PhRMA takes Cures Act to the Hill

Drug industry is going straight to Capital Hill to meet with lawmakers in hopes to curve the discussion and set precedence instead of a wait-and-see approach that only leads to contentious debates.  Leading the charge while the Senate ponders the FDA reform bill called 21st Century Cures is PhRMA's CEO.  The Act could be a ground breaking approach to a Pharmaceutical industry plagued with price gauging and notorious leadership that has come into question.  Steve Ubl, CEO PhRMA intends on having both scientists and patients speak directly with lawmakers in hopes to shape emanate policy making.
The 30K view of Cures is focused on medical innovation, FDA approval process and new drug….so topics around exempt reprints and reference text related to Sunshine Act (reversing some CMS rule), extension of FDAMA 114 for manufacturers communication with scientific developments, FDA new development guidelines and reversal of some FDA regulation on social media.  For specifics, turn to docs.house.gov
For IT, Healthcare vendors will notice downstream affects from HIPAA related to upgraded and compliance to practice management software including:

• Fax machine (like Mainframes) - lingering deployment so added tracking and security will be required
• Security training - updates programs / procedures and mandatory awareness training 
• Access control - increased protection of PHI including audits and proactive account management
• Physical security - facility and equipment room security protection, badges and key codes
• And, all this with increase healthcare data access

.suprise another ransomware

A new remote-control ransomware called surprise has surfaced, working off of memory whereby another executable of an encrypted BASE64 encoded string is launched to encrypt your files (except with $ symbol or in C:\windows or C:\programs)…then, executes a delete executable to remove shadow files and provides you with a notepad ransom note.  The trend apparently, is linked with use of TeamViewer software but the ransomware trail has reportedly gone cold and thus, cause/source is unknown/unconfirmed.  TeamViewer rejected reports it's logs/accounts were compromise/posted or the flaw within it’s software since it deploys end-to-end encryption, applies botnet attack protection, etc. accourding to myce.com

Just a quick news flash...and one of many dBs of victims at haveibeenpwned.com - for your edification

Retailer beach impact

By the numbers...and this report by Entrepreneur does the summary:
• 64% of shoppers have accepted security breaches to be part of the shopping process and 53% say that security breaches are a risk they’re willing to take in exchange for convenience...
• 43% of shoppers (compared to 45% in 2014*) don’t trust companies to keep their personal information safe. Of these, 30% don’t think companies invest in enough security measures.
• 85% of shoppers are aware of companies that have had a security breach where customers’ personal financial information was exposed.
• 39% spend less per shopping trip than before (Compared to 26% in 2014*)
• 69% try to use cash instead of credit/debit cards (Compared to 79% in 2014*)
• 60% shop online with one specific card designated to online purchases so that they can monitor its activity
• 62% of shoppers have used credit and/or debit cards with chip technology to make purchases. Of these…
• 71% say that using credit card with chip technology makes them feel more secure when shopping.
• 60% prefer to use a card enabled with chip technology over any other method of payment.
• 26% say that they do not like using a credit card with chip technology because it takes too long
• 80% Being honest about the incident
• 73% Communicating with shoppers and responding to questions
• 72% Taking financial accountability for their mistake
• 69% Investing in additional preventative security measures
• 6% Firing their CEO
• 6% Firing the head of the IT department

Onto breaking news that the Justice Dept is withdrawing legal action against Apple's iPhone related encryption case of San Bernardino since the encryption was cracked by an unidentified entity...according to USA Today.  Nothing is unbreakable...surely more to follow on this topic

For Sale: 1.5 million Verizon customer info for $100K or $10K chucks

Verizon Enterprise customers information and CNBC reports stolen via communication subsidiary - but not hacked was the phone network / Customer Proprietary network Information (CPNI)…according to KrebsOnSecurity
The teller and hacker analytics reporter, Verizon is now investigating its own and will be addressing potential exposure of confidential data on the black market and then, long term brand topic.

