Slashdot Mirror
TN BlueCross Encrypts All Data After 57 Disks Stolen
Lucas123 writes "After dozens of hard disk drives were stolen from a leased facility in Chattanooga, potentially exposing the personal data of more than 1 million customers, BlueCross decided to go the safe route: they spent $6 million to encrypt all stored data across their enterprise. The health insurer spent the past year encrypting nearly a petabyte of data on 1,000 Windows, AIX, SQL, VMware and Xen server hard drives; 6,000 workstations and removable media drives; as well as 136,000 tape backup volumes."
Most insurance companies these days, are far more concerned with getting bonuses to the executives.
I prefer the "u" in honour as it seems to be missing these days.
It can't because it's mostly numbers, and encryuption only works on complex characters like letters. Numbers don't contain enough information for the crypto algorythms to work on.
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
This entire effort might be useless if they're not using good encryption. Is there one master passphrase to bypass all of the encryption? Also, they make no mention of how they plan to prevent physical theft of data again just that 'Well this time I put a password on my data, take that thieves!'
"We searched the country and were unable to find another company that has achieved this level of data encryption," Michael Lawley, vice president of technology shared services for BCBS, said in a statement.
He certainly did not search very hard. Less than 1PB encrytpted, we do more than that every single day. And I doubt we are unique.
It is a pity that the data was stolen before adequate protection was put into place, but it seems to me TN BCBS took the right steps afterwards:
1. They sent out alerts to those affected, both current and former members
2. They now encrypt all their stored data
Of course, this will not prevent all possible leaks, but at least it shows they are taking protection of their customers' data seriously, and have put in serious work to protect that data. I wish more organizations did that. Way to go, BCBS of Tennessee!
Please correct me if I got my facts wrong.
"I know I already shit on the floor, but I'm wearing a diaper now so it's all good!"
which is totally what she said
Better if they had done that earlier.
No one can remember the password. ;P
HA!
Well the new customers whose data hasn't already been stolen will be happy to hear it, I guess.
Srsly? $6 Million to enable BitLocker?
I'm by no means a security expert but isn't $6 million a bit excessive for the effort?
TFA says "The company said it spent more than 5,000 man-hours on the encryption effort, which encompassed about 885TB of at-rest data." That equates to around $1200/hr. Perhaps I should become a security expert.
A fool sees not the same tree that a wise man sees. -- Willam Blake
This is for the threat.. if the healthcare bill passes we'll destroy the keys
So, they're locking the barn door after the horse has bolted...
dozens of hard disk drives were stolen from a leased facility in Chattanooga, potentially exposing the personal data of more than 1 million customers
The data is gone... and now they're encrypting.
bl00x
$6 million is pocket change to a company that has $5.2 billion in annual revenue. However, the true cost is really higher, as encrypting everything means that things like disk corruption are no longer repairable, lost passwords can't be reset without losing data, and the like. It'd be interesting to see just what the ongoing costs are.
That said, I would like to compliment Tennessee BC/BS for doing the right thing, in spite of it costing money.
--Paul
In the Netherlands we have a adage that seems fitting, "De put pas dempen als het kalf al verdronken is.". Which roughly translates to "Closing the well after the calf already drowned.".
They have the personal details (health records, bank info, addresses, etc.) of millions of people and they just now decided to encrypt the data? WTF?
~Syberz
jryy vg jbhyq unir orra svefg cbfg vs vg jrera'g sbe rapelcgvba bireurnq.
leased facility = cloud so this is what you get from going to the cloud the data can be in a place that can range from a nice data center to a small room in a office building. Also the people ruining the cloud can just have real low prices and then sell data to the highest bidder.
and i know backdoors into every windows and AIX which i did my first hack in 97 and held a hole for 7 years....haha...thanks for telling ...just me ....
Leased facility != cloud. In a leased facility, you can find out the operational conditions and the level of physical security. You can make them part of the lease contract if you care enough. You can't do that in a cloud.
... even if it is far too late. And of course, the customers will pay for the cost of the failure, plus the cost of the fix. The company made a bad choice, and the consequences of that bad choice will be born by .. the customers. The executives will still get their usual multimillion dollar "performance" bonuses as if nothing was ever wrong.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
If you encrypt it before it gets stolen.
Most insurance companies these days, are far more concerned with getting bonuses to the executives.
You don't honestly think that the executives will end up with smaller bonuses as a result, do you? We all know that isn't how this game works.
The company will cover these costs by raising premiums and/or reducing payments. It is very likely that the executives will see larger bonuses after this, as a self-congratulatory measure for "proactively correcting the situation".
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
If you've got the drive... you have unlimited attempts to crack it. Someone with a couple of video cards and a few days on their hands and their encryption is pointless.
The HITECH amendment to HIPAA provides safe harbor from breach notification rules for organizations that encrypt their data. Now, if someone steals all of Blue Cross's hard drives, they don't have to notify the media, the people whose data was stolen, or the state attorney general's office.
That's almost as many States in this country that Obama visited on the campaign trail!
unfortunately, they encrypted all the data with the same password as the BlueCross domain administrative password..... password123
These drives were likely part of various RAID volumes. Doesn't that mean they're pretty well useless outside their hosts? Is someone really going to go to the level of forensic data recovery to elevate from property theft to identity theft? That stuff isn't cheap, so the ROI is probably going to be really low.
Long signatures suck.
we all know the password is "42".
Is it just me, or shouldn't this be standard fscking procedure for companies dealing with sensitive information such as medical and financial records?
I first thought this was just a knee jerk reaction, but I guess they're doing the right thing. I can only imagine how the board meeting went....
CEO: What do we do? We've been had!!
IT Guy: There's a solution to all your problems, you must encrypt the disks.
CEO: But my bonus checks! It'll cost millions to do that!
IT Guy: No. You must ENCRYPT EVERYTHING.
CEO: But....
IT Guy: EVERYTHING.
Board of Directors: Fund it. We can't afford anymore lawsuits.
Looked around the stories including their "infographic", not clear what they are using and how they've implemented it.
Do servers have pre-boot enabled? How did they change they operational processes? Are these HW-encrypted drives? What is the failure rate on the process?
Details like this are important. As it stands, they spent the cash and a lot of time, but no indication that they've implemented it properly. I wouldn't feel much safer.
5,000 hours is nothing to be honest for even a mid-size company. That's 2-3 techs working a whole year on it. Big deal. They could be just sitting in front of the monitor watching the progress bar.
Wearing pants should always be optional.
Anyone know what software they actually used for the encryption? TFA doesn't say.
They should get some credit for spending money encrypting their data but it's still another case of a company that only does the right thing AFTER shit hits the fan.
when one of their machines reboots, where does the key come from? such sites usually spend as much money as possible on the theory that mauve is better, which in this case probably means FC SANs. but at which level does the encryption happen? and doesn't disk encryption just mean that you need to take the enclosure or client box too?
And now, Samuel L. Jackson will read a line from his up coming movie: "English Lesson"
Punctuation motherfucker, learn it.
The Kruger Dunning explains most post on
is written on a post-it stuck to the monitor of the secretary for the CEO.
BlueCross, found written on a post-it note on the back of a keyboard.
It only took them 57 horses getting stolen before they decided to lock the barn door.
good job! way to keep on top of things.
Be seeing you...
So they are spending 1200 dollars a man hour? Total machines seem to be about 6000, so each machine is costing a grand to encrypt? Seems pretty expensive.
/* TODO: Spawn child process, interest child in technology, have child write a new sig */