Slashdot Mirror
TN BlueCross Encrypts All Data After 57 Disks Stolen
Lucas123 writes "After dozens of hard disk drives were stolen from a leased facility in Chattanooga, potentially exposing the personal data of more than 1 million customers, BlueCross decided to go the safe route: they spent $6 million to encrypt all stored data across their enterprise. The health insurer spent the past year encrypting nearly a petabyte of data on 1,000 Windows, AIX, SQL, VMware and Xen server hard drives; 6,000 workstations and removable media drives; as well as 136,000 tape backup volumes."
Most insurance companies these days, are far more concerned with getting bonuses to the executives.
I prefer the "u" in honour as it seems to be missing these days.
You never heard of ASCII, did you?
This entire effort might be useless if they're not using good encryption. Is there one master passphrase to bypass all of the encryption? Also, they make no mention of how they plan to prevent physical theft of data again just that 'Well this time I put a password on my data, take that thieves!'
"We searched the country and were unable to find another company that has achieved this level of data encryption," Michael Lawley, vice president of technology shared services for BCBS, said in a statement.
He certainly did not search very hard. Less than 1PB encrytpted, we do more than that every single day. And I doubt we are unique.
You've never worked on a large database, have you?
It is a pity that the data was stolen before adequate protection was put into place, but it seems to me TN BCBS took the right steps afterwards:
1. They sent out alerts to those affected, both current and former members
2. They now encrypt all their stored data
Of course, this will not prevent all possible leaks, but at least it shows they are taking protection of their customers' data seriously, and have put in serious work to protect that data. I wish more organizations did that. Way to go, BCBS of Tennessee!
Please correct me if I got my facts wrong.
"I know I already shit on the floor, but I'm wearing a diaper now so it's all good!"
which is totally what she said
Better if they had done that earlier.
No one can remember the password. ;P
HA!
Well the new customers whose data hasn't already been stolen will be happy to hear it, I guess.
I'm by no means a security expert but isn't $6 million a bit excessive for the effort?
TFA says "The company said it spent more than 5,000 man-hours on the encryption effort, which encompassed about 885TB of at-rest data." That equates to around $1200/hr. Perhaps I should become a security expert.
A fool sees not the same tree that a wise man sees. -- Willam Blake
This is complete bullshit. Even if for some reason the company held each number in an individual file rather than documents, spreadheets, databases, etc. you could encrypt the drive. You could also encrypt the individual files if you wanted to.
Trolls... Good luck implementing BitLocker on entire VMFS datastores. Not everything is based on Windows Vista/7.
Damn I would have personally gone around and done it on all their computers for $50k. I'd even pay my own airfare.
And then they can pay me again to switch to TrueCrypt when BitLocker falls off the Microsoft upgrade treadmill :-P
"When information is power, privacy is freedom" - Jah-Wren Ryel
So, they're locking the barn door after the horse has bolted...
dozens of hard disk drives were stolen from a leased facility in Chattanooga, potentially exposing the personal data of more than 1 million customers
The data is gone... and now they're encrypting.
bl00x
Parent is a troll. You haven't seen him around yet?
The resurgence of themed trolls lately has been kind of hard to miss. First Dr.Bob, then this guy and the AC who's been posting about fungal infections causing cancer... used to be just goatse and GNAA postings about Obama. JockTroll's been making more appearances lately, too. And of course APK and MichaelKristopeit still haven't gotten a life.
I do wish BadAnalogyGuy would post more often...
They are probably using hardware tokens as part of user login, and hardware security modules to protect the keys that protect the data. It's not cheap. Bit locker will provide some protection for windows desktops. But not databases, and non-windows systems.
$6 million is pocket change to a company that has $5.2 billion in annual revenue. However, the true cost is really higher, as encrypting everything means that things like disk corruption are no longer repairable, lost passwords can't be reset without losing data, and the like. It'd be interesting to see just what the ongoing costs are.
That said, I would like to compliment Tennessee BC/BS for doing the right thing, in spite of it costing money.
--Paul
In the Netherlands we have a adage that seems fitting, "De put pas dempen als het kalf al verdronken is.". Which roughly translates to "Closing the well after the calf already drowned.".
They have the personal details (health records, bank info, addresses, etc.) of millions of people and they just now decided to encrypt the data? WTF?
~Syberz
That's bullhonkey. Numbers can be encrypted. Don't use the same IV params all over the place.
One way people encrypt small chunks of data in a complex way is to use methods like CMS or ECIES. That can be a lot slower though.
jryy vg jbhyq unir orra svefg cbfg vs vg jrera'g sbe rapelcgvba bireurnq.
leased facility = cloud so this is what you get from going to the cloud the data can be in a place that can range from a nice data center to a small room in a office building. Also the people ruining the cloud can just have real low prices and then sell data to the highest bidder.
and i know backdoors into every windows and AIX which i did my first hack in 97 and held a hole for 7 years....haha...thanks for telling ...just me ....