It pays for Ransomware

Is the consensus to pay or not, for your data back? Is there guarantee your data will be unencrypted? Good thing your or your organization diligent performs daily/incremental backups, correct?
Unfortunately, there is no do-it-yourself kit to unencrypt once infected with variants of ransomware.  As mentioned in past posts, the best precaution is not open or clicking on emails/links you do not trust.
Last month, Hollywood Presbyterian Medical Center fell victim when hospital systems were held ransom for money.  And since we are a global society, during the same time frame, two German hospitals also became victims (as well as a LA hospital).  That's just a snapshot of the hospital industry but it's happening in retail, financial, manufacturing, etc.  While the uptick is confirmed, reporting of incidents vary or simply, lack thereof.  The rise will also come from novice cybercriminals that will use ransomare-as-a-service model to accelerate growth throughout various business sectors or individual cases.  But the mass impact is still brewing as increasingly store and share data in cloud services.  So, the traditional perimeters are disappearing and so will the home and office through wearable devices when considering 6.4 billion connected devices said to be connect by Gartner in the next year - meaning, everything connected from one device/PC to another, one local drive to another shared drive, one company database instance to another...
Aside from good backup and fully investigating your options e.g. law enforcements, it’s all about proportions.  That being, putting a price on how much your data is worth to your company and how much your company's networth/value i.e. large organization have resources to pay the millions of dollars being asked.  Aside from the latest, Locky and PadCrypt, the most lucrative malware being, CryptoWall with at least 3 variants, TorrentLocker, TeslaCrypt, and CTB-Locker.  Practical experience tells me never to pay up but according to c|net “When you face the real deal, even the FBI says you should pay.” So, choose wisely…

It’s worth noting that payout does not necessarily mean cold cash delivery but in bitcoins.  Don’t know how to buy up large amount of bitcoin.  Well, you may also be sent with links or online chat on “how-to”.  That’s right, a help desk on how to extort funds to the source, your criminal holding your data hostage.  No joke and certainly not a laughing matter!
Number resulting from analysis of CryptoWall affects include, from Cyber Threat Alliance:

• 4,046 malware samples 
• 839 command and control URLs 
• 5 second-tier IP addresses used for command and control 
• 49 campaign code identifiers 
• 406,887 attempted infections of CW3 
• An estimated US $325 million in damages

Mostly accomplish through phishing (other 1/3 being exploit kits with Angler being at the top of the list) either through attachments and/or redirection of landing page (sometimes with help from out dated or vulnerable web browser); and obfuscating exe files in PDFs, flash or other MS Office type files. So, upshot for prevention is awareness and implementation of various levels of security training/phishing techniques, firmware-browser/OS patching, sound application security practices, and base foundation for kill chain methods via implementation of Anti-virus/Anti-spam, Intrusion Detection Sensors, Web filtering, SSL inspection, Data Leakage Prevention, and appropriate incident response and management.

2016 Top Hacking Tools

Back on the top from 2015 are: Nmap, Metasploit, Burp Suite, John The Ripper, THC Hydra
Others listed on www.techworm.net—

• 2016: Acutenix Web Vul Scanner, OWASP Zed Attack Proxy Project, Wireshark, Burp Suite, Aircrack-ng
• 2015: Cane and Abel, Angry IP Scanner, Burp Suite, Nessus Remote Security Scanner, Ettercap, Wapiti

Nice to see some of the oldies of 10+ years ago have continued to make the top of the list including: Nmap, Metasploit and John The Ripper!  The fundamental of network sniffing, password cracking and vulnerability exploitation has remain static - and as open source and some really cheap investments.  Technology has advanced but the same tools that guaranteed 100% success in penetration testing have not. I would also add to the collection: WebScarab, DumpSec, netStumbler, Nipper, Minikatz, netcat, Ngrep and suite of PS tools…  Happy hacking from VMs instead of the old/clumsy drive partitions ;)

