Artificial Intelligence & Machine Learning , Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime

The Role of Threat Intelligence in Cyber Resilience• December 12, 2018    

When security controls fail, can you detect unusual and anomalous activity with sufficient context to accurately ascertain the risk to the organization?

Can you answer this question with a confident yes?

Most organizations don't even know when security controls have failed. This is a primary reason why intrusions exist in organizations for upwards of 200 days before being discovered. Additionally, heuristic and homogeneous alerts provide virtually zero context about anomalous activity inside the internal network and do nothing to help cyber defense teams prioritize and correctly remediate cyberattacks.

View this presentation to receive expert guidance on:

How threat intelligence can be used strategically and tactically; How to gauge cyber resilience by measuring the levels and capacity of threats attacking your organization; Best methods to predict failures in security controls and arm cyber defenders with threat acumen to triage encountered threats.

Breach Response , Data Breach , Data Loss

Victims Objected to Terms Of Fraud Monitoring Agreement(jeremy_kirk) • December 12, 2018    Photo: José Carlos Cortizo Pérez via Flickr/CC

There's often been a cheeky devil in the details when data breach victims sign up for free fraud-monitoring services from breached organizations: In return for accepting one year of prepaid identity theft monitoring, consumers must often waive their right to join class-action lawsuits or pursue other court actions against a breached business.

See Also: Cybercrime 2.0: A New Era for the Identity and Authentication Challenge

Just such a situation arose last year with Equifax, which on Sept. 7, 2017, disclosed that it had suffered a massive breach that it eventually found had compromised data for at least 148 million people in the U.S., 15 million in the U.K. and about 20,000 in Canada (see: Equifax Breach 'Entirely Preventable,' House Report Finds).

To get signed up for Equifax's fraud-monitoring service, TrustedID, consumers had to agree to an arbitration clause. The inclusion of the clause, however, caused outrage, with lawmakers and attorneys general promising to crack down. Under fire, Equifax eventually removed the offending terms of service, later in September 2017.

Following Marriott International's disclosure of its data breach, this situation appears to be happening again. But according to documents filed in federal court in Maryland on Tuesday, Marriott - like Equifax - now appears to be backing away from what breach victims, and their attorneys, say are the onerous conditions under which the company is offering fraud monitoring to victims of a breach that Marriott failed to spot, and which ran unchecked for four years.

Plaintiffs Call Move 'Underhanded'

Marriott's breach exposed up to 500 million accounts for customers of its Starwood line of hotels, which include brands such as W, Sheraton and Westin. The breach, which affected the Starwood guest reservation database, started in 2014 and ran through Sept. 10, 2018 (see: Marriott's Mega-Breach: Many Concerns, But Few Answers).

The breach was one of the largest such incidents to have come to light this year, and exposed a significant amount of personal information. For 327 million accounts, the breach exposed a combination of name, postal address, phone number, email address, passport number, birth date and travel data. For some of those accounts, encrypted payment card numbers and expiration dates were also exposed, as was potentially the information attackers would have needed to decrypt the payment card data. For the other 173 million accounts affected by the breach, the information exposed was limited to name and sometimes other data such as mailing address, email address or other information, the hotel giant reports.

As is customary, it didn't take long for a class-action complaint over the breach to emerge. On Dec. 6, a breach victim filed a lawsuit in U.S. District Court in Maryland that alleges that the hotel giant has put people at risk of identity theft. The complaint seeks unspecified damages.

Marriott is offering all breach victims a one-year, prepaid subscription to WebWatcher, a fraud-monitoring service offered by risk consultancy Kroll. But the lawsuit contends that the terms and conditions for using WebWatcher mandate that disputes go to mandatory arbitration and that by signing up, consumers forfeit their rights to jury trials or class actions. In other words, from a legal-rights perspective, the service would hardly appear to be "free."

From the complaint: "Marriott engaged in an underhanded attempt to induce putative class members to waive and limit their legal rights, creating both uncertainty about whether to accept the WebWatcher product and whether they were still permitted to pursue legal claims in court through a class action vehicle," the plaintiffs allege. "The net result of this conduct is dissuading consumers from taking all steps to vindicate their rights."

Forced Arbitration: Illegal, Sometimes

Now, however, it appears that Marriott is backing off those terms and conditions. In recently filed court documents, Marriott says it doesn't intend to enforce those terms upon WebWatcher subscribers.

"It's pretty significant - and rare - for a company to agree to this," according to a spokeswoman for Edelson PC, the law firm that filed the class-action complaint.

A declaration filed by an Edelson attorney says that Marriott has "clarified and confirmed" that the terms of the WebWatcher agreement would not apply to "putative class members."

WebWatcher's terms and condition prohibit legal actions against Marriott by any Marriott breach victim who signs up for the fraud-monitoring service that Marriott is offering to consumers whose data it failed to protect.

