What's New Two hospitals in New York state have agreed to pay $4.8 million to settle with the Department of Health and Human Services over HIPAA violations. The two organizations are the New York-Presbyterian Hospital and the Columbia University Medical Center, which jointly were involved in a data breach in 2010. Health data for 6,800 patients--status, vital signs, medications and laboratory results, according to HHS--was exposed online in 2010 and picked up by search engines including Google. A New York-Presbyterian spokesperson told Business Insider the error occurred "when a computer server was errantly reconfigured." An HHS report on the incident concluded that neither organization had sufficient controls in place and neither conducted a full risk assessment to identify risks to the data. For more:
- Read Business Insider's account
- And TechTarget's coverage More on HIPAA and healthcare security:
Move to the cloud generates compliance worries for IT pros
HHS slaps $2M fines on two healthcare firms for unencrypted laptop breaches
Healthcare organizations face multiple risk analysis requirements under federal law Read more about: healthcare security, PHI
back to top
| This week's sponsor is HP. |   | Network refresh
The next generation of network technology promises to make networks faster, more capable and more flexible. Organizations are beginning to deploy updated network technologies. But these network innovations increase the attack surface of organizations implementing them. And hackers often capitalize on the lag between the release of new technology and the availability of updated security protections. Read this paper to understand how these new technologies can increase your vulnerability and to view a set of common-sense recommendations to keep your business safer as you refresh your network. |
Microsoft issues eight security updates today; hackers are expected to use them as a blueprint for finding and exploiting holes in older software, reports Computerworld's Gregg Keizer. The company is no longer issuing patches for its Windows XP operating system, but the OS remains widely used. Net Marketshare says 26 percent of Windows users are still on XP. Microsoft's support for XP ended last month, so this month's Patch Tuesday updates are the first that may provide attackers with an idea of remaining holes that will go unpatched. "By conducting before-and after-patch code comparisons, attackers may be able to figure out where a vulnerability lies in Windows 7--which will be patched--then sniff around the same part of XP's code until they discover the bug there," Keizer writes. One of this month's security updates addresses Internet Explorer for Windows versions Vista, 7, 8 and 8.1. Keizer flags this as an example of a patch likely to be reverse-engineered in the search for a vulnerability in XP. For more:
- Read Keizer's report
- See more coverage on Digital Trends More on Windows security:
Microsoft steps up to the plate, patches critical zero-day IE hole
As Windows XP support deadline approaches, security concerns mount
7 deadly sins: The most dangerous new attack techniques for 2014 Read more about: Patch Tuesday
back to top
The Securities and Exchange Commission has released an investor alert to educate Bitcoin users about the potential schemes con artists have pulled off using the cryptocurrency. The agency said in its statement that many of the illegal tactics follow traditional patterns, but the nature of virtual currencies and the new--and newly rich--audience they attract makes the unaware more susceptible. Some characteristics of cryptocurrency the SEC highlighted as worrisome were its lack of central authority, lack of government backing, history of volatility and other general security concerns. "Fraudsters target any group they think they can convince to trust them," the alert states. "Scam artists may take advantage of Bitcoin users' vested interest in the success of Bitcoin to lure these users into Bitcoin-related investment schemes. The fraudsters may be (or pretend to be) Bitcoin users themselves." While the SEC's investor alerts carry no authority or directives, this marks the latest advisory from federal agencies or representatives about the dangers of virtual currencies. The Department of Defense is investigating the use of cryptocurrency to fuel terrorist plots, and the Department of the Treasury has pointed out its prevalence in bankrolling identity fraud, credit card theft, online scams and malware operations. While the schemes may be similar to tried and true tricks criminals have historically used, they could have a different effect on Bitcoin users. The SEC notes in its advisory that virtual fraud victims are much less likely to recover their money, not only because of the difficulty in tracing funds, but also the lack of insurance and government regulation that protects cryptocurrency. "Before making any investment, carefully read any materials you are given and verify the truth of every statement you are told about the investment," the SEC advises.
For more:
- read the investor alert from the SEC
Related Articles:
DoD probes cryptocurrencies as potential terrorist funding mechanism
Bitcoin mining malware hidden in Google Play apps
Heartbleed undermines Bitcoin client, developers advise update Read more about: SEC
back to top
An Ottawa teenager has been arrested on suspicion of placing more than 30 "swatting" incidents, calling bomb hoaxes and other threats to police and emergency responders. Unfortunately for Curtis Gervais, among the targets of his alleged misdeeds was security writer Brian Krebs. Krebs has previously been the victim of a swatting call, as he reported in detail on the Krebs on Security blog. This time a persistent Twitter user @ProbablyOnion harassed Krebs online, and apparently placed an emergency call reporting a hostage situation at Krebs' street address. The person also hung out a shingle on Twitter for swatting-as-a-service, and claimed responsibility for calls targeting schools and other public locations in the U.S. and Canada. @ProbablyOnion subsequently was identified as Gervais in a document posted to the information-sharing web application Pastebin. The Ottawa Citizen reports that Gervais faces 60 criminal charges, including uttering death threats and public mischief. For more:
- Read Krebs' account of the incident
- See the Ottawa Citizen's report More on swatting, online harassment and fraud:
Call center employee, others indicted for stealing AT&T customer data, money
Identity theft still top consumer complaint, says FTC (FierceCIO)
Hacker breaks into baby monitor to harass sleeping child (FierceCIO:TechWatch) Read more about: Swatting
back to top
| 
No comments:
Post a Comment
Keep a civil tongue.