Hackers Broke into Change Healthcare's Systems 9 Days Before Cyberattack
wsj.com
wsj.com
Can't say I'm surprised that despite all this security theater, Change Healthcare still fails in many spectactular ways.
From a finTech perspective, the nüMedical people I've dealt with act like they won't be held liable for their lack of planning. I see funding in general at levels that require noncompliance with all kinds of regulations, and it would be easy to demonstrate the disconnect between demands given and resources provided in almost every domain by just walking through each step of a process.
The reason those incidents aren't found is simple: too much data and too much alerts to handle, given that CSIRT teams are less than 10 people even for a company the size of Siemens, which manages all kinds of critical infrastructure (including nuclear power plants, which I'd say is far more than critical if anyone of the white house reads this).
All those elastic search based dashboards simply don't cut it, and most malware lays low for a while because they assume that nobody has petabytes of storage available due to absurd pricing for those. That's why there's literally a timeout for a couple days until the persistence and lateral movement step is done, and signs of breaches are gone because the database has to be wiped.
Also, this is the reason why bigger threat actors like APT28 and APT29 make use of social shitstorms (/pol/, kiwifarms, 4chan, anonymous groups on telegram etc) to hide their tracks. They simply flood the logs of the target's system until there's no storage capacity left to hide the actual breach of the actually targeted system.
That's why I started to push EDR into the decentralization age of networking, signing, isolation and proactive communication between peers with my startup. That's the only way to scale those kind of incident logs effectively and the only way to effectively deal with assumptions of compromise to find out which accounts have what kind of access across the network.
Hey, wanna guess where they're trying to push AI driven "insights" right now? That's right, all of cybersecurity roles.
Rather than add headcount to teams, or spin up new teams to section off pieces of a business that might need more customized attention, AI is now being shoved down the throat of security engineers and SIRT teams to handle the massive amount of data involved and to present a human with some little nugget of information to act on, all the while sweeping away the rest as irrelevant.
Useful as a tool? Sure. Able to reduce workload on existing teams? Absolutely. Able to replace the need for more human eyes looking at the problem space and figuring out ways to filter the data for meaningful events? Eh, maybe but I'm not going to hold my breath on it either.
It's the same story with AI across every industry right now.
As long as deep learning concepts are used across the board which lose symbolic inference, this approach won't work. But who am I to tell them, we're still using AlphaGo agents in an ES/HyperNEAT simulation for pentesting and nobody believes us when we tell people this is the only way to make this work in that problem space.
We are just too uncool for the LLM hypetrain, I guess.
This sounds like an economic collapse similar to an ecological collapse due to a single genetic monoculture.
Translation: One year of free credit monitoring.
What a disaster.
> “I don’t think we’ve had a single provider that hasn’t been helped that’s contacted us.” As part of that help, Mason said, UnitedHealth has sent providers $7 billion so far.
Is that misleading? Or am I not understanding something about how all this works?
I should mention that I don't hold it against them.
A secure system should be designed with the assumption of compromise.
No single person should have access to the whole system. No single entry point should have access to everything.
And so on.
Ran into this problem at one company. Boss wanted a secure system. Nobody knew about security but me. Couldn't lock myself out of a system that I had to hold the keys to
The MBA-ification of the world seems to have created an archetypical believer among its other many evils.
One could reasonably posit that Germany lost WW2 because they used Enigma for important stuff, and when Enigma was compromised, their operations were compromised thru the end of the war. For example, Enigma was the cause of Rommel's defeat in Afrika.
A secure system facing the internet should have the default ports changed...then should someone with a zero day and the exploit posted on Git...casual scanning for the known port will fail.
$22-million???!!!
I'm guessing they'll recoup through some sort of insurance for this type of thing. But honestly, what insurer would pay out for that? It's like they didn't even try to secure their systems.
I work for a cyber insurer (who are trying to reduce the risk of compromise, alongside transferring some of the risk via insurance) - providing they’ve not been misleading in their application, we take the risk as we find it and can’t just not pay because of poor cyber controls.
Though given the size of involved parties just about anything can be waived (especially with legal threat of an agency losing power over a court striking it down).