In its first annual healthcare data breach report, Stern Security has critically analyzed over 4,000 data breaches since the Department of Health and Human Services began tracking the information in 2009. Stern Security utilized data from their HealthcareBreaches.com website as well as published information from Health and Human Services to create this comprehensive report.
This report shows thought-provoking insights into healthcare breach trends over the past 12 years. It covers everything from the number of breaches attributed to ransomware to third-party (business associate) breaches. More healthcare breaches occurred in 2021 than any other year and this report illustrates the detailed analysis.
Our company mission is to “Secure the Planet”. This means that we aim to provide education and solutions that any company in the world can use to reduce cyber risk. Our flagship product, Velocity, is a web application (SaaS product) which companies can use to evaluate their own cybersecurity posture as well as to evaluate cyber risks in all of their third-party vendors. While we strive to have fair pricing and various levels that companies of any size can subscribe to, it’s clear that some organizations simply do not have funds budgeted to spend on cybersecurity or to try new products. We’re moving Velocity to a freemium model so any company can measure their baseline security posture for free.
Details
If we’re serious about securing the planet and providing solutions for all organizations regardless of size and budget, we needed to expand our offerings. From my many years working in the cybersecurity industry, both on the customer side and the consulting side, I know that many organizations do not evaluate their security posture at all. Many of those that do, still measure their security posture using an inefficient, often inaccurate, spreadsheet approach. They list every cybersecurity measure that they should be doing in one column and then they state whether they are completing the task or not in another column. It’s easy, but inefficient, painful to manage, difficult to track progress, and tough to update. Velocity eliminates the need for spreadsheets to measure internal risk with these known frameworks. The free version of Velocity is an easy and economical tool for any company in the world to measure their cyber security posture.
What is included?
In the free version of Velocity, companies can evaluate their own security posture using any of several frameworks. Additionally, companies receive access to dashboards that give critical insight into their security posture. As an added benefit, companies eliminate the use of inefficient spreadsheets to evaluate risk. The frameworks that are included in the free version of Velocity are as follows:
CISA Shields Up – To address increased risk due to Russia’s invasion of Ukraine, the Cybersecurity & Infrastructure Security Agency (CISA) released security guidance for organizations. This free valuable guidance is built into Velocity. We will continue to update this significant resource on Velocity as the guidance updates and transforms.
CMMC 2.0 Level 1 – In late 2021, the Department of Defense (DoD) released CMMC 2.0 which is designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). There are three levels within this model and most defense contractors will need to adhere to Level 1. Organizations can evaluate their compliance with Level 1 CMMC 2.0 for free within Velocity. The smaller subset of organizations that access more classified information can pay for a Velocity subscription to evaluate their compliance with the higher levels within this framework. Our company pays to have certified CMMC staff. For more information on CMMC, please review our latest article on the subject: https://www.sternsecurity.com/blog/cmmc-2-0-program-update/
CIS v8 Group 1 – The Center for Internet Security (CIS) has a well-known list of cybersecurity controls that are recommended for all organizations. The latest version (v8 as of this writing) splits the security framework into three groups depending on the size and cybersecurity maturity of the organization. The free version of Velocity includes the first group, Implementation Group 1. Organizations looking to evaluate their maturity with Groups 2 and 3 can upgrade to a paid subscription within Velocity. Our company pays an annual license fee to utilize this security framework.
How do we pay for this?
We have to pay for this somehow as we definitely cannot help secure the planet if we don’t have the funds to run our product. While several frameworks (or parts of frameworks) are free, we have over 10 other major security and compliance frameworks that companies can pay a subscription for. We continue to add more frameworks. We pay subscription fees which we pass on to companies who subscribe to additional features within Velocity. Additionally, we charge companies to evaluate the security posture of their vendors. While utilizing the free version, there is an easy path to upgrade to a paid subscription to utilize other frameworks or evaluate vendors.
I’m incredibly excited to announce our freemium version of Velocity. This is the result of months of hard work from an amazing team. We are so proud of the result and what it can do for the world. Now that Velocity is offering this freemium model, we see a clear path to making our motto “Secure the Planet” a reality. Velocity is not going to solve every cybersecurity problem, but it does give organizations actionable items they can perform to reduce risk. Now any company in the world can measure their baseline security for free on a beautiful web interface.
Not all vulnerability scans are created equal. The configuration of a vulnerability scan makes an enormous impact on your results. Authenticated vulnerability scans will provide much greater insight into an organization’s security posture than unauthenticated scans. However, there is a place for unauthenticated vulnerability scans. This article discusses the differences between authenticated and unauthenticated vulnerability scans and when you should use each.
What are Vulnerability Scans?
Vulnerability scans are an automated process for searching devices for vulnerabilities. Vulnerability scanners are the applications or devices that perform the scans.
What are Authenticated Scans?
Authenticated scans are sometimes called “credentialed scans”. “Credentials” refers to a valid account for a system. So credentialed scans, or authenticated scans, are vulnerability scans that utilize valid accounts (username + password) to log into target systems.
Why Perform Authenticated Scans?