Leased facility != cloud. In a leased facility, you can find out the operational conditions and the level of physical security. You can make them part of the lease contract if you care enough. You can't do that in a cloud.
... even if it is far too late. And of course, the customers will pay for the cost of the failure, plus the cost of the fix. The company made a bad choice, and the consequences of that bad choice will be born by .. the customers. The executives will still get their usual multimillion dollar "performance" bonuses as if nothing was ever wrong.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
If you encrypt it before it gets stolen.
Most insurance companies these days, are far more concerned with getting bonuses to the executives.
You don't honestly think that the executives will end up with smaller bonuses as a result, do you? We all know that isn't how this game works.
The company will cover these costs by raising premiums and/or reducing payments. It is very likely that the executives will see larger bonuses after this, as a self-congratulatory measure for "proactively correcting the situation".
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
If you've got the drive... you have unlimited attempts to crack it. Someone with a couple of video cards and a few days on their hands and their encryption is pointless.
The HITECH amendment to HIPAA provides safe harbor from breach notification rules for organizations that encrypt their data. Now, if someone steals all of Blue Cross's hard drives, they don't have to notify the media, the people whose data was stolen, or the state attorney general's office.
That's almost as many States in this country that Obama visited on the campaign trail!
unfortunately, they encrypted all the data with the same password as the BlueCross domain administrative password..... password123
These drives were likely part of various RAID volumes. Doesn't that mean they're pretty well useless outside their hosts? Is someone really going to go to the level of forensic data recovery to elevate from property theft to identity theft? That stuff isn't cheap, so the ROI is probably going to be really low.
Long signatures suck.
My mind is boggling at the level of ignorance and stupidity in that post. Even a moment of thinking would let you realise that this can't possibly be correct.
I am TheRaven on Soylent News
+1. The only problem is that I usually recognize people because of their sigs, not their user names...
I rarely respond to comments. Also, don't ask for clarifications: a brain and Google are faster, believe me!
we all know the password is "42".
Is it just me, or shouldn't this be standard fscking procedure for companies dealing with sensitive information such as medical and financial records?
I first thought this was just a knee jerk reaction, but I guess they're doing the right thing. I can only imagine how the board meeting went....
CEO: What do we do? We've been had!!
IT Guy: There's a solution to all your problems, you must encrypt the disks.
CEO: But my bonus checks! It'll cost millions to do that!
IT Guy: No. You must ENCRYPT EVERYTHING.
CEO: But....
IT Guy: EVERYTHING.
Board of Directors: Fund it. We can't afford anymore lawsuits.
You should read the rest of his post history.
upon the advice of my lawyer, i have no sig at this time
And then they can pay me again to switch to TrueCrypt when BitLocker falls off the Microsoft upgrade treadmill :-P
Firstly, as someone else has already said, not everything is based on Windows.
Secondly, I cannot think of a product I should be less inclined to use than TrueCrypt to deal with such a problem. Reason I say this is simple - in every large business you always have the occasional helpdesk call to reset a forgotten password - usually when someone's just come back off holiday. How exactly are you going to deal with the problem when the answer to a helpdesk call for a lost TrueCrypt password is "please send the laptop in for reimaging"?
Looked around the stories including their "infographic", not clear what they are using and how they've implemented it.
Do servers have pre-boot enabled? How did they change they operational processes? Are these HW-encrypted drives? What is the failure rate on the process?
Details like this are important. As it stands, they spent the cash and a lot of time, but no indication that they've implemented it properly. I wouldn't feel much safer.
5,000 hours is nothing to be honest for even a mid-size company. That's 2-3 techs working a whole year on it. Big deal. They could be just sitting in front of the monitor watching the progress bar.
Wearing pants should always be optional.
Anyone know what software they actually used for the encryption? TFA doesn't say.
They should get some credit for spending money encrypting their data but it's still another case of a company that only does the right thing AFTER shit hits the fan.
when one of their machines reboots, where does the key come from? such sites usually spend as much money as possible on the theory that mauve is better, which in this case probably means FC SANs. but at which level does the encryption happen? and doesn't disk encryption just mean that you need to take the enclosure or client box too?
And now, Samuel L. Jackson will read a line from his up coming movie: "English Lesson"
Punctuation motherfucker, learn it.
The Kruger Dunning explains most post on
is written on a post-it stuck to the monitor of the secretary for the CEO.
BlueCross, found written on a post-it note on the back of a keyboard.
It only took them 57 horses getting stolen before they decided to lock the barn door.
good job! way to keep on top of things.
Be seeing you...
So they are spending 1200 dollars a man hour? Total machines seem to be about 6000, so each machine is costing a grand to encrypt? Seems pretty expensive.
/* TODO: Spawn child process, interest child in technology, have child write a new sig */