TechDiem.com » InfoSec

What Companies Want In A CISO

admin — Thu, 24 Sep 2015 16:43:36 +0000

Joyce Brocaglia founder of the Executive Women’s Forum and CEO of Alta Associates joins the Dark Reading News Desk at Black Hat to discuss closing the gender gap in security and what companies are looking for in a chief information security officer.

Article source: Dark http://www.darkreading.com/operations/what-companies-want-in-a-ciso/v/d-id/1322307?_mc=RSS_DR_EDT

Shellshock’s Cumulative Risk One Year Later

admin — Thu, 24 Sep 2015 16:43:34 +0000

How long does it take to patch an entire distribution and bring it up to date? Longer than you think.

When Windows XP reached its end of life, there were approximately 257 outstanding security patches required to bring the OS up to date — and this was considering cumulative versions for both commercial and business, as well as patch supercedence. Since the source code is closed, it never suffered from the fragmentation issues affecting many vulnerabilities, such as what we saw last year with the now infamous Shellshock — impacting a half-billion Web servers and other Internet-connected devices.

On September 24, 2014, when the bug was first disclosed, open source, Linux, OS X, embedded systems, and Unix all were affected and in total, versions available from 1994 (version 1.14) to 2014 could be exploited due to this GNU bash shell vulnerability. But in the intervening 12 months, a lot more needed to be done than just patching a single platform and bringing it up to date. That in itself is something many organizations still find difficult to do today.

Why are these facts important on the one year anniversary of Shellshock? Over time, it’s become more difficult to properly perform a thorough vulnerability assessment of all the vulnerabilities that have been found in the past, many of which are still applicable. However, the biggest issue is the cumulative problem of flaws which are affecting systems. Information security teams must remember that Shellshock and other flaws are not gone even though they’ve disappeared from media headlines. Some systems, due to age, end of life, or a vendor’s incompetence, still remain unpatched today.

While mitigating controls may help reduce or eliminate the risk, the fact remains that any newly identified vulnerabilities aggravate the problem and increase the total vulnerability count with each new flaw. Shellshock, as bad as it was and may be still to this day, is just another critical vulnerability in the process and systems that are not being patched, or even assessed. This creates a cumulative risk problem, which could allow an exploit through multiple vectors verses just one.

While this may seem like common sense, it represents an interesting problem: How long does it take to patch an entire distribution and bring it up to date? Depending how many missing patches exist, more time is needed to remediate and with each new finding the snowballing effect of risk grows. This is true for any operating system and application, even when a single cumulative security update is available; the more you have to patch, the longer it will take, and the more it costs to do so.

So how can infosec teams reduce the cumulative side effects from new vulnerabilities? Here are five suggestions:

Ensure that your organization has a vulnerability assessment and patch remediation process to identify risks. This helps make sure you’re patching quickly. Once a flaw is found, regardless of how, it can be closed in a timely, non-cumulative fashion.
When selecting technology vendors, verify that service level agreements include security and maintenance patches, as well as end of life dates for operating systems, embedded devices or applications. This will ensure that as solutions are being deployed, they can be remediated for the life expectancy of the implementation.
Vulnerability assessments themselves have evolved greatly from the days of network scanners. Many security tools from IDS/IPS systems, endpoint agents, next generation firewalls, sniffers, etc. can detect vulnerabilities that are dormant or being actively tested in a hostile environment. Do not rely on just one technology to identify risks and missing security patches. Leverage every single one and correlate the information to identify weaknesses and attacks.
Credential access is always a problem with sensitive hosts and when un-hardening is just not permissible. When local agents are not permitted to do the work (patch management, Windows update, or even vulnerability assessment agents), consider having a cloned isolated lab environment where remote access is permitted (un-harden duplicate hosts) to perform assessments. The results can then be applied to production. This works well with cloning features present in many virtualization technologies.
When network assessment technologies are being deployed, work with the network infrastructure team to logically place scanners as electronically close to targets (not over WAN links) as possible. Avoid scanning through firewalls, other security sensors, and whitelist the scanner only when needed. They should be close enough to each subnet that they have unrestricted access to each target they are responsible for and every port. This includes whether they are hosted in the cloud, as a virtual image, or even a physical scanner in a remote country.

