Data Breach , General Data Protection Regulation (GDPR) , Governance

What's ahead for the cybersecurity landscape in 2019? We've received many lists of predictions from vendors and analysts for next year, and we've picked out five of the most interesting ones.

See Also: Cybercrime 2.0: A New Era for the Identity and Authentication Challenge

Paul Barnes, senior director of product strategy, Webroot:

"There will be a state-sponsored service breach of critical infrastructure leading to loss of life and an extended time frame to return to normal operations."

This scenario has been creeping closer to reality. The attacks against Ukraine's power grid in 2015 and 2016 were among the first and most notable examples of how a targeted cyberattack could disrupt critical infrastructure. Those attacks, blamed on a suspected Russian-linked group nicknamed Sandworm, fortunately only resulted in a loss of power and not life. But industrial control systems remain a big concern for national governments. And there's a chance that even if attackers don't intend for their attack to have fatal consequences, fatalities result nonetheless. Fingers crossed (see: Power Grid Malware Platform Threatens Industrial Controls).

Morey Haber, chief technology officer, and Brian Chappell, senior director, enterprise and solutions architecture, BeyondTrust:

"Privileged attack vectors will continue to be the number one root cause of breaches for both consumer and business data. While Gartner has acknowledged that privileged access management is the top security priority for 2018, many organizations are still in denial of their privileged account risks, which frequently stem from poor password management hygiene. 2019 will see even more high-profile breaches. Organizations must discover and manage their privileged accounts because the attack vector is not going away anytime soon, and ugly newspaper headlines will continue to plague boardrooms."

We're written a lot of those ugly headlines this year. Our modest in-house prediction is that we're not going to have any problems finding plenty of those headlines to write in 2019. The risk of takeovers of privilege accounts is one of the greatest challenges facing organizations. Better password management should be a top priority, as well as regular reviews of access controls, deactivation of unused accounts and behavioral monitoring to detect if something strange is going on. But it's a mighty complicated task, and not everyone is going to get it right every time.

Bogdan Botezatu, senior e-threat analyst, BitDefender:

"Here's a positive prediction for a change: Thanks to the EU's renewed efforts to protect personally identifiable information - in the form of the General Data Protection Regulation that took effect in May this year - we should expect fewer 'credential leaks' to occur, or, at least the very least, make the headlines. Security incidents will be more thoroughly contained at an organizational level in an effort to avoid penalties that could forces a business into bankruptcy."

We hope GDPR is driving better account credential storage and security practices. But while larger companies were somewhat ready for GDPR when it went into effect in May, mid-size to smaller ones were still trying to understand and implement its requirements. Undoubtedly, GDPR is proving to be a big motivation to improve IT security, but we think this prediction may be too rosy - as much as we'd like to see fewer credential leaks. At minimum, organizations should use bcrypt for hashing passwords, because it makes it much more difficult for attackers to discover plain-text passwords (see: Fighting Credential Stuffing Attacks).

Tom Kellerman, chief cybersecurity officer, Carbon Black:

"For my semi-bold 2019 prediction, I'm saying that steganography (the practice of concealing a file, message, image or video within another file, message, image or video) makes a comeback."

Steganography is an ingenious practice that stretches back centuries. It involves the concealment of something - like a message or code - in a way that's only decipherable to those in the know. Steganography perfectly applies to software. A few years ago, a version of the notorious Zeus banking Trojan retrieved a crucial configuration file embedded in a jpeg photo. Placing malware components in what appear to be harmless files gives attackers another tool to conceal their activity. The key to keeping persistent access to organizations is staying under the radar, and steganography can help.

The analysts at Forrester:

"The California Consumer Privacy Act will spur other U.S. states to enact privacy laws. While not as comprehensive as the EU's General Data Protection Regulation, California's Consumer Privacy Act of 2018 does give residents some powerful privacy rights. ... Despite recent murmurs from the Senate Commerce Committee, federal government dysfunction means that there's virtually no chance of a comprehensive national privacy law in the next three years. We predict that, by the end of 2019, at least five additional states - including Massachusetts, New Jersey, New York, Vermont and Washington - will pass their own privacy laws, creating a patchwork of rules for firms to comply with. ..."

The freewheeling days of companies selling and sharing personal data with third parties may be coming to an end. In the wake of Facebook's data breaches, Google's problems with its social network and a raft of other personal data leaks this year, lawmakers and the public are increasingly calling for better security, transparency and accountability.

California's Consumer Privacy Act is the strongest among the 50 states. But a mix regulations across the states mean some consumers have more rights than others, which is a landscape that also makes compliance difficult. A federal privacy law that reflects the prevailing wisdom of privacy experts would give companies and consumers reassurance. As Forrester points out, however, that's not likely in the cards. President Donald Trump's administration has sought to reduce regulations, and a Republican-controlled Senate is unlikely to embrace what would be a complicated law that would invariably increase costs on companies (see: Analysis: California's Groundbreaking Privacy Law).

