7 ms·

I've come to the conclusion that whatever is computerized is going to be leaked. Health records? Might as well open source them for all I care. Red team is tena

I've come to the conclusion that whatever is computerized is going to be leaked. Health records? Might as well open source them for all I care. Red team is tenacious and the steps you have to take to actually keep everything secure make you seem unreasonable. I've moved on. It's more important to focus on election security and physical security at this point. Infosec is dead. Five years ago Bruce Schneier wrote a book called "Carry On" now he has one called "Click Here to Kill Everybody". Just five years. We're in a technological growth feedback function and we're unable to predict it.

ergothus 8y ago
Author David Brin has (relatively) long advocated that we have two options: shoot for privacy resulting in those with power able to access the "private" info, or have it open where everyone can access. He then argues for the latter because it minimizes rather than maximizes abuse. (I'm paraphrasing and summarizing, possibly poorly) I struggle with being _comfortable_ with that idea, but I don't have a problem believing the technical accuracy of it.
- xevb3k 8y ago
  Interestingly (because the parent is about Schneier). IIRC Schneier argues against this. The argument is that even if everybody has access to all information, only a small group is able to exploit that access effectively. So, you still end up with a small group abusing their access to the information. You should therefore aim for privacy of sensitive information.
  - cortesoft 8y ago
    Yeah, I think a good example of this is thinking about something like license plate scanning. Technically, this is not taking advantage of any public information. It is just capturing images of things happening in public. Anyone could set up a camera and capture license plates as they drive through an intersection. So is it totally fine for a police force to scan license plates at every intersection? The question is complicated, because the effect on people changes when you do something that is not worrisome on a small scale in an automated way at a large scale. When you add in that the people doing it have a large amount of power over people and it changes it even more.
    - komali2 8y ago
      Well hold on, the difference there is the police can cross reference scanned plates against other databases the public doesn't have access to, yeah? Or is there some way to id plates against names? If there is I wanna know cause I wanna ID whoever knocked my motorcycle over
      - xevb3k 8y ago
        If you had near continuous location information for a license plate it would be relatively simple to use it to narrow it down to a small group of people. I’d imagine it would be relatively easy to figure out where someone works and/or lives and just go find them. Correlating across multiple public databases might make things even easier. But I don’t think this is the point of the argument. The point is that those in power can gain more benefit from the information than the general population. Let’s say all votes in elections become public. That information is more useful to a powerful political party than to the public at large, or a small unfunded group. If you don’t want that information abused, the argument goes, you should make sure it’s kept private.
- dredmorbius 8y ago
  In practice, the forced revelation of information makes individual privilege and power more important. When everyone has to play with their cards on the table, so to speak, then people who feel like they can be themselves without consequence do so freely -- these generally being people with support groups of like-minded people, and who are neither economically nor physically vulnerable. People who are more vulnerable to consequences use concealment as a method of protection: it makes it possible to speak freely about controversial subjects, or even about any subjects, without fear of harassment. -- Yonatan Zunger, chief architect, Google+ https://plus.google.com/+YonatanZunger/posts/WegYVNkZQqq https://plus.google.com/+YonatanZunger/posts/WegYVNkZQqq
- WorldMaker 8y ago
  For anyone curious for more information, Dr. Brin's largest work on the subject is the non-fiction collection of essays called The Transparent Society: https://en.wikipedia.org/wiki/The_Transparent_Society https://en.wikipedia.org/wiki/The_Transparent_Society Published in 1998, I think it's probably still the most fascinating work on privacy of the post-internet age. More fun fictional explorations of the subject can be found in his novels Kiln People and Earth.
cuboidGoat 8y ago
I worked in a factory that produces critical parts for both the nuclear industry and the silicon fabs. Their main software stack is old dos software with a win95 front end bolted on running in compatibility mode with an integrated database that went obsolete in the early '90s. I asked them what protections they took against hacking, and they told me that nobody would be interested in what they do, so they didn't have to spend any money on protecting themselves.
- jakelarkin 8y ago
  security by obsolescence is a thing too
  - FactolSarin 8y ago
    It's actually one of the security layers for America's nuclear arsenal https://www.businessinsider.com/hacker-us-nukes-report-2016-5 https://www.businessinsider.com/hacker-us-nukes-report-2016-...
  - cuboidGoat 8y ago
    Security by obsolescence isn't the thing where you just dump old code on internet connected computers and steadfastly refuse to do any form of technical assessment other then "Does it run?", due to the assumption that nobody would be interested in screwing you over, though.
- FactolSarin 8y ago
  Was that computer connected to the Internet? If not, then no problem.
  - EvanAnderson 8y ago
    Define "the Internet". Do contractors plug laptops into the network with these "air gapped" computers? How about IoT devices? Printers? I can't recall who said it, but a venerable infosec practitioner once said "Think of an air gap as a very high-latency connection."
jugg1es 8y ago
I work for a healthcare IT company that deals with tons of PHI (protected health information) and we have very strict security practices. New software is extensively evaluated at several points in the SDLC for security issues and access is tightly controlled. Engineers and CEOs have been held personally liable for major breaches (not my company!). Health records are WAY more protected than your SSN. If what happened to Equifax happened to a company like Epic, they would go out of business.
- specialist 8y ago
  None of your systems store patient data encrypted at rest. Inadvertent data breaches are inevitable. The very best you could possibly do is access logs and auditing. Which of your customers do any kind of auditing?
  - paul_milovanov 8y ago
    Hold on, do you know for a fact that EPIC specifically doesn't encrypt data at rest? I'm not questioning your competence/knowledge, just trying to understand specifically what you're saying.
    - specialist 8y ago
      The database or file system is likely (hopefully) encrypted. I'm referring to record and field level encryption. Like this: Translucent Databases http://a.co/d/5855TYO http://a.co/d/5855TYO http://wayner.org/node/46 http://wayner.org/node/46 Think of how password databases don't actually store passwords. Instead they (should) be storing salted and hashed passwords. --- Please see my other comment about plaintext demographic data vs using unique identifiers.
  - sterwill 8y ago
    Although at-rest encryption of health data is an addressable part of US health regulations, not a required one, it's almost always done because it's easy and effective. Most electronic health records are encrypted at-rest.
specialist 8y ago
I've worked on both election integrity and electronic medical record exchanges. I care very much about privacy. Your conclusion is correct. Medical records cannot be encrypted so long as demographic data must be stored in plaintext. Otherwise how would we do record matching (linking) across heterogenous systems? The fix is to use universal identifiers. Once you moot the record matching problem, you can use translucent database techniques to anonymize patient data. I don't expect the USA to adopt an official centralized universal identifier for people any time soon. And none of the 3rd party solutions (NSA, LexisNexus, ChoicePoint, Facebook, etc) are acceptable, for various reasons.
- Kostchei 8y ago
  Homomorphic encryption, anonomized data coupled with metadata, searching via k-Anonymity models. I mean, sure it has a cost, some of this stuff is new, but to say "cannot be encrypted"... that's where the fun is- working out how to do it.
- paul_milovanov 8y ago
  Hold on, even if you keep the demographic data in plaintext, surely you can encrypt the actual HIPAA-protected data?
  - specialist 8y ago
    If you figure out how to do that, please let me know. Maybe there's some new math or tricks since I worked in this domain.
    - sterwill 8y ago
      You can meet an at-rest encryption requirements in a lot of environments by flipping on disk-level, filesystem-level, or database-level encryption where the encryption keys aren't stored on that disk.
      - paul_milovanov 8y ago
TangoTrotFox 8y ago
Leaked is the best word. It doesn't even have to be hackers or outside forces. An individual on the inside maliciously or ineptly handling records is another way things will get leaked. And will is the right word. In the digital age it's not a question of if something will get leaked, but when. And as systems become more complex and companies more expansive this is only going to become more true. And I think this is the point of view people should make when deciding what information to yield to companies, or deciding on their position of things like 'surveillance for your safety.'