When was the last time you checked under the hood for the cumulative impact of Shellshock or other vulnerabilities? Let’s chat about that in the comments.

With more than 20 years of IT industry experience, Morey Haber serves as the vice president of technology for BeyondTrust. He joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition and currently oversees solutions for bothvVulnerability and privileged … View Full Bio

Article source: Dark http://www.darkreading.com/shellshocks-cumulative-risk-one-year-later/a/d-id/1322323?_mc=RSS_DR_EDT

Aussie spy agency gets first bug bounty credit

admin — Thu, 24 Sep 2015 10:43:35 +0000

Australia’s national spy agency has been credited with its first public vulnerability disclosure after reporting a remote code execution vulnerability in an HP Autonomy component.

The Australian Signals Directorate had previously reported vulnerabilities in a variety of software but it is the first time its work has been publicly recognised.

The agency like its overseas peers dabbles in both defensive and offensive security vulnerability and exploitation research.

It says the disclosure is part of its internal security function.

“As part of its Information Security function, ASD has previously disclosed vulnerabilities to vendors. This is the first time ASD has been publicly credited with the discovery and disclosure,” a spokesperson says.

“ASD vulnerability research work has long served the wider information security community, but until now has not received public acknowledgement.

“ASD will continue to work with vendors on the discovery and public disclosure of vulnerabilities in software and hardware as appropriate.”

The vulnerability (CVE-2015-5416) affects an Autonomy component called KeyView IDOL, which parses non-text documents to suck them into databases. The IDOL GIF parsing remote code execution hole is rated a severity score of 7.5 and allows attackers to execute arbitrary code on vulnerable installations

Victims must fall victim to phishing attacks or otherwise visit malicious pages or open malicious files to be exploited.

“It is possible to trigger a buffer overflow by specifying an overly large ImageWidth within a GIF. A remote attacker could exploit this vulnerability to execute arbitrary code under the context of the process.”

A fix has been issued. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: TheReg http://go.theregister.com/feed/www.theregister.co.uk/2015/09/23/aussie_spy_agency_gets_first_bug_bounty_credit/

Bloodthirsty data parasites hungrily eye up healthcare sector

admin — Thu, 24 Sep 2015 10:43:34 +0000

The healthcare industry sees 340 per cent more security incidents and attacks than the average market segment, according to a new study by Raytheon|Websense.

Raytheon|Websense also warns that healthcare organisations are more than 200 per cent more likely to encounter data theft. Carl Leonard, principal security analyst at Raytheon|Websense, said that healthcare organisations are targeted by hackers because of the richness of the data they hold, which once stolen can be monetised via various scams.

“Healthcare records hold a treasure trove of data that is valuable to an attacker,” Leonard explained. “No other single type of record contains as much Personally Identifiable Information (PII) that can be used in a multitude of different follow-up attacks and various types of fraud.”

The rapid digitisation of the healthcare industry, combined with the value of the data at hand, has led to a massive increase in the number of targeted attacks against the sector, according to Raytheon|Websense. Health records not only contain vital information on the identity of an individual (name, address, social security) but also often link to financial and insurance information.

“Access to PII allows an attacker to commit identity fraud, while the financial information can lead to financial exploitation,” Leonard added. “This is a logical and profitable secondary attack area for cyber-criminals who have already dealt in stolen credit card data.”

Healthcare data leaks doubled between 2013 and 2014, leading UK data privacy watchdog the ICO to levy fines totalling £1.3m against NHS organisations.

