Healthcare Information Security in Critical Condition [feedly]

----
Healthcare Information Security in Critical Condition
// A Collection of Bromides on Infrastructure

News today, CareFirst is reporting that that medical records of 1.1 million customers have been breached. The news casts a shadow over the healthcare industry, which is still recovering from the breach of 80 million records from Anthem earlier this year. In fact, the Washington Post is already reporting that "2015 is already the year of the health-care hack — and it's only going to get worse."

The Washington Post reports a third of the US population has been impacted in the past five years:

"Data about more than 120 million people has been compromised in more than 1,100 separate breaches at organizations handling protected health data since 2009, according to Department of Health and Human Services data."

Additionally, a recent Ponemon study, the "Fifth Annual Benchmark Study on Privacy & Security of Healthcare Data" revealed some very alarming statistics, as CSO reports:

The report also found that it's not just big, or small, healthcare organizations, but all sized healthcare organizations are at risk to enduring successful attacks against their systems.

According to the report:

• 91 percent of healthcare organizations had one data breach.

• 39 percent experienced two to five data breaches.

• 40 percent had more than five data breaches over the past two years.

The prognosis is not good. Once again, we are witnessing the negative impact that occurs when organizations fail to properly invest in the most foundational aspect of security: PREVENTION. Once again, we have an incident response team investigating the attack, no doubt to report that this was a sophisticated attack that could not have been prevented. This vicious cycle of "cyber indulgences" and assuming compromise is toxic to security.

Cyber attacks are really not all that sophisticated – the real issue is that the traditional security model has not kept pace with the malicious actors. As the recent Verizon DBIR illustrates, 97% of exploits shared 10 common CVEs. As Bromium research as previously demonstrated, "defense in depth" architecture can be easily circumvented by kernel exploits.

It is time to get serious about the condition of information security, both in healthcare and across many other industries with critical data to protect, such as government organizations, financial services and retail.

Bromium provides a proactive approach to threat prevention by isolating attacks through application containerization. Bromium vSentry software transforms endpoint security with a revolutionary new architecture that focuses on protection through hardware-enforced isolation.

----

Shared via my feedly reader

Sent from my iPhone