Anthem Blocking Federal Auditor From Doing Vulnerability Scans 116
chicksdaddy writes Anthem Inc., the Indiana-based health insurer, has informed a federal auditor, the Office of Personnel Management, that it will not permit vulnerability scans of its network — even after acknowledging that it was the victim of a massive breach that leaked data on tens of millions of patients. According to this article, Anthem is citing "company policy" that prohibits third party access to its network in declining to let auditors from OPM's Office of the Inspector General (OIG) conduct scans for vulnerable systems. OPM's OIG performs a variety of audits on health insurers that provide health plans to federal employees under the Federal Employee Health Benefits Program, or FEHBP. Insurers aren't mandated to comply — though most do. This isn't Anthem's first time saying "no thanks" to the offer of a network vulnerability scan. The company also declined to let OIG scan its network in 2013. A partial audit report issued at the time warned that the company, then known as WellPoint, "provided us with conflicting statements" on issues related to information security, including Wellpoint's practices regarding regular configuration audits and its plans to shift to IBM's Tivoli Endpoint Manager (TEM) platform.
no need (Score:4, Insightful)
Re: (Score:1)
LOL! (Score:1)
OPM. Ok. Who invented this agency??
Sorry to say. But there's no way I'd let them in my doors either. Where's the credibility nowadays?
WTG Anthem! NO MEANS NO!
Re:LOL! (Score:4, Informative)
Congress created this agency years ago (1883 i think) when it passed the civil service act into law.
It's a central office in charge of federal government employees and administrates their benefits and retirement packages as well as wage tables and so on. You can think of them as the HR department on a grand scale.
Re:LOL! (Score:5, Insightful)
Anthem need to learn the rules of the playground and start abiding by them, if I were the Fed I'd be shutting their arses down until they comply. No? You're telling me "NO"?? Fuck you. Get the fuck out of my playground.
Re: (Score:1)
Precisely! What is the issue here? If they want our money they will open their books.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
how about data protection laws, for a start?
Re: (Score:2)
I would not back down until they were audited. Sorry but personal records are at stake.
Re: (Score:2)
What would you do to the federal reserve and their audit refusal?
Re: (Score:2)
wow, how dangerous is it to fuck with the Fed? Let's ask Messrs. Lincoln and Kennedy...
Re: (Score:1)
Re: (Score:2)
O/T: There was no Fed before 1913. However, we've had one form or another of a national bank for much longer; the story of how Andrew Jackson stared down Nicholas Biddle and put a leash on the Second Bank of the United States is quite a different story. Perhaps it was this which you attempted to reference...but even then, the BUS lost.
Re: (Score:2)
your issue isn't with me, your issue is with Anthem.
Re: (Score:2)
nope, he's not me. And I hope Anthem gets told which country they can carry on this type of behaviour in (one without data protection laws, maybe?)
Re: (Score:2)
But there's no way I'd let them in my doors either.
Pray that you never get a federal job. OPM conducted my background investigation for a security clearance. My two-hour routine interview turned into a four-hour nitpicking interview. Being single and staying in the same studio apartment for nearly ten years was considered odd. Working a weekday job and a weekend job for a year, and having multiple overlapping contract jobs for several years, was odder. Not being able to remember every detail of every job I had to take since the Great Recession was oddest. W
Company Policy? (Score:3, Funny)
"Anthem is citing "company policy" that prohibits third party access to its network in declining to let auditors from OPM's Office of the Inspector General (OIG) conduct scans for vulnerable systems."
Seems a little late for that now, doesn't it?
The industry needs more regulation (Score:5, Insightful)
We need regulation....
Insurers aren't mandated to comply — though most do.
They should be required to pass their audit or pass an audit by a 3rd party auditor who is approved by the OIG.
Failure to comply should result in fines and bar them from writing or acquiring any more insurance policies, until they do.
Also, in the event of a breach at this juncture, there should be a financial penalty for their negligence.
Re:The industry needs more regulation (Score:4, Funny)
Re: (Score:2)
You're being sarcastic, right? "Obamacare" doesn't insure people. There was no public option In the healthcare debate.
Re: (Score:2)
Re: The industry needs more regulation (Score:1)
As an Indiana resident, Anthem is essentially my only ACA option already.