Malware slingers are targeting healthcare organisations worldwide. Healthcare is 4.5 times more likely to be impacted by Cryptowall (ransomware designed to blackmail users into paying a ransom for the release of their data) and three times more likely to be impacted by Dyre (malware designed to steal financial data), according to Raytheon|Websense.

“As healthcare organisations are committed to delivering excellent patient care, there is a must for a high availability of data stores, and malware authors are aware of this. As a result, they are targeting this industry,” Leonard explained. “Healthcare records also contain information which is up to ten times more valuable on the black market. Malware authors are determined to launch advanced malware in order to secure access to that valuable data.”

The figures from Websense Security Labs’ 2015 Healthcare Drill-Down Report (available here) came from an analysis of “real-world attack telemetry”.

The study (extract below) provides an overview of the modern healthcare industry landscape, where various trends and pressures are creating a febrile environment for hacker exploitation.

Modern medical care is delivered through an incredibly complex network of information technology systems connecting patients, doctors, nurses, pharmacists, technicians, administrators and accountants with electronic health records (EHR), connected medical devices and insurance companies. Driven by the need to improve patient outcomes and lower costs, the rush to embrace digital technology has created a complex network of connected devices, systems and entities where security may be an underfunded afterthought.

Network security is further complicated when IT must balance protecting data from inappropriate access against the fact that lives could be lost if medical personnel cannot access the information they need, when they need it. Data thieves recognise both the incredible value of healthcare information and the vulnerabilities and security gaps which exist in this newly-connected world.

Raytheon|Websense’s concern about the growing security problems in the healthcare sector is shared by other security researchers. The healthcare industry was the one most effected by data breaches, according to a new study by Trend Micro based on an analysis of 10 years of data from the Privacy Rights Clearinghouse. The top three breach methods in the healthcare industry were loss or theft, insider leaks and unintended disclosures.

Trend’s research paper, entitled Follow the Data: Dissecting Data Breaches and Debunking the Myths, analyses data from security breaches between 2005-2015 as logged by PRC. Focusing on leaked data rather than who has been hit by data breaches can yield valuable insights that might otherwise get missed, Trend Micro argues.

“Much of the attention surrounding these breaches has been focused on who’s affected and how they can recover,” a Trend Micro blog post explains. “The stolen data on the other hand is treated as a lost cause. But there is so much more to learn from studying what was stolen. By following the data, we can get a picture of what attackers are looking for, how they use the data, how much it costs, and where it eventually ends up.” ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: TheReg http://go.theregister.com/feed/www.theregister.co.uk/2015/09/24/health_sector_hack_prognosis/

Facebook’s security now sexier, with killer curves

admin — Thu, 24 Sep 2015 10:43:32 +0000

Facebook has boosted its security chops with support for better bang-for-buck email encryption.

Menlo Park now supports OpenPGP’s standard elliptic curve cryptography public keys meaning security and privacy pundits can post their public keys which will then be used to encrypt email notifications.

It supports NIST curves P-256, P-384, and P-521, and is considering non-NIST curves down the track.

Security software engineers Jon Millican and Steve Weis together with operating systems production bod Phil Dibowitz worked on the initiative.

They say users of the likes of ProtonMail have been calling for encrypted Facebook email support.

“Elliptic curve cryptography offers high levels of security for relatively smaller key sizes and is being widely adopted in modern cryptographic implementations,” the geeks say .

“This new support allows you to post ECC public keys on your profile and have Facebook use them to encrypt email notifications.

“We’ve also heard from several organisations that support for Facebook PGP is a popular request from their customers. “

The team plugs ProtonMail, a zero-knowledge email project born from CERN which supports PGP for Facebook in a way that removes the need for users to juggle Bob and Alice’s keys through a GUI in its webmail and mobile app.

ProtonMail co-founder Andy Yen says the support of strong open crypto standards by big tech could be an ‘unstoppable’ win .

“If we truly want to have a more private and secure internet, working together will be crucial and we applaud Facebook for sticking with open standards,” Yen says .

