Hacking Healthcare: Attacks on the Highest Value Asset

Transcription

1 Hacking Healthcare: Attacks on the Highest Value Asset Paul Dant Chief Strategy Officer Independent Security Evaluators

2 The Key Takeaway

3 Who am I? Paul Dant Chief ISE 9: First digital product 13: First blackhat hack 17: First hacker caught 19: First whitehat hack

4 Who is ISE?

5 Our Roles for Today My Role Paint a picture What we should be protecting Who we are defending against How do we fix the problem Your Role Interpret the picture Understand the correct mission Understand the right approach Realize success

6 How Can You Apply in Practice? Recognize the high value asset and defend accordingly Understand that regulations and compliance should follow, not lead Developing and implementing a strategic plan is critical to success

7 Why Patient Health?

8 Why Patient Health? We tend to focus on these

9 Why Patient Health? Wrong Mission + Outdated Approach = Failure Focusing on Patient Records Ignoring Advanced Threats Patients at Risk

10 Why Patient Health? includes

11 Why Patient Health?

12 What are the Threats? Casual Hacker Hacktivist Corporate Espionage Organized Crime Nation State

13 What are the Threats?

14 A Simple Business Decision

15 Attributes of an Attacker

16 How Do We Know?

17 Medical Device Security Research

18 What s the Solution?

19 Call to Action Engage the C-Suite to discuss the new mission Review our empirical blueprint with your org Next week 30 days Start to develop a long Work to separate IS from IT Begin an in-depth inventory of all assets; prioritize their defense term security plan 60 days 90 days Perform a security assessment

20 Paul Dant

21 How d This Happen? A Journey in PII Pwned Reconciliation Chad Skipper Distinguished Engineer Dell

22 The Date Of Awareness

23 The Date Of Awareness What s mine say? Dude! $7,242 What s mine say? Sweet!

24 The Date Of Awareness

25 The Date Of Awareness

26 The Date Of Awareness

27 How Tax Fraud Works

28 The Journey of Reconciliation Called the IRS Fraud Hotline

29 The Journey of Reconciliation Called the IRS Fraud Hotline Verified that a fraudulent tax refund was submitted for 2014

30 The Journey of Reconciliation Called the IRS Fraud Hotline Verified that a fraudulent tax refund was submitted for 2014 IRS received fraudulent tax return on March 19th 10:24:09 EST - submitted electronically

31 The Journey of Reconciliation Called the IRS Fraud Hotline Verified that a fraudulent tax refund was submitted for 2014 IRS received fraudulent tax return on March 19th 10:24:09 EST submitted electronically Action Return Check and submit Identity Theft Affidavit Form for each person

32 The Journey of Reconciliation Fraudster has more rights than victim

33 The Journey of Reconciliation Fraudster has more rights than victim Can no longer file refund electronically for 3 years

34 The Journey of Reconciliation Fraudster has more rights than victim Can no longer file refund electronically for 3 years Will cause 180 day delay upon tax return filed

35 The Journey of Reconciliation Fraudster has more rights than victim Can no longer file refund electronically for 3 years Will cause 180 day delay upon tax return filed Additional details from IRS will be sent by mail

36 The Journey of Reconciliation IC3 Filed 4/14/15 ault.aspx FTC Filed 4/15/15 cles/0277-create-identity-theftreport SS Office Stated to submit to FTC ount/

37 The Journey of Reconciliation - Added Fraud Alert that will be added to all 3 credit agencies - Equifax / Experian which stays on for 90 days

38 The Journey of Reconciliation - Added Fraud Alert that will be added to all 3 credit agencies - Equifax / Experian which stays on for 90 days Call Banks

39 The Journey of Reconciliation - Added Fraud Alert that will be added to all 3 credit agencies - Equifax / Experian which stays on for 90 days Call Banks Submit FTC report to local police

40 The Journey of Reconciliation - Added Fraud Alert that will be added to all 3 credit agencies - Equifax / Experian which stays on for 90 days Call Banks Submit FTC report to local police Submit FTC report to State Attorney General

41 Who s Watching Who?

42 Who Had It? Who Had? Names DOBs Current Address SSNs Recent Large Breaches

43 Who Had It? Who Had? Names DOBs Current Address SSNs Recent Large Breaches

44 Who Lost It? IRS denies that I was personally impacted Anthem has verified our PII was stolen OPM declined to verify if I was personally impacted

45 Who Done It and Why? IRS Fraud is its own animal and different beast than credit fraud

46 Who Done It and Why? IRS Fraud is its own animal and different beast than credit fraud Fraudster submits 100s of fraudulent tax returns to deposit in various accounts

47 Who Done It and Why? IRS Fraud is its own animal and different beast than credit fraud Fraudster submits 100s of fraudulent tax returns to deposit in various accounts Individuals in Eastern Europe are most suspect

48 What To Do? Since this was IRS Fraud Who is watching the IRS? Inspector General No Accountability Suspect someone stole your identity and used your SSN for employment purposes or could use your SSN to file a tax return? Complete online form 14039

49 How to Reduce Your Risk Don t carry your SSN card or any document with your SSN. Don t give a business your SSN just because they ask only when absolutely necessary. Check your credit report quarterly. Check your Social Security Administration earnings statement annually. Protect your personal computers by using firewalls, anti-spam/virus software, update security patches and change passwords for Internet accounts. Don t give personal information over the phone, through the mail or the Internet unless you have either initiated the contact or are sure you know who is asking.

50 Thank You Chad Skipper Distinguished Engineer Dell