Re:The industry needs more regulation (Score:4, Interesting)
This will definitely provide fodder for all the class action lawsuits that are in the works.
I wonder just how reckless a business has to be with their security before they risk charges of criminal negligence.
Re: (Score:3)
This is hilarious. Every day slashdotters either complain that it's *obvious* we need less regulation. And in a separate thread, it's *obvious* we need more regulation.
Re:The industry needs more regulation (Score:4, Insightful)
This is hilarious. Every day slashdotters either complain that it's *obvious* we need less regulation. And in a separate thread, it's *obvious* we need more regulation.
*protip* slashdotters as you so put is is not a hive mind, people post here from all walks of life and have differing opinions. In fact I have seen opinions from both sides of the political spectrum that have been rated +5 insightful in the same thread. And they were both right, it was insightful and made you think. The last thing this site needs is to become an echo chamber of samethought and goodthink. If you are looking for that there are plenty of other websites out there, may I recommend Tumblr or yahoo news?
Re: (Score:2)
Re:The industry needs more regulation (Score:4)
This isn't inconsistent. On the whole we do need less regulation. I would agree with that. There should be little regulation, but it should be effective regulation.
There should also be a concept of "temporary regulation".... for example: We see this widespread abuse, so for the next 5 years you all have to do X, and if you shape up, then you industry players can decide how to do it afterwards, BUT you will be fully on the hook financially, for negligence, if you do X and it causes damage to people.
There are some subjects or some elements in certain industries that need more regulation, because it's become the "industry standard" to abuse consumers, or people are unfairly being put at risk to save $$$ or safe face for some Mega Co, when Mega Co is essentially a local monopoly or nearly so.
Re:The industry needs LESS regulation (Score:1)
No, no no! The Free Market will solve this problem. The Market Solves ALL problems! We should just de-regulate everything because regulation is EVIL!
That way, Anthem will no longer have to waste money on compliance so they can spend it on productive things like buying up all the competition.
Re: (Score:1)
Also, in the event of a breach at this juncture, there should be a financial penalty for their negligence.
Fines Remain Rare as Health Data Breaches Multiply [soylentnews.org]
on Tuesday March 03, @04:51AM
from the cost-of-doing-business dept.
tt2024432 writes:
Since October 2009, [US] health care providers and organizations (including third parties that do business with them) have reported more than 1,140 large breaches [hhs.gov] to the Office for Civil Rights, affecting upward of 41 million people. They’ve also reported more than 120,000 smaller lapses, each affecting fewer than 500 people.
In a string of meetings and press release
Well... (Score:5, Funny)
I think they already allowed third party access. What's a few more.
Anthem is normal here (Score:5, Insightful)
I work for an organization that hosts PII for a number of large public companies. We are constantly asked about vulnerability scans and about 50% of the clients want to scan our networks themselves. We do not allow that.
The compromise is that we conduct bi-weekly scans with Rapid7, and hire from a rotating list of third parties to conduct yearly vulnerability assessments of our applications and infrastructure. We make the high level results of those scans (number of vulnerabilities found) available to the clients. We also have to put up with the occasional fire drill like Heartbleed. During those situations, we deploy the patches as soon as we can test them, and then provide letters of attestation to any client who wants / needs one.
While some clients complain, they eventually come around when we explain to them that it is for their own safety and the protection of their information. We are in a situation where we retain data for companies who are in direct competition with each other. When push comes to shove, we sometimes have to explain that, "Just like we will not let you scan our network for vulnerability, we will also not allow your direct competitor to scan our networks either."
Re: (Score:3)
Bypassing your security is easy. Step 1, Bad Guy kills your dog in front of you. Step 2, Bad Guy then puts the gun to your head and starts removing body parts till Bad Guy has access. Lets face it, its not exactly the Bad Guys problem that you are bleeding to death on your carpet. It's a hell of a plan you've got.
Why is it you liberal idiots always assume only bad guys have guns?
Step 0, bad guy spotted on approach and hit three times in the gut with .357 rounds. Better yet, a 12 gauge at the doorway.
Maybe YOUR plan is give up your tender butthole. Not everybody is like that.