“As OpenPGP is universal, in the future, we will also be able to integrate with countless other services.”

“We are glad that giants like Facebook are supporting these efforts and if more companies join in, the movement to improve privacy online will be unstoppable.”

ProtonMail users can jettison the old PGP setup and immediately begin to fire encrypted Facebook comms using their OpenPGP public keys. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: TheReg http://go.theregister.com/feed/www.theregister.co.uk/2015/09/24/facebook_crypto_upped/

OPM breach included five times more stolen fingerprints

admin — Thu, 24 Sep 2015 04:43:28 +0000

The Office of Personnel Management’s press secretary, Sam Schumach, announced this morning that the breach of OPM background investigation data included approximately 5.6 million sets of fingerprints from federal employees, contractors, and other subjects of federal background checks. The new number, tied to the discovery of additional archived data that was stolen over the period of the breach, more than quintuples the amount of individuals whose fingerprint data was stolen. OPM’s previous estimate stood at 1.1 million. However, the new findings do not increase the overall number of people affected in the background investigation data breach from 21.5 million, Schumach said in an official statement.

Those fingerprints were collected as part of the OPM’s background investigations at all levels of sensitivity—ranging from the “National Agency Check with Written Inquiries” (NACI) inquiries for federal employees with “moderate, low risk and non-sensitive positions” to the full field investigations required for more sensitive positions. Based on leaked statements from the Obama administration, the fingerprint data is now, at a minimum, in the hands of the foreign intelligence services of China. Just how that fingerprint data could be used, however, is not clear.

“Federal experts believe that, as of now, the ability to misuse fingerprint data is limited,” Schumach said. “However, this probability could change over time as technology evolves. Therefore, an interagency working group with expertise in this area—including the FBI, DHS, DOD, and other members of the Intelligence Community—will review the potential ways adversaries could misuse fingerprint data now and in the future…[and] also seek to develop potential ways to prevent such misuse. If, in the future, new means are developed to misuse the fingerprint data, the government will provide additional information to individuals whose fingerprints may have been stolen in this breach.”

Article source: ArsSec http://arstechnica.com/security/2015/09/opm-breach-included-five-times-more-stolen-fingerprints/

Security wares like Kaspersky AV can make you more vulnerable to attacks

admin — Thu, 24 Sep 2015 04:43:27 +0000

Antivirus applications and other security software are supposed to make users more secure, but a growing body of research shows that in some cases, they can open people to hacks they otherwise wouldn’t be vulnerable to.

The latest example is antivirus and security software from Kaspersky Lab. Tavis Ormandy, a member of Google’s Project Zero vulnerability research team, recently analyzed the widely used programs and quickly found a raft of easy-to-exploit bugs that made it possible to remotely execute malicious code on the underlying computers. Kaspersky has already fixed many of the bugs and is in the process of repairing the remaining ones. In a blog post published Tuesday, he said it’s likely he’s not the only one to know of such game-over vulnerabilities.

“We have strong evidence that an active black market trade in antivirus exploits exists,” he wrote, referring to recent revelations that hacked exploit seller Hacking Team sold weaponized attacks targeting antivirus software from Eset.

He continued: “Research shows that it’s an easily accessible attack surface that dramatically increases exposure to targeted attacks. For this reason, the vendors of security products have a responsibility to uphold the highest secure development standards possible to minimise the potential for harm caused by their software. Ignoring the question of efficacy, attempting to reduce one’s exposure to opportunistic malware should not result in an increased exposure to targeted attacks.”

As Ormandy suggested, the bugs he found in Kaspersky products would most likely be exploited in highly targeted attacks, such as those the National Security Agency might carry out against a terrorism suspect or spies pursuing an espionage campaign might carry out against the CEO of a large corporation. That means most people are probably better off running antivirus software than foregoing it, at least if their computers run Windows. Still, the results are concerning because they show that the very software we rely on to keep us safe in many cases makes us more vulnerable.

