Governance , HIPAA/HITECH , IT Risk Management

Bipartisan healthcare legislation that a Senate health committee passed on Wednesday includes a provision that would incentivize healthcare entities to adopt "strong cybersecurity practices" by encouraging federal regulators to consider organizations' security efforts when making HIPAA enforcement decisions.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

The Health, Education, Labor and Pensions Committee voted 20 to 3 to approve the Lower Health Care Costs Act of 2019, which includes a package of 54 proposals from 65 senators, including 36 Democrats and 29 Republicans.

"I hope we can present [this bill] to Majority Leader [Mitch] McConnell, R-Ky., and Minority Leader [Chuck] Schumer, D-N.Y., for the full Senate to consider next month and would expect that other committees will have their own contributions," said Senate health committee chairman Lamar Alexander, R-Tenn., in a statement about the passage of the bill.

The bill primarily aims to provide patients with more transparency about the cost and quality of healthcare services, including an end to "surprise" healthcare bills.

Putting in the Effort

Among provisions included in a section of the bill that focuses on health information exchange is a proposal for the Department of Health and Human Services to "recognize" the security efforts of healthcare entities when enforcing HIPAA.

The provision calls for incentivizing healthcare entities "to adopt strong cybersecurity practices by encouraging the secretary of HHS to consider entities' adoption of recognized cybersecurity practices when conducting audits or administering fines related to the HIPAA Security Rule."

Legal experts are weighing in on the potential impact of that provision.

"I don't think it would lead to a significant change in enforcement, but it certainly would further incentivize organizations to adopt comprehensive information security frameworks," says privacy attorney Adam Greene of the law firm Davis Wright Tremaine.

"Historically, HHS's Office for Civil Rights has only sought financial enforcement in a small minority of cases where OCR perceives that there are widespread, systematic failures, and OCR generally does not pursue the maximum penalties available to them. This would likely continue to be the case."

The bill, if enacted, would require OCR to develop regulations on how to recognize when a HIPAA covered entity or business associate has adequately demonstrated that it had put into place information security practices that would merit OCR's consideration when the agency is conducting a compliance review or audit, notes privacy attorney David Holtzman of the security consulting firm CynergisTek.

"The goal is to incentivize organizations to go beyond the floor of requirements set by the HIPAA Security Rule by putting into place the recognized guidelines developed by the National Institute of Standards and Technology cybersecurity framework and the best practice approaches developed by the [federal advisory] CISA 405(d) workgroup," he says.

Free Pass, or Not?

Privacy attorney Kirk Nahra of the law firm WilmerHale says the provision potentially could have a positive impact.

"This is a perfectly reasonable way to try to encourage companies to adopt one of these meaningful [cybersecurity] frameworks to demonstrate security compliance," he says.

"It is something that HHS certainly would consider in practice today, but this encouragement certainly helps. However, even if it were to be adopted, I doubt it would end up being a free pass, but it would be part of the overall opportunity to demonstrate appropriate security compliance."

Further assessing the provision's potential impact, Nahra adds: "If it results in better security compliance, that is good for everyone. But I doubt it will make much enforcement difference overall in how OCR looks at cases."

Indeed, OCR already takes into consideration an organization's security program when it considers HIPAA enforcement action, says Kate Borten, president of privacy and security consulting firm The Marblehead Group.

"OCR recognizes that having strong security and privacy programs can't eliminate all risk of breach, and OCR doesn't penalize organizations in such circumstances," she notes. "However, most often, breaches occur when organizations are not doing an adequate job. This proposed legislation could suggest to some organizations that they have a 'get out of jail free' card."

Other Provisions

Other provisions in the legislation include a proposal for HHS's Centers for Medicare and Medicaid Services to require commercial health insurers to make information - including health insurance claims data, in-network practitioners and expected out-of-pocket costs - available to patients through application programming interfaces.