Oncology data breach

2.2 Million patient names, SSNs, diagnosis/treatments, and insurance information hacked – copied and transferred.  Notifications were sent to past/current patients if 21st Century Oncology, Florida-based healthcare provider, (across 145 cancer treatment centers in the U.S. and 36 in Latin America).  Of course credit monitoring was offered as a result.  Notification came from the FBI of the data loss and after the company hired investigators, revealed hackers accessed the database in October 3, 2015 but we’re authorized to publically notify till March 4, 2016. Questions remain unanswered (or to be published) by why weren’t 21st Century Oncology security and systems altered of the issue beforehand?  And not to confuse it with the 34 Million Fraud case...
This is coming off the heels of a settlement (unrelated) of St. Joseph Health patients to receive $242 (and plaintiffs can apply up to $25K for suffered identity theft losses) based on a 2012 data breach.  Of course attorney fees/costs mounted to $7.5 Million.  St. Joseph also spent more than $17 Million on added security systems and $4.5 Million on credit monitoring fees for patients.
Details: businesswire.com 

Breach or not - Retailers and regulators again

To investigate effectively and not cause panic without having full/most of the background, security breaches are not made known for a little while until an organization (or investigators) has formalize a communication strategy.  Hence, Amazon’s recent email blast regarding resetting passwords could be a prelude to sometime - or maybe nothing at all.  Based on the limited details thus far, it does not appear to be a phishing attempt since no link is present in the email, yet a mention of passwords might have been posted online thereby, suggest of changing.
In an unrelated matter, the CFPB (Consumer Financial Protection Bureau) issued its first Consent Order against an online payment platform – questioning reasonable and appropriate data security practices not in place i.e. not meeting at least industry security standards.  Citing mishap in employee data security training, lack of encryption, no periodic internal risk assessment and missing policies, procedures, etc.
Hence, CFPB issued order without prior report of a breach and is proactively representing consumers (which is adding to the growing awareness) and actions taken by authorities such as SEC and FTC (Securities and Exchange Commission and Federal Trade Commission).  CFPB included the following recommendation:

• Annual/bi-annual security risk assessment
• 3-rd party to perform audit
• Maintaining reasonable procedures
• Encrypting data
• Regular employee training
• Appropriate customer identity authentication
• Update security patches for web and mobile applications

Tale of two breach payouts

Can’t help but compare Home Depot's $19 Million vs Erin Andrew's $55 Million though realizing it’s two different kinds of breach, or is it?  Loss of privacy, sensitivity information, trust, and the other weighing in more on dignity...
While Erin Andrews court appears comes to a close (pending potential appeals), Home Depot is will to pay out $13 Million in funds for “reasonably traceable fraud” to compensate 56 Million effected customers’ out of pocket costs (from a malware breach of credit card information in 2014).  Proposed class action lawsuits amount to at least 57 filed in the U.S. and Canada; but the balance of the funds would go to legal fees.  And, on the other side, speculation has it that the sports announcers may only end up with approx. $5 Million after all the legal fees / attorney profits, etc.  Home Depot also reported booking $161 Million in pre-tax expenses for the breach… Of course, the infamous Target breach offered $10 million to settle the class-action lawsuit; and Obama’s administration reported to have shelled out $19 Billion to improve security for individuals, companies and government agencies.

By the numbers...of headlines making the news this week

International Women’s Day – except from RSAC2016 and more

Women account for 10% for the InfoSec workforce which remain consist from last year…according to ISC2.org.  The number is bumped to 20% for GRC (Governance Risk and Compliance) and risk management roles.  Women considerably dominate in these role both as leaders and practitioners (versus mostly operational roles where men dominate in both role types).  So, shortage in technology talent estimated at 545,000 and Symantec saying 1.5 million by 2019) is consistent and filling the roles, regardless of gender is attributed to mixture of monetary and non-monetary incentives...more so than ever. Study also showed a spike of interest from women post 9/11; and women are taking jobs the men aren’t.  Women employed percentage totals (ISC2):

