Peter:	Connect with F5:

Cure Your Big App Attack

Not that I really needed to point his out but, security attacks are moving ‘up the stack.’  90% of security investments are focused on network security, yet according to Gartner, 75% of the attacks are focused at the application layer and ‘over 90 percent of security vulnerabilities exist at the application layer, not the network layer.’  SQL Injection and XSS are #1 and #2 reported vulnerabilities and the top two from the OWASP Top 10.  Plus, from Forrester Consulting, the average loss of revenue per hour for a layer 7 DDoS attack is $220,000.  These vulnerabilities are some of the primary routes that are being exploited in many of the recent attacks.

Modern DoS attacks are distributed, diverse and cross the cavity that divides network components from application infrastructure yet many of these attacks are preventable. The problem is that organizations are using outdated network and/or desktop technology to try and protect against sophisticated application security attacks which traditional solutions like network firewalls, IPS or AV systems have little to no visibility or role. It’s like trying to protect a city against a coordinated air attack by digging trenches in the ground. Wrong band-aid for the attack vector. 

The solution is an integrated approach that covers network and application security along with access control. Another dilemma is that security has often been left up to the network gang who may or may not have expertise in and around the transport and application level exploits.  And deploying more network firewalls, AV, or IPS systems is not really the answer. You might just be digging more trenches.  F5 has technologies like BIG-IP ASM, APM, Edge Gateway and LTM that can help mitigate the recent attacks.  Many of our solutions (particularly ASM) have capabilities to prevent DoS, DDoS, Brute Force, Parameter Tampering (and dynamic parameters), Forceful Browsing, Web Scraping, SlowLoris, Access Control, XSS, SQL Injection and the entire OWASP Top 10.  ASM can also be configured to verify the value of web application set parameters isn’t changed during the user’s session along with ensuring a user has accessed the site via a login page.  With those recent attacks, ASM could have blocked or at least alerted site owners of the intrusion. Detecting and alerting on this when it started, even without mitigating would have considerably minimized the business risk.  BIG-IP LTM can protect you from a network perspective with BIG-IP ASM from an application angle. 

It is interesting that these attacks have been around for a while but also shows how hard it is to get protection right, especially when the attacks are blended.  Once a vector is found to deliver, a variety of exploits can be used in quick succession to find one that will work.  Most of these attacks would also have sailed invisibly through an IPS device – no offense to those solutions – they are just not designed to protect the application layer or didn’t have a signature that matched.  A unified application delivery platform with multi-layer visibility is the best way to detect and mitigate multi-layer attacks.

ps

Resources

• Ongoing storm of cyberattacks is preventable, experts say
• With a click, employees invite a vampire into the network
• DataLossDB
• Codemasters email customers regarding recent security breach
• Thieves Found Citigroup Site an Easy Entry
• Sega Is the Latest Victim, Admits User Accounts Hacked
• Nearly half of firms don't fear hackers
• What Is Next on Hackers' Hit Lists
• Custom Code for Targeted Attacks
• And The Hits Keep Coming
• Unplug Everything!
• The Big Attacks are Back…Not That They Ever Stopped
• Technology Can Only Do So Much

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, phishing, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach, ips

Connect with Peter:	Connect with F5:

Oracle OpenWorld 2010 - Optimize Oracle Database Replication

Peter Silva visits with F5's Chris Akker to discuss & whiteboard F5's solution to Optimize, Accelerate, Secure and Offload Oracle Database Replication with BIG-IP LTM and the WAN Optimization Module (WOM).

ps

Technorati Tags: F5, infrastructure 2.0, integration, Pete Silva, security, business, education, technology, application delivery, cloud, virtualization, oracle, oow

twitter: @psilvas

Audio White Paper - Resource Provisioning - Hardware Virtualization Your Way

BIG‑IP resource provisioning combines the best features of each virtualization model by enabling BIG‑IP LTM modules to run sandboxed without sharing resources, while giving them the ability to dynamical scale if/when needed. Resource provisioning is a new model in hardware virtualization, one that will change the face of application delivery and Application Delivery Controllers moving forward.

 
Download now or listen on posterous

AudioWP_-_Resource_Provisioning_-_Hardware_Virtualization,_Your_Way.mp3 (13816 KB)

ps

twitter: @psilvas

Technorati Tags: F5,DevCentral,BIG-IP,Application Delivery Controllers,Pete Silva

Posted via web from psilva's prophecies

Audio White Paper - Inband Passive Monitors

Application health monitors are now a tried and true technology of the Application Delivery Controller, yet traditional monitors require interaction with the application. Inband passive monitors change that requirement and monitor applications transparently.

  
Download now or listen on posterous

AudioWP_-_Inband_Passive_Monitors_v10_(s).mp3 (9884 KB)

ps

Posted via web from psilva's prophecies