Slashdot Mirror

← Back to Stories (view on slashdot.org)

Anthem Blocking Federal Auditor From Doing Vulnerability Scans

Posted by samzenpus on from the suspicious-behavior dept.

chicksdaddy writes Anthem Inc., the Indiana-based health insurer, has informed a federal auditor, the Office of Personnel Management, that it will not permit vulnerability scans of its network — even after acknowledging that it was the victim of a massive breach that leaked data on tens of millions of patients. According to this article, Anthem is citing "company policy" that prohibits third party access to its network in declining to let auditors from OPM's Office of the Inspector General (OIG) conduct scans for vulnerable systems. OPM's OIG performs a variety of audits on health insurers that provide health plans to federal employees under the Federal Employee Health Benefits Program, or FEHBP. Insurers aren't mandated to comply — though most do. This isn't Anthem's first time saying "no thanks" to the offer of a network vulnerability scan. The company also declined to let OIG scan its network in 2013. A partial audit report issued at the time warned that the company, then known as WellPoint, "provided us with conflicting statements" on issues related to information security, including Wellpoint's practices regarding regular configuration audits and its plans to shift to IBM's Tivoli Endpoint Manager (TEM) platform.

26 of 116 comments (clear)

  1. no need by turkeydance · · Score: 3, Insightful

    Anthem already knows its vulnerability.

  2. Company Policy? by Anonymous Coward · · Score: 3, Funny

    "Anthem is citing "company policy" that prohibits third party access to its network in declining to let auditors from OPM's Office of the Inspector General (OIG) conduct scans for vulnerable systems."

    Seems a little late for that now, doesn't it?

  3. Well... by Anonymous Coward · · Score: 5, Funny

    I think they already allowed third party access. What's a few more.

  4. The industry needs more regulation by mysidia · · Score: 5, Insightful

    We need regulation....

    Insurers aren't mandated to comply — though most do.

    They should be required to pass their audit or pass an audit by a 3rd party auditor who is approved by the OIG.

    Failure to comply should result in fines and bar them from writing or acquiring any more insurance policies, until they do.

    Also, in the event of a breach at this juncture, there should be a financial penalty for their negligence.

    1. Re:The industry needs more regulation by LifesABeach · · Score: 3, Funny

      Anthem is an obvious corporate risk; shut them down. Then put all of their clients on Obama Care.

    2. Re:The industry needs more regulation by bouldin · · Score: 3, Interesting

      This will definitely provide fodder for all the class action lawsuits that are in the works.

      I wonder just how reckless a business has to be with their security before they risk charges of criminal negligence.

    3. Re:The industry needs more regulation by ckatko · · Score: 2

      >We need regulation....

      This is hilarious. Every day slashdotters either complain that it's *obvious* we need less regulation. And in a separate thread, it's *obvious* we need more regulation.

    4. Re:The industry needs more regulation by Mr.+Shotgun · · Score: 3, Insightful

      This is hilarious. Every day slashdotters either complain that it's *obvious* we need less regulation. And in a separate thread, it's *obvious* we need more regulation.

      *protip* slashdotters as you so put is is not a hive mind, people post here from all walks of life and have differing opinions. In fact I have seen opinions from both sides of the political spectrum that have been rated +5 insightful in the same thread. And they were both right, it was insightful and made you think. The last thing this site needs is to become an echo chamber of samethought and goodthink. If you are looking for that there are plenty of other websites out there, may I recommend Tumblr or yahoo news?

      --
      Of all tyrannies, a tyranny sincerely exercised for the (supposed) good of its victims may be the most oppressive
    5. Re:The industry needs more regulation by mysidia · · Score: 3

      This isn't inconsistent. On the whole we do need less regulation. I would agree with that. There should be little regulation, but it should be effective regulation.

      There should also be a concept of "temporary regulation".... for example: We see this widespread abuse, so for the next 5 years you all have to do X, and if you shape up, then you industry players can decide how to do it afterwards, BUT you will be fully on the hook financially, for negligence, if you do X and it causes damage to people.