ergothus 8y ago

Author David Brin has (relatively) long advocated that we have two options: shoot for privacy resulting in those with power able to access the "private" info, or have it open where everyone can access. He then argues for the latter because it minimizes rather than maximizes abuse. (I'm paraphrasing and summarizing, possibly poorly) I struggle with being _comfortable_ with that idea, but I don't have a problem believing the technical accuracy of it.

xevb3k 8y ago
Interestingly (because the parent is about Schneier). IIRC Schneier argues against this. The argument is that even if everybody has access to all information, only a small group is able to exploit that access effectively. So, you still end up with a small group abusing their access to the information. You should therefore aim for privacy of sensitive information.
- cortesoft 8y ago
  Yeah, I think a good example of this is thinking about something like license plate scanning. Technically, this is not taking advantage of any public information. It is just capturing images of things happening in public. Anyone could set up a camera and capture license plates as they drive through an intersection. So is it totally fine for a police force to scan license plates at every intersection? The question is complicated, because the effect on people changes when you do something that is not worrisome on a small scale in an automated way at a large scale. When you add in that the people doing it have a large amount of power over people and it changes it even more.
  - komali2 8y ago
    Well hold on, the difference there is the police can cross reference scanned plates against other databases the public doesn't have access to, yeah? Or is there some way to id plates against names? If there is I wanna know cause I wanna ID whoever knocked my motorcycle over
    - xevb3k 8y ago
      If you had near continuous location information for a license plate it would be relatively simple to use it to narrow it down to a small group of people. I’d imagine it would be relatively easy to figure out where someone works and/or lives and just go find them. Correlating across multiple public databases might make things even easier. But I don’t think this is the point of the argument. The point is that those in power can gain more benefit from the information than the general population. Let’s say all votes in elections become public. That information is more useful to a powerful political party than to the public at large, or a small unfunded group. If you don’t want that information abused, the argument goes, you should make sure it’s kept private.
dredmorbius 8y ago
In practice, the forced revelation of information makes individual privilege and power more important. When everyone has to play with their cards on the table, so to speak, then people who feel like they can be themselves without consequence do so freely -- these generally being people with support groups of like-minded people, and who are neither economically nor physically vulnerable. People who are more vulnerable to consequences use concealment as a method of protection: it makes it possible to speak freely about controversial subjects, or even about any subjects, without fear of harassment. -- Yonatan Zunger, chief architect, Google+ https://plus.google.com/+YonatanZunger/posts/WegYVNkZQqq https://plus.google.com/+YonatanZunger/posts/WegYVNkZQqq
WorldMaker 8y ago
For anyone curious for more information, Dr. Brin's largest work on the subject is the non-fiction collection of essays called The Transparent Society: https://en.wikipedia.org/wiki/The_Transparent_Society https://en.wikipedia.org/wiki/The_Transparent_Society Published in 1998, I think it's probably still the most fascinating work on privacy of the post-internet age. More fun fictional explorations of the subject can be found in his novels Kiln People and Earth.

