7 ms·

I've worked as a security consultant for healthcare companies for years. The HIPAA Security Rule is a joke. The HIPAA Security Rule requirements are extremely b

I've worked as a security consultant for healthcare companies for years. The HIPAA Security Rule is a joke. The HIPAA Security Rule requirements are extremely basic things like "users must have their own login username rather than sharing an account" or "data should be encrypted where appropriate" (and it's left up to the company to decide where they think is "appropriate". There's also zero requirements around the type of encryption or implementation around it.. you could use a Caesar cipher and probably pass a HIPAA audit). Yes, as the other commenter mentioned, hospitals do "take it seriously" in the sense that they put a lot of importance on passing HIPAA audits... but passing a HIPAA security audit is a checkbox exercise for security controls that are a decade+ outdated. It means absolutely nothing about an organization's actual security maturity.

cratermoon 6y ago
Can confirm. Even the getting the ISO27001 certification is mostly about checking boxes. In many cases an ISO27001 item can be satisfied by picking one of several ways that standard gives to claim it's not relevant.
- popotamonga 6y ago
  All a joke, we tell the auditors what they want to hear, we provide documents to prove the processses are implemented as they should but then in practice nothing if followed but they dont get to know that.
- bladegash 6y ago
  You don’t even have to check boxes for ISO 27001 these days. All you need to do is pay “consultants” in certain foreign countries about $5k and you magically receive your certification.
  - hsbauauvhabzb 6y ago
    Can you elaborate? I’m not attempting to use them, it’s a useful tool when explaining 27001 doesn’t mean jack.
    - bladegash 6y ago
      There are companies in certain developing countries who will skirt the rules on providing consulting and auditing/monitoring to the same company. They do it for just about any ISO cert, not just ISO 27001. It is a bit of a dirty secret with companies who work in heavily regulated industries. The companies in question will go through the motions, but make no mistake, you pay for the cert. Sorry for being vague, just not looking to publicly out anyone. If you Google around, I’m sure you can find more about what I am talking about/much of the controversy around many of the ISO governing bodies.
      - FreshFries 6y ago
        > There are companies in certain developing countries who will skirt the rules on providing consulting and auditing/monitoring to the same company. Welcome to my live :) We 'hired' these experts since they came up with the lowest price offer for our certification. I have been through many certifications in the past, this was one was the most... shameful. Pathetic grasp of English, IT in general and security controls specifically. We passed that in absolutely zero time, if you exclude the time spend having lunch and 'discussions' about the interpretation of the requirements. This was PCI BTW. Next was the local healthcare certification, done by an international auditing firm. Possibly even worst. Total paper tiger exercise. Total lack of understanding of current security standards. Nice ties & suits though and even better lunches to discuss (you guessed it) the interpretation of the requirements. I get why these guys get the jobs: they know the right people and look the part. But boy, would it not be nice if experts could do these jobs.
    - g_p 6y ago
      Can't speak directly to this, but just to add to the sentiment here - no breach was ever prevented through the application of pen to paper in the shape of a check mark. If an organisation has the money to spend on doing ISO or something else, it should put the money towards someone who actually has some good skills and knowledge in security and can advise them. An organisation that recognises the business value in being secure (less risk of fines, reputational damage, more ability to win work with lucrative large organizations) is already in a good place as they've crossed the first hurdle! The issue with certificates like ISO (and indeed any other kind of kitemark for security) in my view is that it presents the opinion of one (probably inexperienced and cheap) junior person as to whether what you presented them with on the day sounded to comply with a rule. No focus on whether the mitigation is effective. No focus on whether it's relevant or appropriate. No focus on whether it's adequate, or how it sits in relation to the capabilities of a motivated adversary. A decent understanding of your threat model, your exposure, and how you plan to invest to improve would be far more valuable. Second to this is to then avoid buying snake-oil vendor security products that aren't effective - many of the big organisations breached through solarwinds offer incredibly expensive "AI"-based cyber tools as those are in vogue. Yet all were compromised by a silly supply chain breach from some proprietary DLL a third party vendor was shipping into organisations, which was blindly trusted. Getting a basic understanding of the old fashioned principles of security and having someone help you take technical measures will be a load more effective than producing paperwork to keep a junior auditor happy.
  - deleted 6y ago
    [deleted]
sargun 6y ago
My favorite anecdote from working in health care was a VP asking if we could use—-trust OpenSSL, because it wasn’t version 1.0, and it was 0.9.8, and instead should we license an encryption product.
- viraptor 6y ago
  Was it a VP of a tech department? If not, it's a very valid question. Either way, it sounds like a good approach to ask the question to someone else who's closer to practical implementation.
  - alpaca128 6y ago
    Especially considering some programs only get a minor version increment about once a year(FreeCad 0.18) while projects like Firefox or OpenSuse skipped tens of major version numbers within a short period.
  - sargun 6y ago
    He was our CIO. This was ~2011. Effectively, he was getting steak dinners from vendors, and using that to make decisions. These questions were either from ignorance or worse, malice, to force us to vendors. This (public) medical company went out of business roughly a year after.