      There are some subjects or some elements in certain industries that need more regulation, because it's become the "industry standard" to abuse consumers, or people are unfairly being put at risk to save $$$ or safe face for some Mega Co, when Mega Co is essentially a local monopoly or nearly so.

  5. Anthem is normal here by dave562 · · Score: 5, Insightful

    I work for an organization that hosts PII for a number of large public companies. We are constantly asked about vulnerability scans and about 50% of the clients want to scan our networks themselves. We do not allow that.

    The compromise is that we conduct bi-weekly scans with Rapid7, and hire from a rotating list of third parties to conduct yearly vulnerability assessments of our applications and infrastructure. We make the high level results of those scans (number of vulnerabilities found) available to the clients. We also have to put up with the occasional fire drill like Heartbleed. During those situations, we deploy the patches as soon as we can test them, and then provide letters of attestation to any client who wants / needs one.

    While some clients complain, they eventually come around when we explain to them that it is for their own safety and the protection of their information. We are in a situation where we retain data for companies who are in direct competition with each other. When push comes to shove, we sometimes have to explain that, "Just like we will not let you scan our network for vulnerability, we will also not allow your direct competitor to scan our networks either."

    1. Re:Anthem is normal here by Anonymous Coward · · Score: 2, Interesting

      I work for a large multinational in the human capital management space and we let a select number our customers do penetration testing. Our customers range from Fortune 500 to government agencies in the US and EU. It is not an unheard of practice, and I would argue it is quite common for these requests to come up, especially during contract negotiations.

    2. Re:Anthem is normal here by ColdWetDog · · Score: 3, Funny

      I work for a large multinational in the human capital management space and we let a select number our customers do penetration testing. Our customers range from Fortune 500 to government agencies in the US and EU. It is not an unheard of practice, and I would argue it is quite common for these requests to come up, especially during contract negotiations.

      My little firm can't afford stuff like that. So we outsource our testing to China and Russia - they charge a lot less.

      Seems like they're always falling over each other to try and accommodate us.

      --
      Faster! Faster! Faster would be better!
    3. Re:Anthem is normal here by bouldin · · Score: 4, Insightful

      That sounds reasonable to me. If were running a security group, I would take care of as much in-house as I possibly could. I especially wouldn't allow business partners to scan my gear.. There is just too much risk there.

      There are a couple differences with Anthem, though.

      1. 1. They are being audited by regulators, and your business-to-business relationships are different.
      2. 2. Anthem was not able to document its internal vulnerability scans, while it seems like your company is diligent about this.

      Here's a quote from the OIG:

      "However, Anthem provided us with conflicting statements about its procedures, and ultimately was unable to provide satisfactory evidence that it has ever had a program in place to routinely monitor the configuration of its servers."

      That sounds more like a company with shoddy security trying to hide its failings behind a specious policy.

    4. Re:Anthem is normal here by jafiwam · · Score: 2

      Bypassing your security is easy. Step 1, Bad Guy kills your dog in front of you. Step 2, Bad Guy then puts the gun to your head and starts removing body parts till Bad Guy has access. Lets face it, its not exactly the Bad Guys problem that you are bleeding to death on your carpet. It's a hell of a plan you've got.

      Why is it you liberal idiots always assume only bad guys have guns?

      Step 0, bad guy spotted on approach and hit three times in the gut with .357 rounds. Better yet, a 12 gauge at the doorway.

      Maybe YOUR plan is give up your tender butthole. Not everybody is like that.

  6. There's a diff between "Blocking" and "Refusing" by jddj · · Score: 3, Interesting

    If they can actually block the scans, that'd be... well...more secure than their track record indicates.

  7. Anthem is a publicly traded company by hamjudo · · Score: 5, Interesting
    Anthem is traded on the NYSE under the symbol WLP.

    They should be required to file an 8K form to legally inform all of their stock holders that they have material news that may adversely affect their future stock price, or even company viability.

