Tag: Data breach

BAI Security Compromise Assessment

Unseen Consequences: The Ripple Effects of a Data Breach

A data breach results in some obvious, immediate impacts. Your customers’ and/or patients’ data is exposed, for one. Even if you don’t lose their business, there will likely be some fences to mend to regain their trust. However, what often gets lost in the aftermath of significant breaches is the ripple effect these attacks can have on all levels of your business. These ripples are currently shaking an in-transition Yahoo to its core. Market Loss As you’ve probably heard, Yahoo recently announced that at least 500 million user accounts were breached in a late 2014 attack, making it potentially one of the largest cyber breaches ever. This news came at a particularly bad time, as Verizon was willing to bid

Read More »
Data breach

When Your Customers Suffer: The Banner Health Breach

According to Bank Info Security, Arizona-based Banner Health recently suffered a breach large enough to notify their 3.7 million customers. Banner, which operates 29 hospitals, discovered the attack on July 7th. The attackers gained access through payment card processing systems in some of their food and beverage outlets, after doing so the attackers also found a  door left open allowing access to  clients’ healthcare information. As Bank Info Security notes, the hack “exposed cardholders’ names, card numbers, expiration dates and verification codes as the data was being routed through the affected systems. Cards used at affected outlets between June 23 and July 7 were affected. Card transactions used to pay for medical services were not affected.” The full list of

Read More »
Compliance

The Cost of Lacking Security: OHSU HIPAA Settlement

One data breach is enough to wreak havoc on any organization. The damage one could do to your relationship with customers could be catastrophic for your business, and the fallout can cause you to rethink your entire security strategy. To add insult to injury, there are also typically steep financial penalties. Healthcare Info Security recently reported on data breaches suffered by Oregon Health & Science University (OHSU) and the HIPAA settlement they will have to pay. OHSU now owes $2.7 million stemming from two 2013 data breaches that affected over 7,066 individuals. One breach involved the theft of an unencrypted laptop from a surgeon’s rental vacation home, while the other was from OHSU using a cloud storage system without the

Read More »
Assessment

Securing Government Systems

A new report released today from the software security firm Veracode contained alarming news about the data security practices of many federal agencies. Veracode’s business is auditing the source code of applications for security vulnerabilities. The report documents 208,670 application scans conducted over 18 months for the company’s private and government customers. An analysis of the prevalence of security issues within software code, the application’s compliance with basic best security standards, and how frequently customers updated or fixed flawed applications are included in the report. The study found that Web applications in use by federal agencies failed to comply with security standards 76 percent of the time. By contrast, financial service companies are in compliance a comforting-only-by-comparison 42 percent of

Read More »

Insights From Verizon’s Data Breach Investigations Report

In early spring, while many people are anticipating the return of warm weather and blue skies, the information security industry is looking forward to the release of Verizon’s annual Data Breach Investigations Report (DBIR). Published since 2008, DBIR is a data security reference guide, playbook and bible. Global in scope, the report analyzes thousands of confirmed data breaches and security incidents, sorts out the trends, and provides best practice guidance that informs the industries’ approach to cyberthreats and digital security. This year’s report includes the obligatory alarming statistics, among the most eye-opening being that in 60 percent of investigated incidents attackers were able to compromise a target network within minutes. Equally interesting, the majority of the 79,790 incidents and 2,122

Read More »
BAI Security Audit

Key Takeaways from Interop

Security was on everyone’s mind at this year’s Interop Las Vegas conference, with workshops ranging from insider threats to social engineering, supply chains and managing targeted attacks. One key point that emerged from all of the discussion was that businesses and governments need to understand the motivations of cyber attackers. Dmitri Alperovitch led the INTEROP workshop which was focused solely on the benefits of knowing your enemy. The days when security was a matter of “merely” battling cyber criminals and young hackers out for a joyride are over. Today, we also have cyberespionage, hacktivists and state-sponsored hacking to contend with as well. Seems that everyone is exploiting digital to gain even the tiniest edge in business or politics. Given these

Read More »
Attack

Securing Billions of Smart Things

There are roughly 25 billion smart devices and objects busily gathering data and beaming information back to their respective motherships (and business partners).  That’s up from 7 billion things a mere five years ago. And five years from now? The consensus is 50 billion things will be interconnected, merrily gathering data, and making our lives easier/transforming the world into a marketer’s magic kingdom. The US Federal Trade Commission (FTC) has signaled its strong interest in bringing privacy enforcement to the so-called Internet of Things (IoT), with the release of its “voluntary standards” report this week.  We put those two works inside quotes because while the standards are voluntary right now, it’s a safe bet that they will be used in

Read More »
Cyber Insurance

DOES YOUR ORGANIZATION NEED CYBER INSURANCE?

News about the damage associated with the Sony breach keep coming, and is most likely going to reach new heights over the Christmas break. Meanwhile, criminals keep conducting immensely successful hack attacks against huge brands that should have the financial assets and talent to protect against breaches. Has this risk management gone very wrong — accepting the occasional hack attack as a cost of doing business — or are we fighting a war we can’t win? We know that data/networks can and should be secured more effectively. While no security system will ever be 100% bulletproof, there are glaring bad practice issues in all of the recent high-profile breaches. We’ll look at why this might be happening in a follow-up

Read More »
Compliance

PROTECTING ELECTRONIC HEALTHCARE DATA: THE NEW REALITIESTA

Almost half of all identity thefts in the U.S. are now stolen medical records, as reported by USA Today. While breaches of credit card data may grab the headlines (like last year’s fiasco at Target stores), a stolen credit card number usually reflects fraud quickly and can be cancelled rapidly. By contrast, a single patient’s full electronic medical record (EMR) typically includes the “identity theft trifecta” — birth date, Social Security number and home address — as well as their detailed medical history, which can be discreetly used (over months or years) to bill bogus medical charges or obtain prescription drugs which are regularly trafficked on the black market. As a result, the estimated “street price” of stolen EMRs can now be

Read More »