Kaspersky isn’t the only security software provider to introduce bugs in their products. Earlier this month, security researcher Kristian Erik Hermansen reported finding four vulnerabilities in the core product marketed by security firm FireEye. One of them made it possible for attackers to retrieve sensitive password data stored on the server running the program. Ormandy has also uncovered serious vulnerabilities in AV software from Sophos and Eset.

In a statement, Kaspersky Lab officials wrote, “We would like to assure all our clients and customers that vulnerabilities publicly disclosed in a blogpost by Google Project Zero researcher, Mr. Tavis Ormandy, have already been fixed in all affected Kaspersky Lab products and solutions. Our specialists have no evidence that these vulnerabilities have been exploited in the wild.”

The statement went on to say that Kaspersky Lab developers are making architectural changes to their products that will let them better resist exploit attempts. One change included the implementation of stack buffer overflow protection, which Ormandy referred to as “/GS” in his blog post. Other planned changes include the expansion of mitigations such as address space layout randomization and data execution prevention (for much more on these security measures see How security flaws work: The buffer overflow by Ars Technology Editor Peter Bright). Ormandy thanked Kaspersky Lab for its “record breaking response times” following his report.

Still, the message is clear. To perform, security software must acquire highly privileged access to the computers they protect, and all too often this sensitive position can be abused. Ormandy recommended that AV developers build security sandboxes into their products that isolate downloaded files from core parts of the computer operating system.

“The chromium sandbox is open source and used in multiple major products,” he wrote. “Don’t wait for the network worm that targets your product, or for targeted attacks against your users, add sandboxing to your development roadmap today.”

Article source: ArsSec http://arstechnica.com/security/2015/09/security-wares-like-kaspersky-av-can-make-you-more-vulnerable-to-attacks/

Gartner: Global Security Spending Rises Nearly 5% Despite ‘Commoditization’

admin — Thu, 24 Sep 2015 04:43:25 +0000

Security market to hit $75.4 billion in 2015, but endpoint and consumer software segments slowing due to saturation.

Security spending remains hot — to the tune of $75.4 billion worldwide this year — but signs of a slowdown are showing in certain segments such as endpoint and protection platforms and consumer products, according to new data from Gartner.

The security analyst firm estimates a 4.7% increase in security spending in 2015 over last year, an increase mainly driven by government projects, legislative pressures, and the long shadow of major data breaches around the globe. But Gartner warns that saturation of more mature and established security tools hampering overall growth.

Bigger security budgets are the reality for nearly half of the enterprises recently polled in the Dark Reading/InformationWeek 2015 Strategic Security Survey, with security accounting for anywhere from 1% to 10% of annual IT budgets at half of the organizations in the survey.

Gartner research analyst Elizabeth Kim says cloud, mobile computing, the Internet of Things, and advanced targeted attacks are driving security technology demand. Kim says these technologies are driving spending in newer generation products such as endpoint detection and remediation, threat intelligence, and cloud security offerings such as encryption. Even so, these newer product purchases aren’t enough to provide a sufficient bump to counter the flattening of the more mature and commoditized product sectors.

The firm expects the market to grow at a CAGR of 7.4% through 2019, with the hottest security sectors being testing, outsourcing, and identity access and management.

Meanwhile, the top four security products in most organizations are the same-old, same-old: firewalls (91%), spam filters (88%), antivirus (83%), and VPNs (81%), according to the InformationWeek/Dark Reading survey, with each down a percentage point or two from 2014.

Other findings by Gartner in its “Forecast Analysis: Information Security, Worldwide, 2Q15 Update”:

Up to 20% increase in security product pricing will quell some purchasing, mainly in Europe due to US dollar appreciation;
Data loss prevention (DLP) product market will drop through 2019 due to commoditization and lower-cost solutions;
Less than 5% of companies with more than 500 employees will buy unified threat management (UTM) products for their satellite offices by 2019 — it’s now mainly a small- to midsized business product;
85% of network sandboxing functionality will be woven into network firewall and content security platforms by 2018.

