6 ms·

What always amazes me is that credit card data is almost always safe since VISA/MasterCard and others have very stringent security requirements. (PCI DSS) Ther

What always amazes me is that credit card data is almost always safe since VISA/MasterCard and others have very stringent security requirements. (PCI DSS) There are some regulations regarding medical data (Eg, HIPAA) but security seems like an afterthought in most hospitals at best.

hahamrfunnyguy 6y ago
I've done work in the medical industry, both for hospitals and private software companies developing medical software. In my experience; security, stability and compliance with HIPAA and other regulations are taken very seriously.
- speedgoose 6y ago
  Same. And we have external audits and experts checking what we do.
- xxs 6y ago
  That's UK, no HIPPA per se. Funny enough, the infamous GDPR applies and data leaks are quite punishable. The Hospital Group is in a quite bad position: 1) the blackmail, in no definition that's ransom. 2) The data leak has to be reported and potentially they will get fined by the state. As for taking regulation seriously, I guess it does depend on the industry. Where I work GDPR and regulatory breaches are treated more seriously than downtime.
  - lotsofpulp 6y ago
    I assume UK business won’t have to worry about GDPR for clients in the UK going forward due to Brexit?
    - xxs 6y ago
      Not really. The UK has its own[0]. [0]: https://www.gov.uk/data-protection https://www.gov.uk/data-protection
- Bukhmanizer 6y ago
  In my experience HIPAA is taken very seriously in the sense that people are willing to have meetings about HIPAA, with furrowed brows and serious expressions and a lot of signatures. Are the actual end-products more secure? No probably not. Of course this probably varies drastically from place to place.
  - jabits 6y ago
    Like you said, it may vary place to place, but you are definitely more secure when complying with HIPAA than without. The very act of discussing security within an organization in a structured way is a good start. edit: missing word
- fabianhjr 6y ago
  There are plenty of reports of hospitals using out-of-support Windows versions (95-XP) with known vulnerabilities on _networked connected_ devices. ( https://nakedsecurity.sophos.com/2020/02/20/nearly-half-of-hospital-windows-systems-still-vulnerable-to-rdp-bugs/ https://nakedsecurity.sophos.com/2020/02/20/nearly-half-of-h... ) On the parent comment I am not saying that hospitals aren't HIPPA compliant but rather that the security expectations of credit card data are higher than medical data.
OminousWeapons 6y ago
Securing payments is much simpler than securing medical data in many ways because payment processors are centralized entities with established protocols for data transmission, where communication is largely many (vendors) to one or few (the processors), and where only one type of data is being moved. Health care organizations are HIGHLY decentralized entities where authentication is extremely difficult; where orgs employ many different protocols and software stacks; where many different types of data need to move freely between many orgs, with various levels of sophistication, in many different directions (patient to provider, provider to patient, provider to provider, provider to payer, payer to provider, patient to payer, payer to payer, provider to regulator, provider to researcher, provider to vendor, etc), with few established standards for how that is done (paper, phone, email, web application, fax, API, snail mail, CD, hard drive, USB, etc), with many people having access; and where organizations need to be porous, with high turnover by design. It should also be realized that a failure to access payment data or process a payment results in lost business and headaches. A failure to access medical data may kill someone, so tradeoffs between confidentiality and availability are much more nuanced.
- jrumbut 6y ago
  This is an amazing summary of the problem and why it remains a problem.
- 542458 6y ago
  Good comment, especially WRT trade off between confidentiality and availability. Nonetheless, I do feel that many of these items (few standards, little interchange, often old tech, data decentralization) are primarily problems because the vendors and hospitals don’t really have strong incentive to solve them. I do appreciate that the problem is non-trivial, but I don’t think that the problem would be unsolvable should the appropriate incentives be put into place.
- radicalbyte 6y ago
  In the medical world you have standards (HL7, DICOM, XDS) which are all about throwing large amounts of data around hospital networks (and in the case of XDS - outside). It's a castle with moat model of security - everything within the network is trusted and they focus on keeping the bad guys out. Obviously that's a horrible strategy and it delivers the expected results..
tidepod12 6y ago
I've worked as a security consultant for healthcare companies for years. The HIPAA Security Rule is a joke. The HIPAA Security Rule requirements are extremely basic things like "users must have their own login username rather than sharing an account" or "data should be encrypted where appropriate" (and it's left up to the company to decide where they think is "appropriate". There's also zero requirements around the type of encryption or implementation around it.. you could use a Caesar cipher and probably pass a HIPAA audit). Yes, as the other commenter mentioned, hospitals do "take it seriously" in the sense that they put a lot of importance on passing HIPAA audits... but passing a HIPAA security audit is a checkbox exercise for security controls that are a decade+ outdated. It means absolutely nothing about an organization's actual security maturity.