A Marriott International spokesman says the company doesn't comment on pending litigation and didn't answer a question about whether it has yet revised the terms and conditions that breach victims are signing if they enroll with WebWatcher. Kroll officials couldn't immediately be reached for comment.

But forced arbitration and the banning of court actions have historically been one strategy that organizations - and especially financial institutions - have employed to try and reduce their legal exposure. The practice, however, has been criticized for limiting what have been customary legal rights for consumers to seek redress.

How did we get here? A series of Supreme Court decisions previously paved the way for arbitration clauses, which were shaping consumer litigation, writes Matthew H. Adler, a partner with Pepper Hamilton LLP, in an October 2017 blog post.

"No courts, no massive suits - just individual versus business on a single issue and contract," Adler writes.

Although organizations such as the U.S. Chamber of Commerce support arbitration, the Consumer Financial Protection Bureau created a rule that banned financial services companies from using arbitration clauses in order to prevent consumers from pursuing legal action as a group.

The CFPB rule became law on Nov. 1, 2017. But companies outside of the financial services sector are still allowed to use arbitration clauses.

Data Breach , Governance , Healthcare

Enforcement Action is the Third in Recent Weeks, Eighth This Year(HealthInfoSec) • December 12, 2018    

In its third enforcement action in recent weeks, federal regulators have hit a Colorado medical center with a HIPAA fine in a case involving failure to terminate a former employee's remote access to patient data.

See Also: Third-Party Cyber Risk Management - A Data-Driven Approach

In a statement, the Department of Health and Human Services' Office for Civil Rights said Pagosa Springs Medical Center in Colorado has agreed to pay a $111,400 financial settlement and adopt a substantial corrective action plan to resolve potential HIPAA violations.

Sending a Message

Privacy attorney Iliana Peters of the law firm Polsinelli notes that in all HIPAA settlement agreements, OCR attempts to send a message to covered entities and business associates.

"Here, OCR is highlighting impermissible disclosures involving electronic PHI, particularly with regard to two ways that PHI that covered entities and business associates hold may be especially vulnerable - outdated access controls and lack of business associate agreements," she says.

"The well-known threat to PHI from insiders goes up significantly when such individuals leave an entity, so revoking privileges of such individuals should be a priority for HIPAA covered entities and business associates."

Peters, who formerly worked at OCR, also stresses: "HIPAA covered entities and business associates should take the messages of this case to heart, and use the case as a 'teachable moment' for their organizations."

Long Investigation

The settlement with PSMC, a small, critical access hospital, resolves an OCR investigation launched in 2013 into a complaint alleging that a former PSMC employee continued to have remote access to the medical center's web-based scheduling calendar, which contained patients' electronic protected health information, after leaving the staff.

OCR's investigation found that the medical center impermissibly disclosed the ePHI of hundreds of individuals to its former employee and to the web-based scheduling calendar vendor without a required business associate agreement in place.

The resolution agreement between OCR and PSMC notes that the medical center failed to de-activate the former employee's username and password following termination of employment.

In addition, PSMC impermissibly disclosed the PHI of at least 557 individuals to Google, its business associate, without obtaining satisfactory assurances from Google in the form of a written business associate agreement stating that Google would appropriately safeguard the PHI.

"It's common sense that former employees should immediately lose access to protected patient information upon their separation from employment," said OCR Director Roger Severino in the statement. "This case underscores the need for covered entities to always be aware of who has access to their ePHI and who doesn't."

Corrective Action Plan

Under the two-year corrective action plan, PSMC has agreed to:

Update its security management, including revising its policies and procedures relating to uses and disclosures of PHI; Revise its policies and procedures related to business associates and business associate agreements; Train its workforce members regarding those issues.

PSMC did not immediately respond to Information Security Media Group's request for comment on the settlement.

Other Cases

Inappropriate access by former employees to patient data was also at the heart of OCR's $5.5 million HIPAA settlement in 2017 with Florida-based Memorial Healthcare System, notes Peters, the attorney, who formerly was an enforcement leader at OCR.

In that case, log-in credentials of a former employee of an affiliated physician's office had been used to access the electronic PHI maintained by the healthcare system on a daily basis without detection from April 2011 to April 2012, affecting 80,000 individuals.

The settlement with PSMC is the third that OCR has announced in recent weeks, and the agency's eighth HIPAA enforcement action so far this year.

On Dec. 4, OCR announced a $500,000 HIPAA settlement and corrective action plan with Advanced Care Hospitalists, a Florida-based company that provides contracted physicians to hospitals and nursing homes. The breach case involved the lack of a business associate agreement with an individual providing billing services and the exposure of patient data on a website.

On Nov. 16, OCR announced it had signed a $125,000 settlement with Allergy Associates of Hartford a three-doctor practice in Connecticut, in a breach case involving improper disclosure of patient information to the media.

And in October, OCR signed a record $16 million settlement with Anthem in the wake of a cyberattack on the health insurer revealed in 2015 that resulted in a massive health data breach impacting nearly 79 million individuals (see: Anthem Mega Breach: Record $16 Million Settlement)

OCR's HIPAA financial settlements so far this year total more than $25.6 million.

