This is Howard Anderson, News Editor, Information Security Media Group. And today we're at the HIMSS conference talking to Dan Berger, President and CEO of Redspin. Thanks for joining us today. Thank you, Howard.
It's a pleasure to be with you. Dan, I thought we'd chat a little bit today about all the hacker attacks in the news, Anthem and Primera and others that have primarily been focused on some pretty gigantic organizations. Should we be worried about hackers going after smaller organizations here soon? Well, you know, as I wrote recently in our breach report, hackers are bad guys, but they're good economists.
So by that, what I mean is that it's all a rate of return. So the hacker's going to look at a large data store of PHI and realize that the way they can monetize that is going to be much greater than if they go after smaller hospitals. But that's really talking about hackers who are kind of organized crime or nation-state sponsored. What you would worry about with the smaller hospitals would be just individual hackers, someone working out of their basement who decides that, hey, this is a pretty good deal.
It's easy to get in. I can steal 20,000, 30,000, 40,000 records, monetize them pretty easily. So I do think it's a worry. And I know just a few years ago, in the breach statistics, it used to show that hacking was almost negligent.
And we kept predicting that that was going to change, and it sure has. Should business associates be worrying too? Business associates especially, particularly where they have mixed business lines and they've got healthcare as an important part of their overall business, and they're using PHI because typically they're not used to putting the same kind of extra special controls they should be putting around protected health information as they might around other information that they store. So I think, again, size does matter.
So I think it really depends on how much PHI they have. I think business associates are a right target. But again, it will be the larger ones that should really be worried. Right.
Another one to think about is self-insurers. Self-insured corporations that have their own PHI in there, servers. Again, they're self-insured. They're typically not thinking about PHI as, you know, they're not really thinking about HIPAA.
They're not thinking about PHI. But usually if you're self-insured, you're either a very, very big corporation or a very small corporation. And the very big corporation should really be worried to be doing their own HIPAA security assessments. So what other lessons can we learn from these recent mega hacks?
Well, it just shows that security is all about lowering risk. And many of these large, large hacks were the result of what would seemingly be, you know, kind of innocuous starting points, a phishing attack that someone then leverages to get a place of presence on the network and then moves from there to server to server to server. So I guess the lesson is that you can't really leave anything out when you develop an information security program. You've got to be testing not only your internal and your external network infrastructure.
You've got to be testing your web applications. You've got to be training your people so that they're not susceptible to those types of phishing or social engineering type attacks. And are there steps that people are not taking that they should to thwart the phishing attack? Very much so.
A few years back, social engineering used to mean you'd send a mock phishing email out and you'd kind of count the number of people or the percentage of people that failed. And it kind of ended there. Well, that's not, you know, that's not going to last long. I mean, you're going to get a little bit of water cooler talk about, oh, I fell for this phishing scheme and everything.
But that's not really not social. That's really not security training. So you've got to combine both mock phishing type social engineering testing with follow-on training, particularly if you can do it in context, like train the person when they failed. Far more effective than the typical kind of classroom training or even online self-paced training.
It's not the same as kind of fixing, addressing the problem when it occurs. What about risk assessments when you're talking to a client? What are some of the mistakes that are being made? How do you get it fixed?
A couple of big, big mistakes. The first mistake is that they don't scope the project comprehensively enough. You know, there's so many people who claim to do a HIPAA risk assessment today and maybe it's more like a HIPAA checklist as opposed to saying, what's the real intent of the HIPAA security rules? It's to evaluate the risks of threats and vulnerabilities across your entire organization.
So that's one is that make sure that the scope is broad enough and make sure you've got a qualified person doing that scope. The second thing and probably the biggest thing is that once you've done the assessment, you've got to do the remediation, you know, as painful as it may be. That's just knowing that you've got these risks really isn't going to do much for you. And there's people who just stop there.
Absolutely there are. Or they take the easy ones first and we go back. We've gone back several times to organizations that maybe a year later and we do the test again. And we're always frustrated when we find some of the same problems that existed a year earlier.
You've got to take it seriously. Security is really a process. It's assessment. It's remediation.
It's validating that what you remediated works and it fixes the problem and it's retest. And you go back through the cycle again to the next year and then you do another assessment. But you've got to be on that cycle. If you do that cycle well, your risk will not be eliminated, but you'll lower your risk.
Well, thanks very much, Dan. Thank you, Howard. It's a pleasure being with you again. We've been talking to Dan Berger, President and CEO of Redspin for Information Security Media Group.
I'm Howard Anderson. Thanks for listening.