cuboidGoat 8y ago

I worked in a factory that produces critical parts for both the nuclear industry and the silicon fabs. Their main software stack is old dos software with a win95 front end bolted on running in compatibility mode with an integrated database that went obsolete in the early '90s. I asked them what protections they took against hacking, and they told me that nobody would be interested in what they do, so they didn't have to spend any money on protecting themselves.

jakelarkin 8y ago
security by obsolescence is a thing too
- FactolSarin 8y ago
  It's actually one of the security layers for America's nuclear arsenal https://www.businessinsider.com/hacker-us-nukes-report-2016-5 https://www.businessinsider.com/hacker-us-nukes-report-2016-...
- cuboidGoat 8y ago
  Security by obsolescence isn't the thing where you just dump old code on internet connected computers and steadfastly refuse to do any form of technical assessment other then "Does it run?", due to the assumption that nobody would be interested in screwing you over, though.
FactolSarin 8y ago
Was that computer connected to the Internet? If not, then no problem.
- EvanAnderson 8y ago
  Define "the Internet". Do contractors plug laptops into the network with these "air gapped" computers? How about IoT devices? Printers? I can't recall who said it, but a venerable infosec practitioner once said "Think of an air gap as a very high-latency connection."

jugg1es 8y ago

I work for a healthcare IT company that deals with tons of PHI (protected health information) and we have very strict security practices. New software is extensively evaluated at several points in the SDLC for security issues and access is tightly controlled. Engineers and CEOs have been held personally liable for major breaches (not my company!). Health records are WAY more protected than your SSN. If what happened to Equifax happened to a company like Epic, they would go out of business.

specialist 8y ago
None of your systems store patient data encrypted at rest. Inadvertent data breaches are inevitable. The very best you could possibly do is access logs and auditing. Which of your customers do any kind of auditing?
- paul_milovanov 8y ago
  Hold on, do you know for a fact that EPIC specifically doesn't encrypt data at rest? I'm not questioning your competence/knowledge, just trying to understand specifically what you're saying.
  - specialist 8y ago
    The database or file system is likely (hopefully) encrypted. I'm referring to record and field level encryption. Like this: Translucent Databases http://a.co/d/5855TYO http://a.co/d/5855TYO http://wayner.org/node/46 http://wayner.org/node/46 Think of how password databases don't actually store passwords. Instead they (should) be storing salted and hashed passwords. --- Please see my other comment about plaintext demographic data vs using unique identifiers.
- sterwill 8y ago
  Although at-rest encryption of health data is an addressable part of US health regulations, not a required one, it's almost always done because it's easy and effective. Most electronic health records are encrypted at-rest.

specialist 8y ago

I've worked on both election integrity and electronic medical record exchanges. I care very much about privacy. Your conclusion is correct. Medical records cannot be encrypted so long as demographic data must be stored in plaintext. Otherwise how would we do record matching (linking) across heterogenous systems? The fix is to use universal identifiers. Once you moot the record matching problem, you can use translucent database techniques to anonymize patient data. I don't expect the USA to adopt an official centralized universal identifier for people any time soon. And none of the 3rd party solutions (NSA, LexisNexus, ChoicePoint, Facebook, etc) are acceptable, for various reasons.

Kostchei 8y ago
Homomorphic encryption, anonomized data coupled with metadata, searching via k-Anonymity models. I mean, sure it has a cost, some of this stuff is new, but to say "cannot be encrypted"... that's where the fun is- working out how to do it.
paul_milovanov 8y ago
Hold on, even if you keep the demographic data in plaintext, surely you can encrypt the actual HIPAA-protected data?
- specialist 8y ago
  If you figure out how to do that, please let me know. Maybe there's some new math or tricks since I worked in this domain.
  - sterwill 8y ago
    You can meet an at-rest encryption requirements in a lot of environments by flipping on disk-level, filesystem-level, or database-level encryption where the encryption keys aren't stored on that disk.
    - paul_milovanov 8y ago

TangoTrotFox 8y ago

Leaked is the best word. It doesn't even have to be hackers or outside forces. An individual on the inside maliciously or ineptly handling records is another way things will get leaked. And will is the right word. In the digital age it's not a question of if something will get leaked, but when. And as systems become more complex and companies more expansive this is only going to become more true. And I think this is the point of view people should make when deciding what information to yield to companies, or deciding on their position of things like 'surveillance for your safety.'