Re: (Score:2)
Re: (Score:2)
We are in the same situation and we have data centers spread around the globe to deal with data privacy and jurisdictional considerations.
Re: (Score:2)
You seem to be arguing that disallowing third-party scans is normal, but you admitted your company allows Rapid7 to conduct biweekly scans.
Re: (Score:2)
I could have made that more clear. We license Rapid7 and use their tools to conduct internal tests of the systems on a bi-weekly basis.
Re:Anthem is normal here (Score:5, Insightful)
That sounds reasonable to me. If were running a security group, I would take care of as much in-house as I possibly could. I especially wouldn't allow business partners to scan my gear.. There is just too much risk there.
There are a couple differences with Anthem, though.
Here's a quote from the OIG:
That sounds more like a company with shoddy security trying to hide its failings behind a specious policy.
Re: (Score:2, Interesting)
I work for a large multinational in the human capital management space and we let a select number our customers do penetration testing. Our customers range from Fortune 500 to government agencies in the US and EU. It is not an unheard of practice, and I would argue it is quite common for these requests to come up, especially during contract negotiations.
Re: (Score:2)
How do you deal with things like re-tests and conflicting priorities for remediation? For example, client wants vulnerabilities patched in one week but the next maintenance window is for two weeks.
Re:Anthem is normal here (Score:4, Funny)
I work for a large multinational in the human capital management space and we let a select number our customers do penetration testing. Our customers range from Fortune 500 to government agencies in the US and EU. It is not an unheard of practice, and I would argue it is quite common for these requests to come up, especially during contract negotiations.
My little firm can't afford stuff like that. So we outsource our testing to China and Russia - they charge a lot less.
Seems like they're always falling over each other to try and accommodate us.
Re: (Score:2)
Why won't you allow that? Criminals, including secret services, do it too, As long as you know what you're doing, it really shouldn't matter.
Of course, I wouldn't give them any special access to do it.
Re: (Score:2)
HIPAA covers unintentional breaches as well for the simple reason that unintentional breaches SHOULD NOT BE POSSIBLE.
Mmm hmmm (Score:2)
Anthem is citing "company policy" that prohibits third party access to its network
I guess the hackers didn't read--or failed to abide by--that policy. Kind of like "gun-free zone" which only deters the law-abiding.
Re: (Score:2)
Re: (Score:2)
There's a diff between "Blocking" and "Refusing" (Score:4, Interesting)
If they can actually block the scans, that'd be... well...more secure than their track record indicates.
Anthem is a publicly traded company (Score:5, Interesting)
They should be required to file an 8K form to legally inform all of their stock holders that they have material news that may adversely affect their future stock price, or even company viability.
After having been informed of extreme security issues on our network, Anthem Inc has elected to ignore the situation. Furthermore, Anthem Inc's network is so embarrassing, that Anthem Inc has decided to risk significant fines and legal expenses, rather than allow adults to see just how bad it is.
Translation, shareholder lawsuits may be addressed to Joseph R. Swedish, et al.
Re: (Score:3)
Seems like a clear cut Sarbanes-Oxley problem as well, an external audit would seem to be required given the intrusion they suffered.
Because They've Been Hacked (Score:3, Informative)
Through no real choice of my own, WellPoint/Anthem was involved in some of my shit (they were behind the only decent plans my employee offered, though they weren't branded as WellPoint/Anthem anything). They leak data frequently.
About once a year I get a notice saying my shit has been leaked and that they're providing "identity protection" bullshit as compensation. My current pointless "protection" plan is handled by some clowns called FraudStop.
simple answer (Score:5, Insightful)
STOP THEM FROM OPERATING. Prohibit them from carrying out a single transaction until they comply with Federal requirements. Fuck them, if they don't want to abide by the rules, we'll take their fucking marbles off them and kick them out of the playground.
Re: (Score:2)
if you have a problem with your insurance underwriter being shut down by the Fed for misbehaving, that's something you have to take up with THEM, not ME. That's what corporate liability is for.
Re: (Score:2)
yes. Are you that fucking stupid you'll sue anyone who happens to be around when they have fuck all to do with your problem?
Re: (Score:2)
Prohibit them from carrying out a single transaction until they comply with Federal requirements.
You'd be less incensed if you read the summary. And you'd have fewer upmods if the moderators did too. Sheesh.