Encryption & Key Management , Mobility , Security Operations

DHS, Philips Issue Advisories for HealthSuite Android Health App(HealthInfoSec) • December 11, 2018    

The lack of strong encryption in the Philips HealthSuite Health Android app leaves the consumer mobile health software vulnerable to hacking, according to a new advisory issued by the medical device manufacturer and an alert from the Department of Homeland Security.

See Also: Five Steps to Masterminding an Effective Security Awareness Program

The alert from the DHS Industrial Control Systems' Cyber Emergency Response Team and the Philips advisory warn users of a vulnerability - "inadequate encryption strength" - that affects all versions of the Philips HealthSuite Health Android application. DHS notes the weakness was identified by a researcher.

The Android app enables patients to monitor and track their health habits with various connected Philips devices that measure heart rate activity, sleep, blood pressure, weight and body composition analysis.

"Successful exploitation of this vulnerability may allow an attacker with physical access to impact confidentiality and integrity of the product," DHS notes in its alert. "The software uses simple encryption that is not strong enough for the level of protection required."

A Philips spokesman says the vulnerability only affects data at rest within the app.

Philips notes on its website, however, that the HealthSuite App "enables the transmission of data from your connected Philips' personal measurement devices to us, which we will use to provide you with virtual motivational coaching and with publicly available information for lifestyle improvement."

The app itself is not a medical device, according to the manufacturer. "The app is not intended to diagnose, examine, treat or manage medical conditions of any kind. The app is an information tool only and not a substitute for professional judgement by any healthcare provider," Philips notes on its website.

The advisory from Philips was issued as part of the company's Coordinated Vulnerability Disclosure Policy "for the awareness and remediation of possible system security vulnerabilities," the company says in a statement provided to Information Security Media Group. "As part of our global product security policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities."

No Reported Exploitation

Philips in its advisory notes that it has not received any reports of exploitation of the vulnerability or security issues tied to clinical use. "Philips' analysis indicates that there is no expectation of patient hazard due to this issue," the company says in its advisory.

The company says it plans to address the vulnerability in a new software release scheduled for the first quarter of 2019.

"Philips advises users against jail-breaking or rooting their mobile device," the company warns. "A jail broken or rooted device means one that is modified outside the mobile device or operating system vendor supported or warranted configurations. Such devices have been freed from the limitations imposed on it by mobile service providers and the phone manufacturers without their approval. This may affect the performance of the app, weaken the security of devices and expose users to additional risks."

Safety, Privacy Risks

Whether it's a mobile app that works with medical devices, or software that's part of a medical device itself, vulnerabilities in these products can pose potential risks to patient safety, as well as to data security and privacy.

"Virtually all of the security issues connected with medical devices are software related," notes Bill Aerts, executive director at the Archimedes Center for Medical Device Security at the University of Michigan. "I don't see any real difference in risk between a device and a software product that acts like a device, in general."

But based on the information provided by DHS and Philips, Aerts says, "it's hard to compare how significant this risk is."

While these new advisories involve a consumer-oriented health app, Philips also has been among a handful of manufacturers that have issued other security alerts concerning various medical devices used by healthcare entities to treat, diagnosis or monitor patients.

For instance, in August, DHS and Philips each issued alerts about vulnerabilities involving "improper privilege management" and "unquoted search path or element" that pose risk in certain versions of Philips' IntelliSpace Cardiovascular cardiac image and information management software (see: Cyber Warnings About Certain Philips Medical Devices).

In addition, to the vulnerabilities in those cardiac imaging management products, DHS and Philips also each issued alerts about vulnerabilities in certain Philips PageWriter Cardiographs products, which are used for diagnostic electrocardiogram testing. Those issues include improper input validation and use of hard-coded credentials, which, if exploited, "could allow buffer overflows, or allow an attacker to access and modify settings on the device," DHS noted.

Cause for Concern?

So how big a concern is the new vulnerability revealed in the Philips HealthSuite app?

"By itself, inadequate encryption won't usually pose safety risks, so I wouldn't worry about this if I were a patient using the app," says Ben Ransford, president of healthcare cybersecurity firm Virta Labs.

"Encryption is 'rocket science' that even experts screw up all the time," he says. "You're almost certainly using several weak systems right now. I don't know how this [HealthSuite] app was designed, but the general design principle is to assume your system going to be compromised and figure out how to limit the scope of an attack."

One good strategy, Ransford says, is to use different encryption keys for each copy of the app or each user so that a single compromise won't expose everyone. "Unlike encryption, threat modeling is not rocket science, but it requires humility and creativity, which is why it's so hard to find great product-security people. Engineers prefer to be correct," he says.

Encryption issues are more likely to be identified in legacy products, Aerts says. "It should not be that common. Most development is done with standardized encryption methodology," he contends. "Most exceptions will likely be with older products."