    After having been informed of extreme security issues on our network, Anthem Inc has elected to ignore the situation. Furthermore, Anthem Inc's network is so embarrassing, that Anthem Inc has decided to risk significant fines and legal expenses, rather than allow adults to see just how bad it is.

    Translation, shareholder lawsuits may be addressed to Joseph R. Swedish, et al.

    1. Re:Anthem is a publicly traded company by turp182 · · Score: 2

      Seems like a clear cut Sarbanes-Oxley problem as well, an external audit would seem to be required given the intrusion they suffered.

      --
      BlameBillCosby.com
  8. Because They've Been Hacked by Anonymous Coward · · Score: 3, Informative

    Through no real choice of my own, WellPoint/Anthem was involved in some of my shit (they were behind the only decent plans my employee offered, though they weren't branded as WellPoint/Anthem anything). They leak data frequently.
    About once a year I get a notice saying my shit has been leaked and that they're providing "identity protection" bullshit as compensation. My current pointless "protection" plan is handled by some clowns called FraudStop.

  9. Re:LOL! by sumdumass · · Score: 3, Informative

    Congress created this agency years ago (1883 i think) when it passed the civil service act into law.

    It's a central office in charge of federal government employees and administrates their benefits and retirement packages as well as wage tables and so on. You can think of them as the HR department on a grand scale.

  10. simple answer by ihtoit · · Score: 4, Insightful

    STOP THEM FROM OPERATING. Prohibit them from carrying out a single transaction until they comply with Federal requirements. Fuck them, if they don't want to abide by the rules, we'll take their fucking marbles off them and kick them out of the playground.

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  11. Nice policy you've got there. Would be a shame if by jtownatpunk.net · · Score: 2

    According to this article, Anthem is citing "company policy" that prohibits third party access to its network...

    Sounds like y'all'd better beef up your security because, if they manage to access your network, you've violated company policy by allowing it to happen.
    The government isn't bound by your company policy.

  12. On the other hand ... by sk999 · · Score: 2

    The place I work is required to allow itself to be scanned, both from outside and inside the network perimeter. However, whenever the auditors show up to do their inside scanning, we have to disable a number of security systems so they can "do their job". Kinda defeats the whole purpose, but whatever makes the auditors happy.

    1. Re:On the other hand ... by SJ · · Score: 2

      Not really...

      Just because your firewall drops a port-scan (simple terms here) doesn't mean that someone won't get lucky and guess an open port and exploit it.

      The Auditors want to know if you're patching your systems.

      No point leaving the combination to the safe on a sticky note next to it, and then saying "it's ok. I always lock my front door".

  13. Re:LOL! by ihtoit · · Score: 4, Insightful

    Anthem need to learn the rules of the playground and start abiding by them, if I were the Fed I'd be shutting their arses down until they comply. No? You're telling me "NO"?? Fuck you. Get the fuck out of my playground.

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  14. Enough scans for everyone! by Threni · · Score: 2

    Believe me, they'll be getting vulnerability scans whether they want them or not! (They just won't get the results in their chosen format!)

    On the internet, everyone gets a free pentest!

  15. Two scenarios. by 140Mandak262Jamuna · · Score: 3, Insightful
    Scenario 1:

    Dear Investigator,

    We understand you suspect our CEO was doing insider trading and want access to our server logs to find evidence of guilt or innocence. While we appreciate your conscientiousness, we regret, we do not allow third party access to our servers. We thank you for your understanding. Hoping this would buy us enough time to sanitize our server logs, Yours, Gofly Akite, for Dewy Chetham and Howe.

    SEC investigator: eh? well, OK, Guess I tried, so I have covered my ass

    Scenario 2:

    "Hey Police officer, you want to search my car for pot? I know you are just doing your job, but sorry buddy, my policy is not to allow any third parties into my car. Hope you understand"

    Police Officer: "Keep your hands visible, and slowly exit your vehicle, turn around put your hands on the hood and bend over..."

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact