In Development

Receive Invite When Available

Cybersecurity , Risk Management

Last month, the Federal Financial Institutions Examination Council responded to institutions' requests for clarification about how, and to what extent, the Cybersecurity Assessment Tool should be used when preparing for regulatory IT examinations (see Banks to FFIEC: Cyber Tool is Flawed).

See Also: Managing Identity, Security and Device Compliance in an IT World

As part of that "frequently asked questions" guide, the FFIEC addressed a number of concerns, the most pressing of which relates to banks' and credit unions' ongoing confusion about whether use of the tool is mandatory.

Once again, the FFIEC stressed that use of the tool is voluntary: "The FFIEC released the Assessment as a voluntary tool that institution management may use to determine the institution's inherent risk and cybersecurity preparedness."

Nevertheless, some FFIEC critics tell me that regulators are still questioning institutions about their use of the tool during IT examinations.

"The CAT is not necessarily 'voluntary,'" says former bank CISO David Shroyer, who now works as managing director of information and cybersecurity for Queen Associates, an IT consultancy and staffing agency. "It will be reviewed in every exam."

So, if examiners keep asking to review internal risk assessments based on the tool, then the tool's use is not voluntary.

The FFIEC needs to clarify how much discretion individual examiners have when it comes to relying on the tool to determine risk preparedness during exams.

"[The FAQ] should clarify the fact that examiners should not be asking to review these assessments as if they were mandatory," contends financial fraud expert Avivah Litan, an analyst at the consultancy Gartner. "It's the examinations that are the main problem, not the tool, in my opinion."

The FAQ fails to clarify whether institutions will be asked to review during their exams self-assessments conducted with the tool: "To obtain additional information about a particular FFIEC member's use of the Assessment, financial institution management should contact its institution's regulator directly," the FAQ notes.

Regulators Admit Ambiguity Exists

Soon after the FAQ was published, I spoke with Tim Segerson and Wayne Trout of the National Credit Union Administration's Office of Examination and Insurance (see FFIEC Sheds Light on Use of Cybersecurity Assessment Tool). The NCUA is one of the five regulatory agencies that makes up the FFIEC.

Segerson and Trout agreed the FAQ doesn't answer every question, and they indicated that the tool is likely to eventually be updated and/or revamped to better address emerging cyber risks. But they acknowledged that although the use of the tool is voluntary, its use is still likely to come up during IT examinations.

"On the examination process right now, for institutions that have ... actually gone through and completed the assessment tool, examiners are engaging in conversation with those institutions' managers and determining what the institution rated themselves in the inherent risk profile, as well as [how] the institution rates themselves in the maturity portion of the tool," Trout noted in our October interview.

Segerson and Trout pointed out, however, that they could not be certain about how other agencies' examiners are discussing the assessment tool during exams.

I reached to the four other FFIEC agencies - the Office of the Comptroller of the Currency, the Federal Reserve, the Federal Deposit Insurance Corp. and the Consumer Financial Protection Bureau - for clarification about how their examiners plan to use the tool or inquire about its use during exams. None immediately replied to my request for comment.

Avoid 'One-Size-Fits-All' Approach

Al Pascual, who oversees fraud and security at Javelin Strategy & Research, says the FFIEC really can't be too prescriptive when it comes to how each agency expects institutions to use the tool. "The FFIEC would be doing the industry a disservice if it tried to prescribe a one-size-fits-all approach to security," he says.

Still, it's not fair to banks and credit unions for regulators to say the tool's use is voluntary and then raise questions about how it's being used during examinations.

With so much ambiguity about how individual agency examiners could use the tool during exams, it's no wonder banks are confused.

What's more, if the FFIEC is leaving it up to individual regulatory agencies to decide how they will use the tool or talk about the tool's findings during assessments, then use of the tool is not truly voluntary.

"The FFIEC should have been more explicit about the fact that the regulators should not be implicitly enforcing use of the tool," Litan tells me. "Instead, they are telling the members to contact their regulator directly. It's the FFIEC's job to spread the word about the misaligned examinations - i.e., that they should not be treating these assessments as if they were required."

HIPAA/HITECH , Privacy , Risk Management

If President-elect Donald Trump fulfills a campaign promise of repealing Obamacare - which could result in the dismantling of HealthCare.gov and state health insurance exchanges - great caution will be needed to protect the data of millions of consumers contained in those systems.

See Also: Avoid Theft of Your Privileged Credentials

Meanwhile, a new federal watchdog report reviewing the security of the state of New York's health insurance exchange shows some security shortcomings in the existing Obamacare system. The review by the U.S. Department of Health and Human Services' Office of Inspector General is the latest of several Obamacare-related data security reports issued in recent years by watchdog agencies.

Protecting Privacy

Even if Obamacare, officially known as the Affordable Care Act, is repealed, "I don't believe the current approach of security and privacy management will change," says Curt Kwak, former CIO at the Washington state health insurance exchange and now CIO of Proliance Surgeons in Seattle. "It will be a long change management process with the same level of scrutiny and focus that we have always placed on consumer data, including PHI. I would suspect it would be like changing any critical large system, which is to focus on data initially, safeguard and archive, before any work on the system begins."

Also, some data handled by the state-based exchanges is obtained through federal systems, including the Internal Revenue Service and Centers for Medicare and Medicaid Services, as well as state agencies, he notes. "These systems are as locked down as you are going to get, governed by the government. ... So as long as there is leadership and full accountabilities established to all parties, I think it will be OK."

Mac McMillan, CEO of security consultancy CynergisTek, says that if Obamacare is repealed, the most important security measure "will be the proper disposition of the data, sanitization of systems and the eventual destruction of the information itself. But before that, there is a more important question regarding the disposition of this information as part of the individuals' health history or record."

The Next Steps

The concern in the repeal of Obamacare resulting in the discontinuation of Healthcare.gov and related systems at many states "are the same faced by the dismantlement or shutting down of any program or business handling sensitive or in this case patient information," McMillan says. "Care will need to be taken to first preserve the information, then protect the data, and eventually distribute/restore it as part of that person's record once they have alternative coverage."

Any potential dismantling of systems associated with health insurance exchanges under Obamacare - if it's, indeed, repealed - would require the same level of caution to protect data that any healthcare entity or business associate would need to exercise if any of their business operations were to cease, McMillan says.

"If an entity goes out of business they should return the information to the covered entity who owns it and properly sanitize all systems before disposing of them," McMillan says. "If an organization retires/migrates a system, they are still obligated under the [HIPAA] rule to retain the information and/or follow the disposition instructions of the covered entity who owns the data."

If health insurance exchange systems will no longer need to store PHI, "the data needs to be wiped in a manner that complies with HIPAA requirements for media reuse and disposal," notes Keith Fricke, partner and principle consultant at tw-Security.

But even before systems are potentially dismantled, data needs to be protected during in-between stages of discontinued operations, he notes. "Take the systems offline and restrict physical and electronic access until the data are properly disposed of," he suggests.

Similar Challenges

The processes and procedures that would be needed to protect Obamacare-related data if the law is repealed are similar to what covered entities and business associates deal with when faced with operations or business shutdowns.

"The processes for proper destruction/sanitization still apply," McMillan says. "If the entity is retaining the retired system as an archive, then steps should be taken to encrypt the data if not done so already, to limit access and to remove from the production environment so it is not accessible without review/permission."

Even when covered entities or BAs go out of business, Fricke notes, "organizations are still obligated to protect the patient data while in their custody; therefore, all required administrative, physical and technical controls are still in play. Also, contract language for any parties involved should have language addressing termination of relationship and agreed-upon actions to be taken to dispose of data."

Any type of major change introduces risk, says Dan Berger, CEO of the consultancy Redspin. "Many breaches have occurred as a result of servers being left online that were thought to have been disconnected," he points out.

Rigorous planning in advance of the dismantling process - and exceptional execution - are required to ensure that data is protected, Berger notes. "In addition, there has to be an offline data retention plan in place and ultimately an airtight data disposal process," he says.

Of course, a security risk assessment is essential before any major change in infrastructure or systems, Berger adds. "End-of-life is no exception and carries additional considerations for data retention obligations and secure disposal," he says.