“There’s been a tremendous DLP adoption wave,” says Lawrence Pingree, research director and analyst for Gartner, who co-authored the report. “We’re seeing greater integration of DLP,” which accounts for the drop in the dedicated DLP space, he says. “We will still see DLP playing a role in the future.”

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: Dark http://www.darkreading.com/endpoint/gartner-global-security-spending-rises-nearly-5--despite-commoditization-/d/d-id/1322313?_mc=RSS_DR_EDT

Cloud Security Visibility Gap Dogs Deployments

admin — Thu, 24 Sep 2015 04:43:24 +0000

SANS says visibility is the top cloud security concern.

As enterprises increasingly weave a growing number of outside cloud providers into the fabric of today’s IT infrastructure, visibility into cloud provider operations and security controls reigns as the number one cloud security concern, according to a recent survey conducted by SANS Institute on behalf of Cloud Passage.

In a report released today, SANS analyst David Shackleford says that the opacity of provider infrastructure management remains a huge point of contention among IT professionals, with 58 percent citing it as the biggest problem they have with cloud vendors.

“Regardless of the model used, the issues are the same: Lack of visibility, steep fees for vendor-provided security and lack of compliance support are respondents’ top three concerns with their public cloud services,” he writes, explaining that this is a concern whether organizations are using software as a service (SaaS), platform as a service (PaaS), or infrastructure as a service (IaaS) providers.

This nevertheless is doing nothing to dampen cloud adoption—81 percent of respondents say they expect to deploy a SaaS environment within the next year and well over half expect to deploy PaaS and IaaS.

As organizations seek to square this visibility gap with accelerated deployments, the biggest security challenge they’ll face is in keeping the auditors at bay. Nearly three-quarters of respondents said that maintaining compliance across public, private and hybrid cloud environments has been a huge challenge related to their cloud model.

As cloud adoption continues to snowball, so does the amount of sensitive data in the cloud. Approximately 48 percent of respondents store or process employee records in the cloud and 40 percent store or process customers’ personal information. And 20 percent of organization also use the cloud to store or process intellectual property, customer financial information, and health records.

All of this sensitive data puts a target squarely on the back of these cloud environments and that worries respondents. Approximately 40 percent say they’re concerned about unauthorized access to data by other tenants and 38 percent are concerned about shadow IT in the cloud. And circling back to the visibility concern, well over a third of organizations are worried that the public cloud’s lack of consistent security controls that integrate with on-premises tools and security management make it difficult to keep tabs on data from end to end.

“A number of respondents also specifically mentioned the need for greater security automation, whereby security teams have access to tools and scripts that integrate with provider and SecaaS APIs to better secure and monitor their cloud assets,” Shackleford says. “Security teams are struggling to get enough visibility into cloud provider infrastructure, controls and processes through contracts and audit reports, and say the nature of organizations’ ‘defense in depth’ security stack has to change as well.”

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Article source: Dark http://www.darkreading.com/risk/cloud-security-visibility-gap-dogs-deployments/d/d-id/1322317?_mc=RSS_DR_EDT

Healthcare Organizations Twice As Likely To Experience Data Theft

admin — Thu, 24 Sep 2015 04:43:23 +0000

Bad guys very willing to invest in attacking medical data, but healthcare not very willing to invest in defending it.

Healthcare institutions are twice as likely to experience data theft than other sectors, and already see 3.4 times more security incidents, according to a study released today by Raytheon and Websense.

Why is healthcare so popular with attackers? Perhaps because the balance sheet tips in their favor. Medical records are very desirable on the black market, because medical records, themselves, may be a treasure trove of PII, financial information, and insurance numbers.

The exact figures vary, but while basic PII may run for just $1 on the black market these days, Jim Trainor of the FBI Cybersecurity Division told CBS News in February that “PHI records can go from 20 say up to — we’ve even seen $60 or $70.” A new report released by BitSight today references a recent report by NPR’s “All Things Considered” which found a “value pack” of just 10 Medicare numbers that sold for about $4,700.

