Slashdot Mirror
Anthem Blocking Federal Auditor From Doing Vulnerability Scans
chicksdaddy writes Anthem Inc., the Indiana-based health insurer, has informed a federal auditor, the Office of Personnel Management, that it will not permit vulnerability scans of its network — even after acknowledging that it was the victim of a massive breach that leaked data on tens of millions of patients. According to this article, Anthem is citing "company policy" that prohibits third party access to its network in declining to let auditors from OPM's Office of the Inspector General (OIG) conduct scans for vulnerable systems. OPM's OIG performs a variety of audits on health insurers that provide health plans to federal employees under the Federal Employee Health Benefits Program, or FEHBP. Insurers aren't mandated to comply — though most do. This isn't Anthem's first time saying "no thanks" to the offer of a network vulnerability scan. The company also declined to let OIG scan its network in 2013. A partial audit report issued at the time warned that the company, then known as WellPoint, "provided us with conflicting statements" on issues related to information security, including Wellpoint's practices regarding regular configuration audits and its plans to shift to IBM's Tivoli Endpoint Manager (TEM) platform.
Anthem already knows its vulnerability.
...we wouldn't want to interfere with the free flow of information out of our network.
OPM. Ok. Who invented this agency??
Sorry to say. But there's no way I'd let them in my doors either. Where's the credibility nowadays?
WTG Anthem! NO MEANS NO!
"Anthem is citing "company policy" that prohibits third party access to its network in declining to let auditors from OPM's Office of the Inspector General (OIG) conduct scans for vulnerable systems."
Seems a little late for that now, doesn't it?
I think they already allowed third party access. What's a few more.
We need regulation....
Insurers aren't mandated to comply — though most do.
They should be required to pass their audit or pass an audit by a 3rd party auditor who is approved by the OIG.
Failure to comply should result in fines and bar them from writing or acquiring any more insurance policies, until they do.
Also, in the event of a breach at this juncture, there should be a financial penalty for their negligence.
This is why we need government regulations: to enforce a bare minimum of corporate behavior.
Now where are all the shills who can tell us about how efficient private enterprise is, and how freedom=no regs on big business?
I work for an organization that hosts PII for a number of large public companies. We are constantly asked about vulnerability scans and about 50% of the clients want to scan our networks themselves. We do not allow that.
The compromise is that we conduct bi-weekly scans with Rapid7, and hire from a rotating list of third parties to conduct yearly vulnerability assessments of our applications and infrastructure. We make the high level results of those scans (number of vulnerabilities found) available to the clients. We also have to put up with the occasional fire drill like Heartbleed. During those situations, we deploy the patches as soon as we can test them, and then provide letters of attestation to any client who wants / needs one.
While some clients complain, they eventually come around when we explain to them that it is for their own safety and the protection of their information. We are in a situation where we retain data for companies who are in direct competition with each other. When push comes to shove, we sometimes have to explain that, "Just like we will not let you scan our network for vulnerability, we will also not allow your direct competitor to scan our networks either."
Anthem is citing "company policy" that prohibits third party access to its network
I guess the hackers didn't read--or failed to abide by--that policy. Kind of like "gun-free zone" which only deters the law-abiding.
If they can actually block the scans, that'd be... well...more secure than their track record indicates.
They should be required to file an 8K form to legally inform all of their stock holders that they have material news that may adversely affect their future stock price, or even company viability.
After having been informed of extreme security issues on our network, Anthem Inc has elected to ignore the situation. Furthermore, Anthem Inc's network is so embarrassing, that Anthem Inc has decided to risk significant fines and legal expenses, rather than allow adults to see just how bad it is.
Translation, shareholder lawsuits may be addressed to Joseph R. Swedish, et al.
Through no real choice of my own, WellPoint/Anthem was involved in some of my shit (they were behind the only decent plans my employee offered, though they weren't branded as WellPoint/Anthem anything). They leak data frequently.
About once a year I get a notice saying my shit has been leaked and that they're providing "identity protection" bullshit as compensation. My current pointless "protection" plan is handled by some clowns called FraudStop.
STOP THEM FROM OPERATING. Prohibit them from carrying out a single transaction until they comply with Federal requirements. Fuck them, if they don't want to abide by the rules, we'll take their fucking marbles off them and kick them out of the playground.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
According to this article, Anthem is citing "company policy" that prohibits third party access to its network...
Sounds like y'all'd better beef up your security because, if they manage to access your network, you've violated company policy by allowing it to happen.
The government isn't bound by your company policy.
The place I work is required to allow itself to be scanned, both from outside and inside the network perimeter. However, whenever the auditors show up to do their inside scanning, we have to disable a number of security systems so they can "do their job". Kinda defeats the whole purpose, but whatever makes the auditors happy.
From the hero graphic on Anthem's site:
March is colon cancer awareness month
Find out how screening save lives.
The irony wasn't lost on me...
I happen to be one of the millions of customers whose credentials (SSN, birthday, etc.) may have been stolen in this Anthem security failure. Ditto for my family members.
I also happen to have been possibly compromised in the Target and Home Depot leaks.
Target and Home Depot offered one year of security monitoring. Anthem offered two years.
For the former two companies, presumably the violator got only my credit card information. That's a bother, but manageable, and the card issuer would likely eat any lossage. (Yet customers eventually fund their losses, and they are simply too lethargic to do things right.) But Anthem seems different. While their offer for two years of monitoring seems generous at first, I fully expect two years from now to have the same SSN and birthday that I have now, Unfortunately, in the financial security practices currently in practice in the USA, these two items and a little more publicly-obtainable personal info is all it takes to establish a new credit account. After two years I will still be vulnerable to criminals who have a little patience.