Data Breach , Governance , HIPAA/HITECH

In the latest HIPAA enforcement action taken by a state, Massachusetts Attorney General Maura Healey's office has signed a $75,000 consent judgement with McLean Hospital, a psychiatric facility, for a breach that affected 1,500 individuals.

See Also: Third-Party Cyber Risk Management - A Data-Driven Approach

The HITECH Act of 2009 gave state attorneys general the authority to bring civil actions for violations of the HIPAA privacy and security rules.

Among other recent HIPAA-related enforcement actions by states, the New Jersey attorney general's office on Dec. 10 announced a $100,000 settlement in a case involving health insurer EmblemHealth for a 2016 breach that exposed Social Security numbers on mailings to more than 81,000 plan members.

In March, that same EmblemHealth breach resulted in a $575,000 settlement with New York's attorney general's office involving the insurer's business associate, United Parcel Service Mailing Innovations.

New Jersey's attorney general took action in another HIPAA case in April, smacking medical practice Virtua Medical Group with a $418,000 penalty for a 2016 breach. That was followed in November by a $200,000 settlement with the vendor involved in that incident, which did business as Best Medical Transcription.

State Activity Uptick

State AGs are finding that by bringing actions through their authority to enforce the HIPAA standards, and incorporating additional violations of state-enacted data security or consumer protection laws, they can pose substantial penalties that "get the attention of the public and other healthcare organizations," notes privacy attorney David Holtzman, vice president of compliance at the security consultancy CynergisTek.

"We are clearly seeing an uptick in state attorneys general filling a void through enforcement of the HIPAA rules when the Department of Health and Human Services' Office for Civil Rights has been perceived as falling short of its mission to hold accountable organizations failing to effectively safeguard personally identifiable health information from unauthorized access."

McLean Hospital Settlement

In a statement about the settlement with Belmont-based McLean Hospital, Healey's office says the case centers on a former employee who failed to return four unencrypted backup computer tapes containing personal and health information of patients, employees and deceased donors of the Harvard Brain Tissue Resource Center.

The hospital violated HIPAA as well as the state Consumer Protection Law and the Massachusetts Data Security Law when it failed to properly protect patients' information, the AG's office says.

McLean Hospital is part of the Boston-based integrated health system Partners HealthCare, which has also been the subject of a handful of other HIPAA-related enforcement cases in recent years.

That includes a $1 million HIPAA settlement in 2011 citing Partners' Massachusetts General Hospital and its physicians for a 2009 breach case involving the loss of scheduling documents for 192 patients in the hospital's General Infectious Disease Associates outpatient practice, including those with HIV/AIDS.

Missing Back-Up Tapes

In the McLean Hospital case, the Massachusetts AG's office alleges that the facility allowed an employee to regularly take home eight unencrypted back-up tapes containing clinical and demographic information from the Harvard Brain Tissue Resource Center. The tapes contained personal information, such as names, Social Security numbers, diagnoses and family histories.

"When the employee was terminated from her position at McLean in May 2015, she only returned four of the tapes, and the hospital was unable to recover the others," the statement from Healey's office says.

The AG also claims several other failures by McLean to identify, assess and plan for security risks, including failing to properly train employees, report the loss of the tapes in a timely manner and encrypt portable devices containing personal information.

"Hospitals must take measures to protect the private information of their patients," Healey says. "This settlement requires McLean Hospital to implement a new information security program and train its staff on how to properly handle the private information of those they serve."

In a statement provided to Information Security Media Group, McLean Hospital says that since this incident, the hospital has "continued to enhance its privacy and security practices and procedures within the brain bank and throughout the research operation. The agreement with the attorney general represents a continuation of those efforts. "

Taking the Right Steps

"Organizations maintaining personally identifiable information must account for security threats created when employees are permitted or required to remove from the worksite devices or media on the data is stored," Holtzman says.

"If you have employees that are removing the data or working remotely, it's important to make a list of the level of information to which they have access."

Organizations should encrypt PII and PHI stored on any devices or media, he says. "Keep logs of the data that is stored on portable devices and removable media. Track the movement of devices and media on which PII is stored as well as conduct periodic audits to ensure that the data can be accounted for."

Yapstone Holdings Settlement

Healey's office also announced this week a $155,000 breach-related settlement with payments processing firm Yapstone Holdings Inc. That case stemmed from exposure via the internet of the personal information of consumers, including bank account and Social Security numbers, addresses, and driver's license numbers.

The AG says Yapstone violated Massachusetts data security regulations.

The AG's office began its investigation after Yapstone notified the office of the incident in 2015.

The investigation into the incident revealed that in July 2014, while modifying Yapstone's website, the company's engineers accidentally removed password protections from public-facing websites used to sign users up for Yapstone's service.

The mistake rendered the webpages publicly viewable to anyone on the internet for more than a year, the AG's statement says. The investigation found that Yapstone employees appeared to have been aware of the vulnerability in August 2014 but neglected to fix it until August 2015, when another employee discovered it.

In addition to the financial penalty, the settlement requires Yapstone to hire a CISO, train employees on data security and assess and update information security policies relating to changes to its systems and to external vulnerabilities.