Nice policy you've got there. Would be a shame if (Score:3)
According to this article, Anthem is citing "company policy" that prohibits third party access to its network...
Sounds like y'all'd better beef up your security because, if they manage to access your network, you've violated company policy by allowing it to happen.
The government isn't bound by your company policy.
On the other hand ... (Score:3)
The place I work is required to allow itself to be scanned, both from outside and inside the network perimeter. However, whenever the auditors show up to do their inside scanning, we have to disable a number of security systems so they can "do their job". Kinda defeats the whole purpose, but whatever makes the auditors happy.
Re: (Score:3)
Not really...
Just because your firewall drops a port-scan (simple terms here) doesn't mean that someone won't get lucky and guess an open port and exploit it.
The Auditors want to know if you're patching your systems.
No point leaving the combination to the safe on a sticky note next to it, and then saying "it's ok. I always lock my front door".
Multiple types of scans (Score:1)
There are a variety of different scans.
There's simple stuff like "is this port open when it shouldn't be", or "can I get to this host which should be firewalled"
Then there "when I connect to Apache on host X, is it running a version with known vulnerabilities. Are they patched"
Finally there's
"Is host X running exploitable Y which is currently protected by Z, but could be exploited if A, B, or C happened"
For the last one, it's still important to identify vulnerable software even if it's not accessible by a f
March is colon cancer awareness month (Score:1)
From the hero graphic on Anthem's site:
March is colon cancer awareness month
Find out how screening save lives.
The irony wasn't lost on me...
Re: (Score:2)
heh, yeah. I'll undergo a colonoscopic exam AFTER Anthem do.
Shutdown -hell yes now (Score:2)
Health care companies cannot operate without a license.
Just remove their license, or forever remain a toothless laughing stock.
Re: (Score:2)
This.
Yeah, and...? (Score:1)
More than meets the eye (Score:2)
The typical compromise (see what I did there?) when a customer or Federal Government auditor wants to run scans of any sort on your private network is to agree on tools (to be provided by the auditing group if you don't already have them) running an agreed configuration/profile/whatever against an agreed limited scope target list (typically a VLAN or set of VLANs unless that entire network is devoted to just that one customer, which is sometimes the case, though less so these days with public/private/hybrid
Somebody please... (Score:2)
Their security must suck (Score:2)
Earlier this week I put in a request for pen-testing a new server I had completed. I think it's secure, but that isn't my area of expertise, so I have the experts kick the shit out of my server to see if anything falls over.
Enough scans for everyone! (Score:2)
Believe me, they'll be getting vulnerability scans whether they want them or not! (They just won't get the results in their chosen format!)
On the internet, everyone gets a free pentest!
Two scenarios. (Score:4, Insightful)
Dear Investigator,
We understand you suspect our CEO was doing insider trading and want access to our server logs to find evidence of guilt or innocence. While we appreciate your conscientiousness, we regret, we do not allow third party access to our servers. We thank you for your understanding. Hoping this would buy us enough time to sanitize our server logs, Yours, Gofly Akite, for Dewy Chetham and Howe.
SEC investigator: eh? well, OK, Guess I tried, so I have covered my ass
Scenario 2:
"Hey Police officer, you want to search my car for pot? I know you are just doing your job, but sorry buddy, my policy is not to allow any third parties into my car. Hope you understand"
Police Officer: "Keep your hands visible, and slowly exit your vehicle, turn around put your hands on the hood and bend over..."
Re: (Score:2)
uh, no. When a Government agency puts a contract out to tender, THEY SET THE TERMS. This INCLUDES random penetration testing and periodic data security/integrity auditing. A contractor who does not agree with any terms of contract may NOT change said term, may NOT negotiate on said term, may NOT make a conditional bid.
(citaiton: I have completed Government contracts. Can't say any more under 1911 c.28 section 2).
Their mistake - (Score:1)
...was in not publishing those policies to the hackers that got in earlier. If only they had known that there was a company policy against it, it could have saved everyone a lot of extra work.
All things considered though, this arrogance seems in line with a place who doesn't know their own vulnerabilities. I'd wager this isn't the first time they have been compromised and this is just defensive turtling to try to hide facts.