To the extent that financial monitoring is effective, and until US financial purveyors adopt saner practices, why shouldn't Anthem offer me free monitoring tor lifetime plus one year, after which a SSN becomes public and essentially worthless to criminals?
Post Snowden, they just look at the logs and see what the port knocking sequence is.
Health care companies cannot operate without a license.
Just remove their license, or forever remain a toothless laughing stock.
-- Another senseless waste of fine bytes.
No, no no! The Free Market will solve this problem. The Market Solves ALL problems! We should just de-regulate everything because regulation is EVIL!
That way, Anthem will no longer have to waste money on compliance so they can spend it on productive things like buying up all the competition.
Anyone getting (massive piles of) money from the Feds has already signed enough of their rights away.
If they expect to keep doing business, they will permit a reasonable inspection of the network.
It's not like the government is stealing the data, is it?
My guess is they use lots of microsoft windows servers unpatched with default/global passwords, unix servers with lots apps running as root & global file permissions, on a network without many firewalls. And the internet links are not well sercured.
Scan them anyway? What, are they going to use harsh language?
The typical compromise (see what I did there?) when a customer or Federal Government auditor wants to run scans of any sort on your private network is to agree on tools (to be provided by the auditing group if you don't already have them) running an agreed configuration/profile/whatever against an agreed limited scope target list (typically a VLAN or set of VLANs unless that entire network is devoted to just that one customer, which is sometimes the case, though less so these days with public/private/hybrid clouds being all the rage). When it comes to web application and database testing, you'll typically agree on a non-production target list that's a mirror of the production system (with appropriate verification of the two being a mirror outside the automated testing) so as to avoid impacting the production systems. When it comes time to run the tests, over-the-admins'-shoulder monitoring ensures the proper tools with the proper configurations hitting the proper targets is being done and that the output is being handed over unaltered.
Seen this done in plenty of places and 99% of the time, the auditing group is fine with it because at the end of the day, it's getting them exactly what they want; just in a slightly more red-tape riddled way. Meanwhile, the group being audited has the assurance that nothing is running wild all over their network unsupervised. If you don't have anything to hide, you're typically fine with this approach. If you aren't fine with this approach, something else is going on behind the scenes and most of the time that'll be something you're trying to hide.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
List the rules that these companies have to abide by because I can't find them.
Earlier this week I put in a request for pen-testing a new server I had completed. I think it's secure, but that isn't my area of expertise, so I have the experts kick the shit out of my server to see if anything falls over.
-- Will program for bandwidth
Believe me, they'll be getting vulnerability scans whether they want them or not! (They just won't get the results in their chosen format!)
On the internet, everyone gets a free pentest!
Dear Investigator,
We understand you suspect our CEO was doing insider trading and want access to our server logs to find evidence of guilt or innocence. While we appreciate your conscientiousness, we regret, we do not allow third party access to our servers. We thank you for your understanding. Hoping this would buy us enough time to sanitize our server logs, Yours, Gofly Akite, for Dewy Chetham and Howe.
SEC investigator: eh? well, OK, Guess I tried, so I have covered my ass
Scenario 2:
"Hey Police officer, you want to search my car for pot? I know you are just doing your job, but sorry buddy, my policy is not to allow any third parties into my car. Hope you understand"
Police Officer: "Keep your hands visible, and slowly exit your vehicle, turn around put your hands on the hood and bend over..."
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Let's review the situation. A customer, the U.S. Government, entered a contract with a private company (private property) that has specific terms. If the private company with private property did not include in its contract that vulnerability scans are permitted, then too bad customer. Go shop for services elsewhere. Punish them with by taking your money (tax dollars) to a vendor who does what you want.
Forget the regulation BS and audits. That will only lead to government control of everything. The most effective and efficient way to get good services is let the money do the talking. But no. We have politics here. I am sure that someone greased the hands of politicians campaign funds to be sure to get that government contract.
Security auditing company comes in and tells management to "drop their pants" on all of the standing network security. Management makes ops and engineering "drop their pants" so that auditor can "get an accurate picture of internal operations." Auditor then dings ops and engineering for everything they dropped their pants on. Don't play the game. Make them work for it the same way a black hat would have to.
There are a variety of different scans.
There's simple stuff like "is this port open when it shouldn't be", or "can I get to this host which should be firewalled"
Then there "when I connect to Apache on host X, is it running a version with known vulnerabilities. Are they patched"
Finally there's
"Is host X running exploitable Y which is currently protected by Z, but could be exploited if A, B, or C happened"
For the last one, it's still important to identify vulnerable software even if it's not accessible by a firewall, etc. Why? Because things change. Maybe somebody opens a port by accident, and suddenly that vulnerable box isn't behind a firewall anymore. Maybe it was intentionally opened as a new service needed to be able to hit the box, but nobody know about the pre-existing security hole.
Keep in mind that these scans generally aren't 24/7, so you fix whatever you can find when you run them. In good practice, they should also be run on any boxes that are *going* to be provisioned to production, but aren't yet. That means you need special access through the firewall etc so that you can scan stuff before it goes life.
...was in not publishing those policies to the hackers that got in earlier. If only they had known that there was a company policy against it, it could have saved everyone a lot of extra work.
All things considered though, this arrogance seems in line with a place who doesn't know their own vulnerabilities. I'd wager this isn't the first time they have been compromised and this is just defensive turtling to try to hide facts.
"No good deed goes unpunished"