cratermoon 6y ago

Can confirm. Even the getting the ISO27001 certification is mostly about checking boxes. In many cases an ISO27001 item can be satisfied by picking one of several ways that standard gives to claim it's not relevant.

popotamonga 6y ago
All a joke, we tell the auditors what they want to hear, we provide documents to prove the processses are implemented as they should but then in practice nothing if followed but they dont get to know that.
bladegash 6y ago
You don’t even have to check boxes for ISO 27001 these days. All you need to do is pay “consultants” in certain foreign countries about $5k and you magically receive your certification.
- hsbauauvhabzb 6y ago
  Can you elaborate? I’m not attempting to use them, it’s a useful tool when explaining 27001 doesn’t mean jack.
  - bladegash 6y ago
    There are companies in certain developing countries who will skirt the rules on providing consulting and auditing/monitoring to the same company. They do it for just about any ISO cert, not just ISO 27001. It is a bit of a dirty secret with companies who work in heavily regulated industries. The companies in question will go through the motions, but make no mistake, you pay for the cert. Sorry for being vague, just not looking to publicly out anyone. If you Google around, I’m sure you can find more about what I am talking about/much of the controversy around many of the ISO governing bodies.
    - FreshFries 6y ago
      > There are companies in certain developing countries who will skirt the rules on providing consulting and auditing/monitoring to the same company. Welcome to my live :) We 'hired' these experts since they came up with the lowest price offer for our certification. I have been through many certifications in the past, this was one was the most... shameful. Pathetic grasp of English, IT in general and security controls specifically. We passed that in absolutely zero time, if you exclude the time spend having lunch and 'discussions' about the interpretation of the requirements. This was PCI BTW. Next was the local healthcare certification, done by an international auditing firm. Possibly even worst. Total paper tiger exercise. Total lack of understanding of current security standards. Nice ties & suits though and even better lunches to discuss (you guessed it) the interpretation of the requirements. I get why these guys get the jobs: they know the right people and look the part. But boy, would it not be nice if experts could do these jobs.
  - g_p 6y ago
    Can't speak directly to this, but just to add to the sentiment here - no breach was ever prevented through the application of pen to paper in the shape of a check mark. If an organisation has the money to spend on doing ISO or something else, it should put the money towards someone who actually has some good skills and knowledge in security and can advise them. An organisation that recognises the business value in being secure (less risk of fines, reputational damage, more ability to win work with lucrative large organizations) is already in a good place as they've crossed the first hurdle! The issue with certificates like ISO (and indeed any other kind of kitemark for security) in my view is that it presents the opinion of one (probably inexperienced and cheap) junior person as to whether what you presented them with on the day sounded to comply with a rule. No focus on whether the mitigation is effective. No focus on whether it's relevant or appropriate. No focus on whether it's adequate, or how it sits in relation to the capabilities of a motivated adversary. A decent understanding of your threat model, your exposure, and how you plan to invest to improve would be far more valuable. Second to this is to then avoid buying snake-oil vendor security products that aren't effective - many of the big organisations breached through solarwinds offer incredibly expensive "AI"-based cyber tools as those are in vogue. Yet all were compromised by a silly supply chain breach from some proprietary DLL a third party vendor was shipping into organisations, which was blindly trusted. Getting a basic understanding of the old fashioned principles of security and having someone help you take technical measures will be a load more effective than producing paperwork to keep a junior auditor happy.
- deleted 6y ago
  [deleted]

sargun 6y ago

My favorite anecdote from working in health care was a VP asking if we could use—-trust OpenSSL, because it wasn’t version 1.0, and it was 0.9.8, and instead should we license an encryption product.

viraptor 6y ago
Was it a VP of a tech department? If not, it's a very valid question. Either way, it sounds like a good approach to ask the question to someone else who's closer to practical implementation.
- alpaca128 6y ago
  Especially considering some programs only get a minor version increment about once a year(FreeCad 0.18) while projects like Firefox or OpenSuse skipped tens of major version numbers within a short period.
- sargun 6y ago
  He was our CIO. This was ~2011. Effectively, he was getting steak dinners from vendors, and using that to make decisions. These questions were either from ignorance or worse, malice, to force us to vendors. This (public) medical company went out of business roughly a year after.