New York State Exchange

As for the OIG's review of the New York health insurance exchange, the watchdog agency found that the New York marketplace had implemented many security controls, including policies and procedures, to protect PII on its website and database. "However, it did not always comply with federal requirements. Specifically, the New York marketplace had not adequately secured its website," OIG wrote.

OIG also notes: "Although we did not identify evidence that the vulnerabilities in the New York marketplace's website had been exploited, exploitation could have resulted in unauthorized access to and disclosure of PII, as well as disruption of critical marketplace operations."

OIG says the vulnerabilities could have potentially resulted in the compromise of data confidentiality and integrity as well as jeopardized the availability of the marketplace. In addition, without proper safeguards, the vulnerabilities would leave the systems and network at risk for crimes involving fraud as well as malicious attacks.

One of the key takeaways from OIG's reviews of the Obamacare health insurance exchanges is the paramount importance of website and web application security, Berger says. "In the commercial sector, web application security is a specialized discipline that attracts among the best security engineers in the business. Prudent web app security involves manual testing as vulnerabilities are often the result of business logic flaws, something automated scanners won't always detect."

Other States

OIG's review earlier this year of the security of Minnesota's state-operated health insurance exchange under the Affordable Care Act also revealed various security weaknesses that potentially put sensitive consumer data at risk (see OIG Flags Security Flaws in Two State Health Info Systems).

Also, a GAO report issued in September said undercover testing for the 2016 coverage year found that the eligibility determination and enrollment processes of online healthcare marketplaces in California, Virginia and West Virginia were vulnerable to fraud (see GAO: Obamacare Enrollment Fraud Vulnerabilities Persist).

Endpoint Security , Risk Management , Technology

It's an innocent act: Close the lid on the laptop and go for a burrito at lunch. The laptop locks itself and goes into a mid-day snooze. But as prolific hacker Samy Kamkar shows with his latest experiment, this feeling of security is an illusion.

See Also: Faster Payments, Faster Fraud?

Kamkar, who most famously created the MySpace worm a decade ago, pushes the bounds of hacking possibilities, finding creative ways to disrupt systems. And his most recent work, which he calls PoisonTap, is yet another illustration of how tradeoffs made between security and convenience can open up dangerous security holes.

Kamkar built PoisonTap using a $5 Raspberry Pi Zero computer, a microUSB cable and a microSD card. Although physical access to a computer is required to insert the device, from there it doesn't rely on any software vulnerabilities to accomplish its misdeeds. Instead, it takes advantage of the implicit trust put in connected devices and produces "a snowball effect of information exfiltration, network access and installation of semi-permanent backdoors," Kamkar writes on his blog.

Kamkar has released the source code for PoisonTap on GitHub along with a demonstration video.

Locked, But Not Really Locked

When computers go into a locked state, most users would think nothing gets in or out. But Kamkar found that even if a computer requires a password to gain access again, he could skip over that step by inserting his malicious USB device.

When the computer then asks PoisonTap for an IP address, it impersonates an ethernet device. And rather than just responding as a local network device, PoisonTap pretends it's the entire internet IPv4 address space. The computer then prioritizes PoisonTap's connection because it's a local area network and subsequently routes all of its internet traffic over it.

The trouble starts there, and Kamkar found all kinds of ways to tamper with a computer even if PoisonTap is physically connected to a computer for only a short period. He found he could easily steal certain types of cookies, which are small data files stored within a web browser that allow, for example, visitors to continue to access a website without logging in again.

By spoofing DNS requests, Kamkar could deliver hidden iframes to a person's web browser that impersonated popular websites and then collect those sites' cookies. It should be noted that this attack will not work if websites are encrypted, designated by "https" in the URL window, or if cookies have been flagged with the "secure" setting.

The implanted iframes, though, don't disappear - even if PoisonTap is removed. The browser caches them, which makes them essentially backdoors unless someone flushes their browser's cache, which regular users rarely do. The backdoor could also allow an attacker to have access to the user's router, Kamar writes.

"This can lead to other attacks on the router which the attacker may have never had access to in the first place, such as default admin credentials on the router being used to overwrite DNS servers or other authentication vulnerabilities being exposed," he writes.

