The specter of a hacktivist cyberattack is chilling to IT security pros, even though they don't consider the methods hackivists typically use the most worrisome. "They were really more concerned about the types of attacks and the data that is more the target of cybercrime and cyberespionage," said Harry Swerdlove, CTO of Bit9, the firm that surveyed the pros.
Only about a quarter of the healthcare professionals surveyed for the report were concerned about the financial consequences of data breaches on their organizations, Kroll also found.
"This is surprising, given the fact that breaches in the healthcare industry ultimately come at a higher overall price than the cost realized in the financial and retail sectors," notes the report.
One reason so few healthcare data pros are concerned about the financial impact of data breaches could be linked to their short-term view of the problem. They're blind to the long-term effects that some of these events can have, according to Kroll Senior Vice President Brian Lapidus.
One data breach had a "tail" that exceeded 10 years, Lapidus recalled, so the organization was dealing with the consequences of the event for more than a decade after it happened.
"People think of breaches in terms of the actual event, and they don't think about the tail," he told TechNewsWorld.
Security at healthcare organizations can also suffer from a preoccupation with compliance, he added. "Compliance isn't necessarily a driver of security. It's the beginning of it -- not the end."
Two years ago, that nation's nuclear facilities were targeted by the Stuxnet worm, which knocked out 1,000 of the 9,000 centrifuges it uses to refine uranium.
Last week, the facility it uses to export 80 percent of its crude oil was targeted by a computer virus intended to disrupt operations there.
Little is known about this latest cyberattack on Iran's infrastructure, but apparently it hasn't done much damage yet. The facility on Kharg Island is still operational, and while some data was affected, Iranian authorities are saying no major damage was done.
The cyberattack on Iran came just days before the U.S. House of Representatives convened hearings in Washington, D.C., on "The Iranian Cyber Threat to the United States."
At that forum, members of Congress were warned about possible cyberattacks on power and transportation systems in the United States.
The good news is that Iran is not as sophisticated in cyberwarfare as China or Russia, Frank J. Cilluffo, director of The George Washington University Homeland Security Policy Institute said in testimony submitted to Congress.
However, there have been reports of Iran hooking up with Venezuela to launch cyberattacks on military and civilian targets -- including nuclear power plants -- in the United States, he noted.
Moreover, Iran has been willing in the past to outsource its dirty work to terrorist organizations, Cilluffo observed.
"There is little, if any, reason to think that Iran would hesitate to engage proxies to conduct cyberstrikes against perceived adversaries," he said.
April 25. Sixteen months after the fact, Cryptic Studios, a maker of massively multiplayer online role playing games, informs its users that one of its user databases was compromised in December 2010. "We have no evidence at this time that any data other than the account name, handle, and encrypted password were accessed for any user," the company says.
April 26. UK's Serious Organized Crime Agency, with FBI and U.S. Department of Justice, shuts down 36 websites trafficking in stolen payment card and online bank account details. SOCA estimates the raids will prevent more than US$811 million in potential fraud.
April 27. Iron Mountain (NYSE: IRM) and PwC reports that four in 10 (42 percent) European law firms did not know whether they had suffered a data breach in the previous three years.
August 20-23. Gartner (NYSE: IT) Catalyst Conference. San Diego, Calif. Early bird price (before June 23): $1,995. Standard price: $2,295.
Nearly two-thirds (64 percent) of IT pros believe their organizations will be the target of a cyberattack in the next six months, and three out of five (61 percent) say the attack will come from hactivists.
That was one of the findings in cybersecurity firm Bit9's annual security survey released last week.
What's surprising about the survey is the concern given to hacktivist attacks, Bit9 Chief Technology Officer Harry Sverdlove told TechNewsWorld -- "even though Anonymous and hacktivist-type attacks represent a minority of actual attacks."
Moreover, when the survey's questions began to get more specific, a different set of worries began to emerge. For example, when asked about the types of attacks that concerned them most, nearly half (45 percent) the IT pros said malware and 17 percent said spear phishing--both methods commonly used in attacks by cybercriminals and nation states.
