Unauthorized Data Transmission by Hospital Applications

As reported in Network World and from our own observations, there is a bit of trouble with unauthorized outbound information transmission from a variety of systems and software on business networks, including healthcare. Healthcare Providers are particularly susceptible to this, because they have more systems per installation than any other form of business.  Most of the problems are covered in the article link above, so we’ll focus on the two that aren’t, and then talk about what we can do to help.

As discussed in the article :

  • Security devices and systems transmitting configuration data and other information without consent or notice.
  • OT devices like MRI machines and other systems, misconfigured or with their own security problems.
  • Desktop operating systems like Windows 10, which is obnoxiously chatty with high risk components being transmitted.
  • Rogue devices brought in by employees with good intentions, which unfortunately are not secure and transmit all sorts of good data.

Then there’s these:

  • Applications, misconfigured or configured with malignant intentions in an unauthorized fashion by companies with poor practices or ethics.
  • Good intentioned or bad intentioned users, transmitting all sorts of company data.

Email leaks are bad enough, but when systems and authorized users are transmitting data without our knowledge, it’s a serious blind spot. YOu can implement some form of data loss prevention, which should catch the leaks over common channels, but what about the systems and applications that are authorized and more difficult to find?

For these unauthorized data transmissions by personnel, you need manual review and monitoring. To catch data theft by systems personnel, you need to capture their activities and then validate them during or after the fact for bad activities.  We’ve observed major players in the electronic medical records business transmitting large amounts of patient data back to their company systems without authorization.  That needs to be squashed when it happens, so implement a process to make sure it doesn’t happen to your company.

For unauthorized transmissions by systems, you also need monitoring, but because it’s part of the overall activities, you can’t just watch when it’s happening, because you don’t know when it’s happening.  For this, you need to capture and analyze traffic and build up a knowledge of what is normal so you can spot anomalies.  It’s usually easy to profile an application and then locate any strange activity.

If you want some reassurance that your processes are catching everything, or you don’t have the resources to manage the verification process improvement on your own, please call us.  Finding needles in haystacks is kind of our thing.  We’ll be glad to help you figure out your needs and then map out business process improvements to cover them.

We’re the best at finding evidence of bad actors on your network.  Call now 610-810-1727 or email us at sales@ .

Drafting Policies for Fun

Not many people think writing policy is fun. Or procedures. Or standards. Or any documentation, really. But policy and documentation can be fun, and more importantly, if done well, contributes directly to the security and safety of the organization, so it’s worth spending time on.

OK, but how can it possibly be fun? Because when you understand what you’re building, how it is like a set of block like toys that click together to create a structure capable of supporting an entire company, then it’s more like a puzzle. And if you don’t like puzzles, anything around the legal industry is probably not for you, and you should get someone else to do it for you. Like Liticode *cough*.

Policy, and all documentation, really, is a support structure. And just like any support structure, requires engineering. Wordsmithing, not metalsmithing, but still, craft that requires study. If you throw something together without adequate understanding and skill, you end up with more problems than before you made the policy. Like a bad bridge, it will collapse at the worst possible time, probably taking careers with it.

A more visually correct representation is a house of cards, because we’re dealing with documents, and most of them are flimsy things that collapse under the faintest pressure.  But we’re going to fix that problem by building using better cards.  Cards made of reinforced concrete and steel, architected not cobbled together.

Policy is the roof. Why not the foundation? Because policy is the first line of defense. It’s what takes the first hits when you’re under attack by hostile lawyers or other nefarious entities, including your own personnel who just want to do things differently. Policy is the shield from stuff falling on the business.

The walls are the procedures and standards that support the policy. Can’t have a policy without process and standards, or it’s a useless policy. For example, if you have a policy that says no personal use of company assets, but you don’t have a process to detect it, or a standard of configuration for the business computers being used, your policy is going to be impossible to support.

So what’s the foundation? That is your charters, bylaws, explanatory documentation, authorities, and anything else that doesn’t count as part of the super structure.  A simplistic example is the criminal laws against theft.  They aren’t part of your policy or your procedures, but they provide the cause that your HR termination policy uses to support a dismissal.  You rely on them, just like you rely on manufacturer’s documentation, government standards, industry standards, and job descriptions, to direct the business.

So, just like building a complex house of cards, your policy in one area might be the foundation in another layer. The procedures of one layer are the foundation of another. The point to internalize being that all these documents are a) tangible, meaning they exist and you can put your hands on them to produce in court, and b) fit together like a puzzle, reinforcing and supporting each other, so that removing one piece in the bottom layer doesn’t cause the entire thing to collapse.  That last part is important.  They interlock and reinforce each other.

Which brings up the other fun part of the policy game. Who has ever performed a red team analysis of policy? Nobody, other than Liticode. We’re the only company that will look at your documentation and game it with our legal teams and provide you a risk analysis of your policy structure and documentation. And that’s just as important as your penetration testing of your network. The evil hackers might get your database, but the lawsuits that come after are what’s going to destroy the company and careers. We help you prepare with our policy analysis, but we want you first and foremost to have people that grasp the concept of the policy structure and how it is critical to your corporate defense.  Defense in depth includes the legal activities side.  Most (all?) risk assessments simplistically check off boxes indicating policy is present, but don’t evaluate the content.  That will get you blindsided, and we can help avoid that.

So enjoy building policy. Call us if you’re short handed or want an additional set of eyes. Call us later if you want to test it and see if you have any unexplored risks in your structure. Our staff has the skill and experience to turn your house of cards into a fortress.

Identification Identity Crisis

Should organizations require and validate a government issued form of identification before granting network access? It’s easy enough to do. Costs a bit for the comparison books and an hour of training, but it will catch the majority of bad identification.  Of course, what to do with it after you’ve caught it…

But how much bad identification, as opposed to high quality forgeries, is seen in any business? No data.

More importantly, as has been pointed out by some bright people in the industry, the secretary is not a security guard, and the security guard is not a security professional.  Some small percentage of false identification is going to result in violence.  Better the guard than the HR representative.

Regardless of whom, outside of the government, nobody without a Treasury department background is going to catch the good forgeries.  So we can at best reduce a risk, but not eliminate it.

Given the possibility of violent confrontations, would a business be better served by a validation after the fact? It depends on the business, but in general, giving network access to the bad guys for any amount of time is a bad idea.

How do you test effectiveness when the mere act of copying a form of identification can be a Federal crime?

It makes perfect sense, wanting to identify persons with access to the network, but the process does not make perfect sense.  In the meantime, businesses will go on accepting fake identification and getting taken by fake ID holders.