- cratermoon 6y ago
  Can confirm. Even the getting the ISO27001 certification is mostly about checking boxes. In many cases an ISO27001 item can be satisfied by picking one of several ways that standard gives to claim it's not relevant.
  - popotamonga 6y ago
    All a joke, we tell the auditors what they want to hear, we provide documents to prove the processses are implemented as they should but then in practice nothing if followed but they dont get to know that.
  - bladegash 6y ago
    You don’t even have to check boxes for ISO 27001 these days. All you need to do is pay “consultants” in certain foreign countries about $5k and you magically receive your certification.
    - hsbauauvhabzb 6y ago
      Can you elaborate? I’m not attempting to use them, it’s a useful tool when explaining 27001 doesn’t mean jack.
Godel_unicode 6y ago
Let's not go letting credit card processors off the hook, this was barely a month ago. Part of our security team is essentially full-time on dealing with the consequences of actors using stolen credit cards. https://www.forbes.com/sites/billhardekopf/2020/11/13/this-week-in-credit-card-news-major-data-breach-on-travel-sites-mastercard-looks-beyond-cards/ https://www.forbes.com/sites/billhardekopf/2020/11/13/this-w...
- fabianhjr 6y ago
  From that article: > security researchers from Website Planet found that Cloud Hospitality stored information from more than 10 million travelers on an unsecured database with no password protection. That will be taken by credit card companies as gross negligence and breach of contract (they include PCI DSS compliance on all contracts and a requirement that they do the same for anyone that processes credit card data for them) plus anyone going the legal route (and indeed there are reports of a class action that mention PCI DSS compliance explicitly) My original comment was more in regards the care and security that is expected.
viraptor 6y ago
PCI is far from good requirements. Some of their controls make sense, some made sense for corps in the 90s and some are completely opposite to what you should do. It's good that they at least force the company to think of the requirements and dedicate some time to it. But I really wouldn't put PCI DSS as a good example, or an "almost always safe" example.
rossdavidh 6y ago
Visa/MC have several advantages over a federal regulator: - they have a more regular feedback mechanism (if someone's db gets leaked, they get more fraudulent charges from that company's customers, so they can figure out whose security was bad, and this happens often) - they have a more credible enforcement mechanism: they can and will turn off your ability to process CC transactions, while a federal regulator in many cases faces a lot of political pushback if they try to actually shut down a medical facility - the intended (and actual) purpose of PCI was to reduce the number of operators actually storing CC data; if a federal regulator tried to make things onerous enough to force most medical facilities to not store medical data, there would be enormous pushback and they would be forced by Congress to back down
g_p 6y ago
Not to disagree with you as I agree with the sentiment, but as a counter data point, I've seen a number of quite serious beaches in the past where PCI/DSS clearly wasn't being followed, as CVV2 was compromised along with payment details. Often the merchants were too naive to even understand what was going on. Clearly having straightforward gateways to handle payments can help retailers and raise the bar, but I never cease to be amazed at how many sites run third party scripts on pages processing sensitive information! Bonus marks for using third parties that let other third parties place code on the page! I think we have 2 orthogonal aspects here - the presence or absence of a straightforward commodity solution, versus the presence of clear security guidelines. The former seems to be what drives better practices, whereas the latter is more guidance people ignore, due to lack of personnel and skills.
Nadya 6y ago
I dug out my login to comment on this: >There are some regulations regarding medical data (Eg, HIPAA) but security seems like an afterthought in most hospitals at best. I worked as a developer for healthcare/hospital websites and the company I worked for took it far more seriously than the hospitals did. We had to babysit them constantly on potential violations and actual violations. The average hospital has at least a dozen different HIPAA violations each and every day because in the end convenience almost always trumps security when a person is stressed and busy. And those were just the violations I was privy to as their web developer - undoubtingly there were even more that I couldn't have been aware of. When we dropped support for IE8-10 it was a major issue at nearly every hospital we worked with and we couldn't convince them to finally upgrade until lawsuits started happening. https://www.hipaajournal.com/upgrade-internet-explorer-to-remain-hipaa-compliant-8259/ https://www.hipaajournal.com/upgrade-internet-explorer-to-re... HIPAA compliance is a checkbox and actual security doesn't mean anything because actual security is too inconvenient.

hahamrfunnyguy 6y ago

I've done work in the medical industry, both for hospitals and private software companies developing medical software. In my experience; security, stability and compliance with HIPAA and other regulations are taken very seriously.

speedgoose 6y ago
Same. And we have external audits and experts checking what we do.
xxs 6y ago
That's UK, no HIPPA per se. Funny enough, the infamous GDPR applies and data leaks are quite punishable. The Hospital Group is in a quite bad position: 1) the blackmail, in no definition that's ransom. 2) The data leak has to be reported and potentially they will get fined by the state. As for taking regulation seriously, I guess it does depend on the industry. Where I work GDPR and regulatory breaches are treated more seriously than downtime.
- lotsofpulp 6y ago
  I assume UK business won’t have to worry about GDPR for clients in the UK going forward due to Brexit?
  - xxs 6y ago
    Not really. The UK has its own[0]. [0]: https://www.gov.uk/data-protection https://www.gov.uk/data-protection
Bukhmanizer 6y ago
In my experience HIPAA is taken very seriously in the sense that people are willing to have meetings about HIPAA, with furrowed brows and serious expressions and a lot of signatures. Are the actual end-products more secure? No probably not. Of course this probably varies drastically from place to place.
- jabits 6y ago
  Like you said, it may vary place to place, but you are definitely more secure when complying with HIPAA than without. The very act of discussing security within an organization in a structured way is a good start. edit: missing word
fabianhjr 6y ago
There are plenty of reports of hospitals using out-of-support Windows versions (95-XP) with known vulnerabilities on _networked connected_ devices. ( https://nakedsecurity.sophos.com/2020/02/20/nearly-half-of-hospital-windows-systems-still-vulnerable-to-rdp-bugs/ https://nakedsecurity.sophos.com/2020/02/20/nearly-half-of-h... ) On the parent comment I am not saying that hospitals aren't HIPPA compliant but rather that the security expectations of credit card data are higher than medical data.

OminousWeapons 6y ago

Securing payments is much simpler than securing medical data in many ways because payment processors are centralized entities with established protocols for data transmission, where communication is largely many (vendors) to one or few (the processors), and where only one type of data is being moved. Health care organizations are HIGHLY decentralized entities where authentication is extremely difficult; where orgs employ many different protocols and software stacks; where many different types of data need to move freely between many orgs, with various levels of sophistication, in many different directions (patient to provider, provider to patient, provider to provider, provider to payer, payer to provider, patient to payer, payer to payer, provider to regulator, provider to researcher, provider to vendor, etc), with few established standards for how that is done (paper, phone, email, web application, fax, API, snail mail, CD, hard drive, USB, etc), with many people having access; and where organizations need to be porous, with high turnover by design. It should also be realized that a failure to access payment data or process a payment results in lost business and headaches. A failure to access medical data may kill someone, so tradeoffs between confidentiality and availability are much more nuanced.

jrumbut 6y ago
This is an amazing summary of the problem and why it remains a problem.
542458 6y ago
Good comment, especially WRT trade off between confidentiality and availability. Nonetheless, I do feel that many of these items (few standards, little interchange, often old tech, data decentralization) are primarily problems because the vendors and hospitals don’t really have strong incentive to solve them. I do appreciate that the problem is non-trivial, but I don’t think that the problem would be unsolvable should the appropriate incentives be put into place.
radicalbyte 6y ago
In the medical world you have standards (HL7, DICOM, XDS) which are all about throwing large amounts of data around hospital networks (and in the case of XDS - outside). It's a castle with moat model of security - everything within the network is trusted and they focus on keeping the bad guys out. Obviously that's a horrible strategy and it delivers the expected results..

tidepod12 6y ago

I've worked as a security consultant for healthcare companies for years. The HIPAA Security Rule is a joke. The HIPAA Security Rule requirements are extremely basic things like "users must have their own login username rather than sharing an account" or "data should be encrypted where appropriate" (and it's left up to the company to decide where they think is "appropriate". There's also zero requirements around the type of encryption or implementation around it.. you could use a Caesar cipher and probably pass a HIPAA audit). Yes, as the other commenter mentioned, hospitals do "take it seriously" in the sense that they put a lot of importance on passing HIPAA audits... but passing a HIPAA security audit is a checkbox exercise for security controls that are a decade+ outdated. It means absolutely nothing about an organization's actual security maturity.

cratermoon 6y ago
Can confirm. Even the getting the ISO27001 certification is mostly about checking boxes. In many cases an ISO27001 item can be satisfied by picking one of several ways that standard gives to claim it's not relevant.
- popotamonga 6y ago
  All a joke, we tell the auditors what they want to hear, we provide documents to prove the processses are implemented as they should but then in practice nothing if followed but they dont get to know that.
- bladegash 6y ago
  You don’t even have to check boxes for ISO 27001 these days. All you need to do is pay “consultants” in certain foreign countries about $5k and you magically receive your certification.
  - hsbauauvhabzb 6y ago
    Can you elaborate? I’m not attempting to use them, it’s a useful tool when explaining 27001 doesn’t mean jack.

Godel_unicode 6y ago

Let's not go letting credit card processors off the hook, this was barely a month ago. Part of our security team is essentially full-time on dealing with the consequences of actors using stolen credit cards. https://www.forbes.com/sites/billhardekopf/2020/11/13/this-week-in-credit-card-news-major-data-breach-on-travel-sites-mastercard-looks-beyond-cards/ https://www.forbes.com/sites/billhardekopf/2020/11/13/this-w...

fabianhjr 6y ago
From that article: > security researchers from Website Planet found that Cloud Hospitality stored information from more than 10 million travelers on an unsecured database with no password protection. That will be taken by credit card companies as gross negligence and breach of contract (they include PCI DSS compliance on all contracts and a requirement that they do the same for anyone that processes credit card data for them) plus anyone going the legal route (and indeed there are reports of a class action that mention PCI DSS compliance explicitly) My original comment was more in regards the care and security that is expected.

viraptor 6y ago

PCI is far from good requirements. Some of their controls make sense, some made sense for corps in the 90s and some are completely opposite to what you should do. It's good that they at least force the company to think of the requirements and dedicate some time to it. But I really wouldn't put PCI DSS as a good example, or an "almost always safe" example.

rossdavidh 6y ago

Visa/MC have several advantages over a federal regulator: - they have a more regular feedback mechanism (if someone's db gets leaked, they get more fraudulent charges from that company's customers, so they can figure out whose security was bad, and this happens often) - they have a more credible enforcement mechanism: they can and will turn off your ability to process CC transactions, while a federal regulator in many cases faces a lot of political pushback if they try to actually shut down a medical facility - the intended (and actual) purpose of PCI was to reduce the number of operators actually storing CC data; if a federal regulator tried to make things onerous enough to force most medical facilities to not store medical data, there would be enormous pushback and they would be forced by Congress to back down

g_p 6y ago

Not to disagree with you as I agree with the sentiment, but as a counter data point, I've seen a number of quite serious beaches in the past where PCI/DSS clearly wasn't being followed, as CVV2 was compromised along with payment details. Often the merchants were too naive to even understand what was going on. Clearly having straightforward gateways to handle payments can help retailers and raise the bar, but I never cease to be amazed at how many sites run third party scripts on pages processing sensitive information! Bonus marks for using third parties that let other third parties place code on the page! I think we have 2 orthogonal aspects here - the presence or absence of a straightforward commodity solution, versus the presence of clear security guidelines. The former seems to be what drives better practices, whereas the latter is more guidance people ignore, due to lack of personnel and skills.

Nadya 6y ago

I dug out my login to comment on this: >There are some regulations regarding medical data (Eg, HIPAA) but security seems like an afterthought in most hospitals at best. I worked as a developer for healthcare/hospital websites and the company I worked for took it far more seriously than the hospitals did. We had to babysit them constantly on potential violations and actual violations. The average hospital has at least a dozen different HIPAA violations each and every day because in the end convenience almost always trumps security when a person is stressed and busy. And those were just the violations I was privy to as their web developer - undoubtingly there were even more that I couldn't have been aware of. When we dropped support for IE8-10 it was a major issue at nearly every hospital we worked with and we couldn't convince them to finally upgrade until lawsuits started happening. https://www.hipaajournal.com/upgrade-internet-explorer-to-remain-hipaa-compliant-8259/ https://www.hipaajournal.com/upgrade-internet-explorer-to-re... HIPAA compliance is a checkbox and actual security doesn't mean anything because actual security is too inconvenient.