Yet another Hack...

United health group/change healthcare hacked last spring just got notification.

100 million people had their data stolen.

can we please FOR THE LOVE OF GOD stop putting important data on the interwebs for the sake of convenience if you are not going to spend the money to secure it.

I dont want the monitoring option I want in on a class action suit every single time one of these conglomerates have some idiot with a music degree heading up cyber security sue them for a couple hundred million, then maybe just maybe they will start hiring people with a clue.

So sick of this, its all 100% preventable.... but nobody wants to spend the money or the time to make it so.

Tech Crunch

A ransomware attack earlier this year on UnitedHealth-owned health tech company Change Healthcare likely stands as one of the largest data breaches of U.S. health and medical data in history.

Months after the February data breach, a “substantial proportion of people living in America” are receiving notice by mail that their personal and health information was stolen by cybercriminals during the cyberattack on Change Healthcare. At least 100 million people are now known to be affected by the breach.

a reply to: Irishhaf

It's not folks with a music degree. It's a CISO and security team fighting the CFO and cost centers. Even then, with the best controls you can implement, you're still going to get popped. There's a person in HR or customer service or whatever that clicks on a link, and congratulations you've let a threat actor into your environment. Until you can remove the human element from things, this will continue to happen.

a reply to: Hypntick

I know have a graduate degree in Security management, I understand..

I said Music degree because the first time my data got hacked from the fed was the OPM hack several years ago. (they never cleared a contractors credentials after they were done with the work)

Before that my data got hacked and it was tracked back to the CISO actually had a music degree.

I am mid level IT having to fight with the communication sq to get the credentials I need to do the job I was hired to do on the base I work at.

I have rapidly grown to hate this career path I am on but, I am to old to change career again.

a reply to: Irishhaf

Careful...musicians are phenomenal mathematicians and physicists.

Ever hear of a guy called Brian May...sir dr may.

If his reply is no that will make two of us.

a reply to: theatreboy

a reply to: theatreboy

I have not, and I am not talking about mathematicians and physicists, I am talking about cyber security.

a reply to: Irishhaf

I ..have a Masters in Security and Emergency Mgmnt.

Michigan State
U of M
Henry Ford Health
DMC

a reply to: theatreboy

Dudes an Astro Physicist...got a new Astro book out too.

a reply to: Irishhaf

Do you receive CISA? I do. Everyday. You can receive them as well.

Cyber Internet Sec

originally posted by: Irishhaf
a reply to: theatreboy

I have not, and I am not talking about mathematicians and physicists, I am talking about cyber security.

Something tells me math and physics are involved with cyber security.

Brian May, astrophysicist and founding member and guitar player for Queen.

a reply to: Irishhaf

Not saying that a CISO can't have changed focus areas over the years, I've seen plenty with business degrees instead. I get the business side of things, you've got to understand how security impacts the business to make informed decisions. That being said there's a director or SVP somewhere that should know better.

Then again I've done enough tabletops for Fortune 50 companies to know the CISO, unless it's someone that's worked their way up, have no clue around the technical controls needed, they rely on underlings to give them appropriate data and budget. The smart CISO, if they don't understand any better, will hire consultants who will inform them of what needs to be remediated. I can't tell you how many times, as a consultant, I've had my work product signed off on, put in a binder, and a box checked off saying "yep we did this". I have my name removed from such reports, I do not want to have to show up in court, least fun part of my job.

a reply to: theatreboy

Math features into encryption and data analytics, physics not so much. Yes I have a BS and MS in cyber security, not a lot of math required aside from knowing how some of the cryptography works, even then you go with RSA 2048 and hope quantum stuff doesn't keep up before we get to quantum encryption.

a reply to: mysterioustranger

CISA and SANS.

then I get to work argue and get over ridden by E-2's and 3's that tell me not to worry about it bases dont get hacked.

every time my data has been exposed it was failures by sys admins (credentials not removed, failure to patch, or just a lousy set up leaving gaps in the defense., time will tell on this one.

a reply to: Irishhaf

Until WE own these systems....we're screwed.

Their toys after all that.....