Imagine trying to determine if a house has a pest problem by only looking at the outside of the house. Sure, you may be able to see evidence of a pest problem, but you’ll definitely know there is a problem if you go inside. Unauthenticated scans are similar to the outside view only. Authenticated scans are similar to having the keys to the house and looking inside for problems. With an authenticated vulnerability scan, the vulnerability scanner logs into the device and performs detailed checks on the system patch level, permissions, installed applications, and more.
Scanning from Inside or Outside the Network
Scanning from the internet gives you a view of your publicly accessible devices. It’s a good idea to scan from the outside to see what is available. These external scans are often performed as unauthenticated scans to see how others see your devices from the internet. However, it is still a good idea to scan these same devices from the inside as authenticated scans to get a more comprehensive view of the vulnerabilities on the system. Additionally, internal resources should be scanned from the internal network as authenticated scans.
SNMP vs SSH Vulnerability Scans
When performing authenticated vulnerability scans on network devices or Linux systems, you often have the choice of utilizing SNMP (Simple Network Management Protocol) or SSH (Secure Shell). Usually, SSH credentialed scans give you more comprehensive results, but it really comes down to the permissions that are given to the credentials that you are utilizing.
Should I Choose Authenticated or Unauthenticated Vulnerability Scans?
Authenticated vulnerability scans give you a more comprehensive view of the vulnerabilities within your environment. If you have a choice, perform authenticated vulnerability scans. If you are performing external scans, it is common to performing these as unauthenticated scans, but you should still scan these same devices from the inside of the network as authenticated scans.
What Account Should be Used for Authenticated Scanning?
You should use a dedicated account with escalated privileges. This account should be limited to the vulnerability scanning process and should not have the ability to use VPN, RDP, or other tasks not associated with vulnerability scanning. This dedicated account should have a long random password with at least 20 characters. In penetration tests, our team has compromised vulnerability scanner accounts that had weak passwords and were not limited to the scanning process on the network.
How Often Should Vulnerability Scans be Performed?
The Center for Internet Security (CIS) version 8 Guide states that automated internal vulnerability scans should be performed on assets at least quarterly. This guide also recommends that external scans are performed at least monthly.
Should I Also Scan Internal Vendor Devices?
All of your internal assets should be scanned unless they are known to have problems with scanning. As part of your Third-Party Risk Management (TPRM) process, your organization should work with vendors to determine if their assets on your network can be scanned. These vendor devices should be scanned before placing them in production and then on a regular basis thereafter.
Are there any Devices that Shouldn’t be Scanned?
Some devices that are known to crash with vulnerability scans include: VOIP systems, printers, some medical devices, and certain SCADA (Supervisory Control and Data Acquisition) systems. Always scan in a non-production environment if you’re not sure about the stability of the system and consult with the vendor as necessary. Systems that cannot be scanned should be segmented on the network.
Conclusion
You will most likely perform both authenticated and unauthenticated scanning in your vulnerability management program. Each scan type has different uses, but authenticated scanning provides a more comprehensive analysis of a system.
If the SolarWinds hack taught us anything, it’s that the security of a company’s infrastructure is dependent on the resilience of their vendors. A breached vendor is a trojan horse that bypasses normal defenses and accesses the trusted areas of the network. Threat actors have cunningly discovered that a trusted vendor is often the easier path to infiltrate their primary target. Some of the top cybersecurity technologies in 2021 focus on vendor risk evaluation.
Even if companies have internal security teams, evaluating vendor risk is a resource intensive process. Most organizations utilizing spreadsheets to create vendor questionnaires. After several back-and-forth emails and several weeks, the vendor completes the questionnaire. Next, begins an equally long process of internal deliberations to give the vendor a risk score. This process can take months for a single vendor. The current vendor security review process that most organizations perform is inefficient and varies in accuracy. Meanwhile, vendor breaches continue to skyrocket. In the healthcare industry, 21.1% of breaches were caused by vendors (business associates) from 2009 to December 31st of 2019. However, in 2020, breaches from vendors spiked to 39.7%!
Third party breaches in the healthcare industry from 2009 through 2019 (Source: HealthcareBreaches.com)
Vendor breaches in the healthcare industry greatly increased in 2020:
Third Party breaches in the healthcare industry in 2020 (Source: HealthcareBreaches.com)
A strong vendor risk evaluation solution is critical to combat these issues. A good vendor risk management product adds efficiencies, reduces cost, and increases security for organizations and vendors. These solutions automate much of the manual work and consolidate the vendor evaluations into a few places. Instead of every single customer performing their own evaluations, these solutions perform the work. These solutions can evaluate hundreds of vendors at once instead of the inefficient spreadsheet questionnaire evaluations and countless vendor security meetings that many organizations perform today. Internal vendor evaluations will become a process of the past and replaced by vendor risk management solutions.
Vendor security should be evaluated before the contract is signed. Vendors have incentive to strengthen security if their customers are grading them as part of the product evaluation and contract negotiation. If they want the business, they better have good security.
This field continues to grow rapidly as vendor breaches spike in frequency. Vendor risk management solutions will help combat this issue and shine the spotlight on third-party security. Without a doubt, this is one of the top cybersecurity segments in 2021. Proper vendor evaluation is needed to increase security and reduce risk.