Yet, security measures that ensure those records stay confidential can inhibit patient care — or at least that’s how it seems to some medical professionals. Nurses and physicians fully understand the importance of data availability, but when patients’ lives are on the line, data confidentiality takes a back seat.

According to the Raytheon Websense report, healthcare professionals “have an increased tendency to try and get around IT security policy in order to better serve their patients” and “up to 75 percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.”

“Outside of stock trading, I can’t think of another industry where you have to err on the side of openness,” says Bob Slocum, senior product marketing manager of data and endpoint security for Websense. Further, there is no other industry, he says, where an employee (like a doctor) can routinely trump a security policy.

The end result is that attackers are far more willing to invest in stealing medical records than healthcare institutions are willing to invest in protecting them from being stolen.

As the Raytheon Websense report references, the average healthcare organization only spends about 3 percent of its IT budget on security, even though HIMSS recommends they spend at least 10 percent. Bitsight reports that while healthcare has done a good job closing up those Heartbleed vulnerabilities (only 4.4 percent), it’s still wide open to FREAK (43.4 %) and POODLE (73.5 %).

Conversely, attackers will bring their best tools to bear. According to Raytheon and Websense, healthcare organizations are four times as likely to be hit with advanced malware — particularly the CryptoWall ransomware (450% likelier), Dyre Trojan (300% likelier), and stealthy Dropper (376% likelier), which opens backdoors and drops other assorted payloads.

Healthcare is also 14 times as likely to be hit by the Andromeda botnet — which has a particularly stealthy loader with anti-VM and anti-debug capabilities that can stay silent for months before it communicates with its command and control server, according to Raytheon and Websense.

Slocum says that he expected the numbers to be bad, and but not quite as “astronomically bad” as they were.

Plus, while outside attackers barrage them with malware, medical institutions also have malicious insiders to worry about. According to a report released yesterday by Trend Micro, healthcare has a larger insider leak problem than any other sector, attributing 17.5% of its breaches over the past 10 years to it. Insider leaks were the primary source of identity theft cases (44.2%) and healthcare was hit harder by identity theft than any other sector, accounting for 29.8% of cases.

The Bitsight report has declared healthcare the second-worst industry performer in data security, ahead of only education. According to Trend Micro, more than one-quarter (26.9%) of the data breaches reported in the past 10 years were in the healthcare sector.

And it isn’t only an American problem; as the Raytheon Websense report cites, the U.K.’s National Health Services has been fined £1 million for its data security transgressions.

Complexity contributes to the problem. Multiple hospitals, labs, imaging centers, and pharmacies in multiple locations share data and computing resources.

The complexity just increases as the early-adopting industry hooks more medical devices into the Internet of Things. As guests of today’s Dark Reading Radio episode on “Fixing IoT Security” remarked, one of the challenges of the IoT is installing software security updates — something that is infinitely more complicated when the device needing the update resides within a patient’s body.

Slocum says he takes the issue to heart, being a diabetic himself, but that medical device manufacturers he’s spoken to have been very proactive about security — not only by inviting ethical hackers to try to break into their devices, but by securing their other systems extra carefully, knowing that any sort of breach would damage their brand reputation and thus people’s trust in their devices.

Slocum says there’s some reason for optimism. He says that IT leaders in healthcare oganizations have been “beating the drum” and asking their CEOs for cybersecurity funding for years, to no avail; but since the Anthem breach, the conversation has changed.

“I believe they’re going to get more [money] and executive support,” he says. He recommends that they direct some of these funds to more unified solutions that can manage complex environments and to better end user awareness training.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad … View Full Bio

Article source: Dark http://www.darkreading.com/risk/healthcare-organizations-twice-as-likely-to-experience-data-theft/d/d-id/1322312?_mc=RSS_DR_EDT