The requirement, which is designed to provide consumers with more information to use when selecting a health insurance plan, also "emphasizes that all existing privacy and security protections for patient health data under HIPAA and state laws apply."

Another provision calls for the Government Accountability Office to conduct a study "on the privacy and security risks of electronic transmission of individually identifiable health information to and from entities not covered by HIPAA."

A GAO study is needed "to better understand existing gaps in privacy and security protections for health information as patients move their information to third parties, such as mobile applications, that are not covered by the HIPAA privacy and security rules," according to the bill.

"Ten years ago, the HITECH Act had a similar requirement for the GAO to address health information that falls outside of HIPAA," Greene says. "This issue only takes on more importance now, as the Office of the National Coordinator for Health IT, CMS and OCR regulations all support consumers obtaining access to health information on apps that fall outside of HIPAA."

Greene notes, however, that the Federal Trade Commission has jurisdiction over information that falls outside of HIPAA.

Slim Chances?

So what's the likelihood that Congress will pass the legislation and the president will sign it?

"I usually bet against anything passing both houses of Congress these days, although this seems like a pretty uncontroversial set of changes," Greene says. "The question is whether the overall legislation will find support, or whether these HIPAA provisions may end up in a different bill."

If the proposal is enacted, organizations would have the potential to avoid OCR's threat of punitive penalties or fines if they invest in building upon the minimum standard of security required by the NIST Cybersecurity Framework and the HIPAA Security Rule, Holtzman notes.

"Healthcare organizations are constantly under attack from bad actors determined to disrupt their operations or unlawfully release patient data that are well-resourced, often much better than our health systems," Holtzman says. "Organizations acting in good faith and applying best practices still face the probability of cyberattacks and the breaches that can result. Recognizing an organization's effort to improve their cyber posture is important and can be more effective than punitive approaches."

Cybercrime , Fraud Management & Cybercrime , Fraud Risk Management

The cyberattack earlier this year against Indian outsourcer Wipro, as well as several of its customers, is part of a much larger, multiyear phishing campaign that involves many more companies used as jumping off points, according to an analysis by the security firm RiskIQ.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

The ultimate goal of the unknown group behind the campaign is not fully understood, but it appears that financial gain, especially through the manipulation of gift cards, is at least a major motivating factor, RiskIQ found.

The attackers' phishing campaign, RiskIQ says, is designed to target retailers, employee rewards programs and other organizations dealing in gift cards. Once they had access, the attackers used money transfer services, clearinghouses and other payment processing services to monetize the data they stole, according to the analysis.

"The actor group's phishing campaign looks to target company employees for the purpose of harvesting user credentials so that the actors can gain direct access to the organizations' infrastructure," Yonathan Klijnsma, head researcher at RiskIQ, tells Information Security Media Group.

"The common targeting profile across all organizations seems to align with specific targeting of gift cards. One hypothesis for this targeting approach is that the actor group is looking to gain access to money outside of traditional financial services," Klijnsma adds.

The group - tentatively named "Cardshark" - behind the campaign prefers to use commercially available open source software as part of its attack and as a way to cover its tracks, RiskIQ researchers determined. The group also uses PowerShell scripts to steal credentials and certificates, according to RiskIQ, which has conducted previous analyses of various skimmer attacks (see: New Skimmer Attack Steals Data From Over 100 E-Commerce Sites).

In addition to Wipro, the attack group targeted Rackspace, possibly in an attempt to use that company's platform and other services to access its customers and third parties, RiskIQ says. Others that appear to have been victimized during this three-year campaign include retailers, such as Best Buy and Staples; employee rewards programs, such as Affinion Group and O.C. Tanner; gift card providers Greendot and BlackHawk Networks; and digital marketing firms SmartFocus and Insideview, among many others, according to RiskIQ.

Multiyear, Multipart Phishing Campaigns

The RiskIQ analysis found that the threat group appears to have started targeting victims in May 2016. During a three-year period, there were at least five separate campaigns that targeted companies in various sectors, including retail; gift card programs; point-of-sale and money transfer services; payment services; loyalty rewards programs; and IT vendors, researchers determined.