• 74% HR Managers
• 38% Management occupations
• 26% Cmoputer and information systems managers
• 26% Chief executives
• 25% Computer and mathematical occupations
• 18% Information security analysts

Titles are one thing, but experts predict 65% of children entering schools today will have entirely different job titles by the time they enter the workforce.  Retention mimic each other regardless of gender but 3 areas where women leave are a result of:

• Poor leadership / management: 44% women vs 39% men
• Unhappy with work environment/culture: 41% women vs 34% men
• Lack of work/life balance: 26% men vs 21% men

In a salary study of mostly U.S. respondents, the results show women in GRC groups average salary were 4.7% less than men ($115K vs $121K); and while salary is approximately equal or more throughout the ranges except for salaries range over $120K.
Takeaway is invest in women/girls, roots of socialist holiday and first held in 1914 till UN proclaimed it as a holiday in 1977…and now, 2015 International Women’s Day
Additional links: UNwomen.org | The Guardian | India | quotes

RSAC2016 25th Anniversary

Another great show at #RASC2016 except the crowd this year – So, brain dump of key takeways. First, I did not win the CloudLock Harley Davidson raffle [Bummer]. Other big ticket items including asking yourself “what does the data say” which runs parallel my own motto, “follow the data” trail.  Both have significant impact in how you address holistic data security practices, diversity in implementation and incident recovery.  Having an exit prevention strategy, for example, can be as essential, if not more, to being proactive and preventative controls.  While it has been proven that no security is full proof, there are many commonalities the root-cause. But first recapping the notables: Anthem 80 Million medical records which is the largest of it’s kind and new pathway to type of rich data breach; Premera for 11 Million accounts compromised for over 9 months which would segway to Dwell-time (I posted in the past)?; or Ashley Madison for failure of contracted services and security (so not actually/so much for the profile who likes what data itself i.e. $19 fee for deletion of data was not delivered prior to incident); 333,000+ IRS breach of records which is still climbing – that revealed 400,000 attempts of credits reports leading to this hack…
And so the commonalities:

• Improperly segmented networks
• detection deficit disorder (ignoring or looking at incidents in wrong places)
• Failure to white list
• Not monitoring critical systems
• Poor awareness
• No multi-factor authentication
• Phishing messages 

Can’t have an IT discussion without, The Cloud – Companies should be responsible for their data and so warrants should be issued to the individual organization not to the cloud service providers.  Yes, worth more than a few words but does allow and command more transparency for customers and their clients to have the level of “trust” and necessary attestation upon signing-up for cloud services.  Matters of privacy is a timeless value and a balance between right to privacy and personal data, public value, and safety will be in the hot seat in legal, courts as the laws try to catch up with technology.
RSA’s key note heightened the privacy issues and how that would related to opening pandora’s box for allowing backdoors, etc. revealed without textual diligence, modern technological construct and consideration of its impact, both fundamental practices in the past as well as decisions for the future.

So, what’s the long-and-short? Defense in Depth is Dead. The source is not connecting data elements and lack of collaboration within teams and outside company boundaries.  Solutioning is based on now based on integration and not layers!  The 6 key domains are

• Discovery-got to know what’s on networks not just servers but cloud providers, IOT
• State of security for each asset we own – not just vulnerability , malicious file e.g. phishing exploiting client-side vulnerability
• Need ability to monitor activity across the network – packet inspection integration
• Analyze – pulling domains together (event correlation, behavior analysis) to prioritize
• Response – typically the SOC and effectively response
• Protect – proactively protect devices (NOT prevent) and can it be done in an automated way – longest item for industry to solve since it’s based on trust of ability to do this

As a result, the upshot is (1) results will be visibility (for all state of assets including shadow), (2) understanding critical context (to prioritize threats/weaknesses), and (3) ability to take appropriate action in a decisive manner.  Conclusion instead is Long Live Depth in Defense.

More recap / notes...as RSAC comes to a close