The Glue Defense

The sure-fire defense against PoisonTap is one that has been used for a long time: permanently plugging USB ports with epoxy.

As noted before, PoisonTap is also ineffective if websites are encrypted. Following the leaks from former National Security Agecy contractor Edward Snowden that revealed large-scale government spying operations, more and more websites are implementing encryption, but the massive effort is far from complete.

Closing web browsers when leaving a computer unattended is another defense, although Kamkar notes that behavior "is entirely impractical."

There are also some platform-specific tips: Enabling FileVault, macOS's full-disk encryption feature, is recommended. When Macs go into a deep sleep, "your browser will no longer make requests, even if woken up," Kamkar writes.

Even though macOS has a setting that requires an administrator password before a change to network setting is allowed, Kamkar wrote on Twitter that "it only prevents *manual* network changes, yet still auto-provisions new devices."

Data Breach , Litigation

Adobe Systems will pay a $1 million settlement to 15 states for its 2013 data breach, which at the time was one of the largest known breaches of user account data.

See Also: Secrets to a Simpler Security Incident Response

The settlement resolves consumer protection, data security and privacy claims against the company," Massachusetts' Attorney General's office says in a statement. It also requires Adobe to put in place defenses to better protect data.

Parties to the agreement are Arkansas, Connecticut, Illinois, Indiana, Kentucky, Maryland, Massachusetts, Missouri, Minnesota, Mississippi, North Carolina, Ohio, Oregon, Pennsylvania and Vermont, where a total of 534,000 victims lived. The settlement works out to be less than $2 per victim.

"It is good to see that the states tried to recover losses sustained by some of their residents, but it is unlikely scalable to the actual losses sustained by many consumers," says Alex Holden, CISO at Hold Security, who discovered Adobe's breach.

38 Million Accounts Affected

Adobe disclosed a series of data breaches in October 2013. It initially believed that only 2.9 million accounts were affected, but three weeks later said the breach involved 38 million active accounts. The full stolen data, a 3.8GB file, contained 153 million accounts.

The stolen data included names, addresses, phone numbers, email addresses, usernames and encrypted payment card numbers and expiration dates.

The states alleged that Adobe "did not take reasonable steps to protect consumers' personal information or to promptly detect the attack and prevent the theft," according to Massachusetts' Attorney General's office.

The money will be split among the states depending on the number of victims who reside in each. For example, North Carolina, whose attorney general's office released a statement on the settlement, will get more than $71,000 for its 52,734 victims. Massachusetts says its share is more than $70,000 for 53,000 victims.

The financial penalty in the settlement probably pales in comparison to the legal fees Adobe has incurred, says Troy Hunt, an Australian data breach experts who runs the Have I Been Pwned breach notification website.

"I think the most interesting thing about this is here we are three years later, and the saga is still playing out," Hunt says. "$1 million doesn't seem like much. You have to wonder what three years of lawyers and court wrangling would have added up to."

In 2015, Adobe chose to settle a class-action suit filed in federal court in California related to the 2013 breach. The terms of the settlement were not disclosed, but Adobe ended up paying $1.2 million of the plaintiffs' legal fees (see Adobe Plans to Settle Breach Lawsuit).

Source Code Also Stolen

The breach occurred after attackers compromised one of Adobe's public-facing web servers and then used that access to move laterally through its network, according to the Massachusetts Attorney General's office. Adobe "received an alert that the hard drive for one of its application servers was nearing capacity," it says.

"In responding to the alert, Adobe learned that an unauthorized attempt was being made to decrypt customer payment card numbers maintained on the server," according to the statement.

The attackers also stole Adobe source code, which was also discovered by Holden. He found the code stashed on a server run by a hacking gang. The source code had been encrypted, or stolen in that fashion, but the files were left unprotected on the server when Holden found it.

The theft of source code, which included Adobe's ColdFusion web server software, is almost an incalculable loss that also likely caused financial issues for other customers not party to the settlement, Holden says. It's possible hackers could develop zero-day exploits from the ColdFusion source code, he says.

"Exploitations of Adobe's web server product ColdFusion led to thousands of sites being compromised and losses of even more data," Holden says.