These attacks culminated in April, when Wipro, India's third-largest IT outsourcing company, acknowledged that it was investigating a multimonth intrusion and that its systems were being used as jumping-off points for digital phishing expeditions targeting the systems of a least a dozen of its customers.

Blogger Brian Krebs first reported on the Wipro case and brought the issue to the attention of RiskIQ as well as FireEye, which has conducted its own analysis of the attack.

RiskIQ's Klijnsma says that while the targets of the campaign don't seem connected, all touched on the gift card industry in some way, such as supplying the data or the infrastructure to support the financial services used by this particular market.

"Information technology companies were a bit of an outlier in the common gift card connection among all other organizations, but our hypothesis is that since the actor group was mainly targeting North American organization in the early stages of its attacks, Rackspace could be an infrastructure provider for other targets of interest," Klijnsma says. "Additionally, the Krebs reporting notes that once the actor group breached Wipro, they actively targeted Wipro customers associated with gift card infrastructure."

Tools of the Trade

As part of the attack, it appears that the group used legitimate email marketing and analytics tools to help disguise their scheme, according to the RiskIQ report.

At one point, it appears the attackers used some templates and artwork developed by the Swiss penetration testing firm Lucy Security, which markets a platform for organizations to conduct security and phishing-awareness training. In addition, Klijnsma notes that the attackers also appear to have compromised default Lucy SSL certificates as early as May 2016.

While RiskIQ notes that the attackers did not compromise Lucy Security's core software or platform, some of the assertions in the analysis were refuted by the company.

"Lucy Security has previously reported that hackers have copied some artwork from the Lucy phishing simulation software and used the designs as part of their phishing attacks. The hackers did not use the Lucy security platform to deliver these attacks," Lucy Security CEO Colin Bastable says. "Our technology generates unique and traceable links in order to track user susceptibility and awareness training participation. It is a security awareness training platform."

Some of the other legitimate tools that the RiskIQ analysis determined were used during this campaign included ScreenConnect, which can give an attacker remote control access of a computer, and EMOC Remote Installer, which allows for the deployment of any tool across a network.

Through a combination of stolen templates and legitimate tools, the group was able to craft its phishing emails that could avoid detection and security protections within the network and then get unsuspecting employees to click, according to RiskIQ. In most cases, these campaigns lasted only a few days to draw attention away from the attack, the analysis found.

BabyShark and North Korea

While the RiskIQ analysis could not pinpoint a specific sponsor of this group, the report noted one possible tie to techniques previously used by North Korea.

Researchers found that the group used a PowerShell script called BabySharkPro, which had previously been associated with threat actors tied to North Korean threat activity. The RiskIQ analysis, however, concedes this could be a "false flag" to mislead those investigating this particular campaign.

"The only 'connection' to North Korea is the reference to 'Baby Shark,' Klijnsma says. "However, this doesn't mean the Cardshark group is part of a North Korean operation. Baby Shark could even be a false flag to throw off researchers. However, we do note that the size, sophistication and focus of this campaign do rival that of known state-sponsored groups."

Using the BabySharkPro script, the attackers could deploy the credential-stealing tool Mimikatz, which could then gather more data from a victim's computer and allow the group to burrow deeper into the network, RiskIQ found.

Governance , Legacy Infrastructure Security , Security Operations

There tends to be a fair amount of irritation when the internet goes on the blink.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

That certainly was the case Tuesday during an incident that the networking services company Cloudflare described in a blog post as "a small heart attack."

Unsurprisingly, the problem revolved around Border Gateway Protocol, or BGP, the delicate protocol that stiches thousands of autonomous systems, or in laymen's terms, networks, that make up the internet. BGP is regarded as one of the most fragile but critical technologies underlying the internet.