By contrast, hacktivist attack methods received low concern rankings from the respondents. Only 11 percent were concerned about distributed denial of service attacks (DDoS) and 4 percent by SQL injection assaults.
"Once we went a little deeper, they were really more concerned about the types of attacks and the data that is more the target of cybercrime and cyberespionage," Sverdlove noted.
Healthcare Data At Risk
The U.S. healthcare industry is one of the most at risk for significant data breaches and one of the most likely to be targeted for its well of protected data, according to a recent report commissioned by Kroll Advisory Solutions.Only about a quarter of the healthcare professionals surveyed for the report were concerned about the financial consequences of data breaches on their organizations, Kroll also found.
"This is surprising, given the fact that breaches in the healthcare industry ultimately come at a higher overall price than the cost realized in the financial and retail sectors," notes the report.
One reason so few healthcare data pros are concerned about the financial impact of data breaches could be linked to their short-term view of the problem. They're blind to the long-term effects that some of these events can have, according to Kroll Senior Vice President Brian Lapidus.
One data breach had a "tail" that exceeded 10 years, Lapidus recalled, so the organization was dealing with the consequences of the event for more than a decade after it happened.
"People think of breaches in terms of the actual event, and they don't think about the tail," he told TechNewsWorld.
Security at healthcare organizations can also suffer from a preoccupation with compliance, he added. "Compliance isn't necessarily a driver of security. It's the beginning of it -- not the end."
Iranian Oil Depot Hit by Virus
Iran is starting to become to cyberwarriors what the Spanish Civil War was to the Wehrmacht.Two years ago, that nation's nuclear facilities were targeted by the Stuxnet worm, which knocked out 1,000 of the 9,000 centrifuges it uses to refine uranium.
Last week, the facility it uses to export 80 percent of its crude oil was targeted by a computer virus intended to disrupt operations there.
Little is known about this latest cyberattack on Iran's infrastructure, but apparently it hasn't done much damage yet. The facility on Kharg Island is still operational, and while some data was affected, Iranian authorities are saying no major damage was done.
The cyberattack on Iran came just days before the U.S. House of Representatives convened hearings in Washington, D.C., on "The Iranian Cyber Threat to the United States."
At that forum, members of Congress were warned about possible cyberattacks on power and transportation systems in the United States.
The good news is that Iran is not as sophisticated in cyberwarfare as China or Russia, Frank J. Cilluffo, director of The George Washington University Homeland Security Policy Institute said in testimony submitted to Congress.
However, there have been reports of Iran hooking up with Venezuela to launch cyberattacks on military and civilian targets -- including nuclear power plants -- in the United States, he noted.
Moreover, Iran has been willing in the past to outsource its dirty work to terrorist organizations, Cilluffo observed.
"There is little, if any, reason to think that Iran would hesitate to engage proxies to conduct cyberstrikes against perceived adversaries," he said.
Breach Diary
April 23. Opponents of Texas Voter Photo ID law file brief alleging state's attorney general exposed the Social Security Numbers of millions of voters when complying with a discovery request in the case. The disks containing the information were returned to the state by the attorneys requesting the information after the mistake was discovered.April 25. Sixteen months after the fact, Cryptic Studios, a maker of massively multiplayer online role playing games, informs its users that one of its user databases was compromised in December 2010. "We have no evidence at this time that any data other than the account name, handle, and encrypted password were accessed for any user," the company says.
April 26. UK's Serious Organized Crime Agency, with FBI and U.S. Department of Justice, shuts down 36 websites trafficking in stolen payment card and online bank account details. SOCA estimates the raids will prevent more than US$811 million in potential fraud.
April 27. Iron Mountain (NYSE: IRM) and PwC reports that four in 10 (42 percent) European law firms did not know whether they had suffered a data breach in the previous three years.
Calendar of Events
May 2. Security of Patient Data. Webinar, 2 p.m. ET, sponsored by Kroll Advisory Solutions and Healthcare IT News.August 20-23. Gartner (NYSE: IT) Catalyst Conference. San Diego, Calif. Early bird price (before June 23): $1,995. Standard price: $2,295.
0 comments:
Post a Comment