4 ms·

My university IT (which also runs a huge hospital network) seems to have no idea how to secure their data. Their solution is to encrypt everything, as if disk e

My university IT (which also runs a huge hospital network) seems to have no idea how to secure their data. Their solution is to encrypt everything, as if disk encryption and VPNs are enough to prevent data theft. They rolled out a csmpus-wide VPN requirement recently based on a Juniper networks system - the exact same system that led to the Anthem data breach that lost 80 million patient records (because Juniper had a slow patch cycle after Heartbleed). No two-factor auth on the VPN, so any one of 50,000 employees with phished credentials could give an attacker VPN access. Meanwhile all the actual patient databases are old, leaky systems they seem uninterested in upgrading. Sheer lunacy.

yeukhon 11y ago
You don't have to hack the system. You can literally just look at trash cans and you will probably find some medical records. I seriously doubt most people shred the document... criminals can do inside job, and this happens without anyone even knowing. As a nurse you can probably download all patients records. I don't know if anyone is required to scan some temporary access code to get records. I do know there are logs, but they are more for compliance than anything IMO. In fact, in many IT organizations, I seriously doubt anyone even look at logs. They are there for compliance, mostly mean when shit happens, there is evidence. Aftermath. This is why AI can help in intrusion and anomalies detection (understanding context). It is like talking about virus and malware detection... Also, a lot of the two-auth out there has the option to Remember This Computer so if the computer is hacked you are doom. I am interested in what constitutes frequent-access data access and infrequent-access data because then you can classify behaviors. Logging, encrypt in transits and at rest are required, but I doubt most of the data are encrypted in transit (probably just proxy over 80 and reaches the terminal screen).

yeukhon 11y ago

You don't have to hack the system. You can literally just look at trash cans and you will probably find some medical records. I seriously doubt most people shred the document... criminals can do inside job, and this happens without anyone even knowing. As a nurse you can probably download all patients records. I don't know if anyone is required to scan some temporary access code to get records. I do know there are logs, but they are more for compliance than anything IMO. In fact, in many IT organizations, I seriously doubt anyone even look at logs. They are there for compliance, mostly mean when shit happens, there is evidence. Aftermath. This is why AI can help in intrusion and anomalies detection (understanding context). It is like talking about virus and malware detection... Also, a lot of the two-auth out there has the option to Remember This Computer so if the computer is hacked you are doom. I am interested in what constitutes frequent-access data access and infrequent-access data because then you can classify behaviors. Logging, encrypt in transits and at rest are required, but I doubt most of the data are encrypted in transit (probably just proxy over 80 and reaches the terminal screen).