BGP is designed to let networks announce the best paths to their resources. Those changes, which are called "announcements," are then propagated by other networks.

But BGP is like a row of dominoes. And if one network makes a mistake in announcing new routes, other networks down the line can pass on that mistake if the bad routes aren't filtered out. Errors are referred to as leaks.

Cloudflare put the blame squarely on Verizon for not adequately filtering erroneous routes announced by an ISP, DQE Communications, in Pennsylvania. It pulled no punches, saying there was no good reason for Verizon's failure other than "sloppiness or laziness."

"The leak should have stopped at Verizon," writes Tom Strickx, a Cloudflare network software engineer, in the blog post. "However, against numerous best practices outlined below, Verizon's lack of filtering turned this into a major incident that affected many Internet services such as Amazon, Linode and Cloudflare."

Routes Gone Bad

DQE used a BGP optimizer, which allows for more specific BGP routes, Strickx writes. Those more specific routes trump more general ones in announcements. DQE announced the routes to one of its customers, Allegheny Technologies, a metals manufacturing company. Then, those routes went to Verizon.

To be fair, the ultimate responsibility falls on DQE for announcing the wrong routes. Allegheny is somewhat to blame for pushing those routes on. But then Verizon - one of the largest transit providers in the world - propagated the routes. That's when it became messy.

Internet traffic destined for Cloudflare, Amazon Web Services and Google then went through DQE, Allegheny and Verizon. Subsequently, about 15 percent of Cloudflare's global traffic was affected during the most severe period.

Strickx writes that there is a no-cost way to prevent taking up bad routes. Verizon could have had a limit on the number of prefixes - the term for blocks of IP addresses - that its routers are allowed to accept per BGP session. If the number of prefixes is too numerous - which may be a sign of an error - a router can reject taking the announcement, thus preventing a huge traffic choke point.

"Had Verizon had such a prefix limit in place, this would not have occurred," Strickx writes. "It is a best practice to have such limits in place. It doesn't cost a provider like Verizon anything to have such limits in place."

No Beef With Verizon

Cloudflare's sharp blog post, as well as how fast it posted it after the incident, caught many by surprise.

"Regarding those really aggressive claims, I was a bit shocked by that as well," writes one person on Hacker News, which has a commentary thread on the kerfuffle. The observer speculated that Cloudflare might have "some pre-existing beef with Verizon and is using this as an opportune moment to dump on them."

Not so, says Cloudflare CTO John Graham-Cumming.

"No one had an axe to grind with Verizon," Graham-Cumming writes in a response on Hacker News. "We were working a complex problem affecting a good chunk of our traffic and customers. Everyone was calm and collected and thoughtful throughout."

Cloudflare's legal department signed off the blog post, Graham-Cumming writes.

Verizon officials couldn't be immediately reached in Sydney on Wednesday for comment. But this isn't the first time I've contacted Verizon regarding irregularities with how it handles BGP.

Last year, I reported that Verizon carried erroneous routing announcements that allowed traffic for Australian defense websites to go through China Telecom. The situation carried on for some 30 months, and no clear answer emerged as to why Verizon allowed it to carry on for so long. There are security risks in routing traffic through nations such as China (see: Did China Spy on Australian Defense Websites?).

How to Mitigate BGP Risks

There have been plenty of warnings by experts over the shortcomings in BGP, which has its roots in the 1970s. But as Strickx points out, there are ways to mitigate the risks, such as tapping into the Internet Routing Registry, which maintains databases of prefixes that networks can refer to avoid accepting wrong announcements by other providers.

Also, there's Resource Public Key Infrastructure, which uses a system of digital certificates to verify that a set of IP addresses belongs to a network provider and that the provider is allowed to make related BGP announcements.

While many networks use IRR and RPKI, an internet-wide upgrade of all networks remains an elusive goal. One consolation is that BGP mistakes usually don't go unnoticed for long. But be prepared for more small heart attacks along the way.