Confidential drug testing results for several U.S. Olympic athletes were recently publicly released by a suspected Russian hacking group known as Fancy Bear. The hackers allegedly illegally accessed critical databases of the World Anti-Doping Agency, which organizes drug testing schedules and is used by athletes to keep authorities up-to-date on their locations. But could more releases of hacked personal health information of athletes, politicians, and other high-profile individuals be coming soon?
My name is Mary Ann Kolbasakmiki, Executive Editor of Information Security Media Group. Today I'm speaking with Sean Curran, a Director in the Security and Infrastructure Practice at Business and Technology Consulting firm, West Monroe Partners. Sean will discuss whether he expects we'll see more hacking of health records of high-profile individuals and steps at healthcare organizations and other entities to take to prevent those types of breaches. Sean, for starters, I should mention that the Kremlin has denied Russia's alleged involvement in this latest hack, but as we know, Russian hackers are also suspected in other recent high-profile hacks, including the attack on the Democratic National Committee.
So with that said, what do you make of this latest attack, and are the medical-related records of other athletes, celebrities, politicians, business leaders also at risk for such hacks, and why? It's a really good question. The hack that we're seeing and despite what Russian may or may not have claimed, the source of the hacks is definitely coming out of Russia, and it is still the potential that it was state sponsored though that's not always obvious in these cases. We've got the same challenges whether it's the hack coming out of Russia, we saw something similar last year, we take many of his medical records coming out of a clinic that he visited.
So we're likely to see these types of things occur whether it's a direct computer-based hack or whether it's an insider attack. And we'll still see these sorts of things to come up. I doubt that when people like Donald Trump and Hillary Clinton are seeking medical support and they're using third-party companies that aren't necessarily as secure as current major medical institutions are, there's a higher likelihood that those types of places may be compromised from a breach standpoint. The big problem here is for most of those organizations, they just don't have the investment in security and much stop the target in the eyes of the attacker.
So Sean, as you mentioned, there has been a lot of controversy about whether, for instance, Hillary Clinton and Donald Trump should release their medical records and if so, how much information should be released. Do you think there is a real danger right now that hackers or even perhaps malicious insiders are already working on how they can get their hands on this information and release it? How vulnerable do you think the medical records of Clinton and Trump are potentially to attacks or for other unauthorized disclosure by insiders, for instance, and what should be done about this risk? It all comes down to the motivations of the individuals involved.
When we talk about insider threats, it's an extremely difficult thing to address. There's certainly regulation that tries to address that with HIPAA and other regulatory requirements for the protection of these information, but if an individual has the desire, whether it's politically motivated or whether it's financially motivated, it's going to be very difficult to stop that type of attack, especially if they already have privileged access to the information. When you talk about malicious attacks that are driven by external parties that don't necessarily already have privileged access, if that information is held by an organization that is considered a softer target or doesn't understand the potential risk that the information they're holding presents, then there's a higher likelihood that they could be the fault to the country. We saw a very large-scale organizations, but government as well as non-government organizations have had over the last few years, so it stands a reason that if they're spending 3, 5, 10% of their budget on security in comparison to an organization that doesn't generate anywhere near that sort of revenue, they're going to be more likely to be at risk.
Sean, with that said, what special precautions should hospitals, health plans, clinics, and other health-related agencies, such as the World Anti-Doping Agency, take to protect sensitive information pertaining to high-profile patients, and what should these organizations be doing beyond the steps? They typically take to protect the medical records of your average patient. First thing that I would say is not only understand what data you're collecting and the value that it may represent, potentially taking an alternative view to data that may be collected on more high-profile people, but also making sure you understand everywhere it's located. The big challenge we see for most organizations is the data that they were collecting 10 years ago and stored in one major system is now being replicated to other locations and in other components of their business for different purposes.
And so minimizing that reputation and minimizing the locations where it's also reduced to likelihood has been compromised, or it certainly needs the potential that can. The next stage is really to think through who really needs access and how do I minimize that access. The security is often a balance between how much I'm willing to spend, how much convenience I'm willing to give up, and the amount of controls I want to have in place to be able to protect information. And so convenience is the area that we really need to give up at the means of being able to save expense.
Two-factor authentication is a great example. If I've got very sensitive information, putting two-factor authentication in place significantly reduces the likelihood of someone being under-complicate information. Today, in comparison to five years ago, implementing two-factor authentication is much easier. It's much more cost effective than it was five, ten years ago when you were paying hundreds of dollars to be able to spend something to that nature.
That's the major thing that they can look at. Minimize where the data is located, put in controls that will help to reduce the likelihood of being accessed by unauthorized individuals inside two-factor authentication, and then making sure they have a good comprehensive methodology to be able to look at the other risks and threats to their systems environments. Today, the biggest threat is associated with what the cost of the efficient attacks. A simple email sent to an unsuspecting employee, but that turns out to be nowhere.
So there's a lot of work that needs to be done to think about how to minimize that. The hacks today are not focused on the photos on the exam. They're focused on the employees and the allows for risk individuals. So minimizing that access and minimizing their data sort helps reduce the footprint and the likelihood of being caught.
So, one of those things that you just mentioned, where do you think organizations typically fail the most that you see resulting in some of these incidents that we've been seeing related to hacking attacks, particularly of high-profile sorts of individuals or high-profile organizations, such as the Democratic National Committee? Most organizations struggle with what we consider the hiding aspect, the bare minimums, which is in some ways a little surprising. It's understanding that storage of data and any data that I'm collecting and maintaining has a value in making sure that I only keep what I need for the period of time that I actually need it. That's probably the first area the organization struggle with is the purging of data that they know are necessary, and the minimization of its spread throughout the organization.
The next place would be really protecting those endpoints. We put a lot of stock in and BYOD, for instance, bringing around devices being hugely touted in the last couple of years, really goes against the concept of minimizing my footprint of attack. Bringing my own device suggests I'm putting an empowerment on my employees to protect those devices much more than I do with the assets I own. And so, understanding that convenience, giving up some of that convenience, the ability to change the background, the ability for an employee to install their own software where it's a printed driver for their home.
Giving up that convenience is what's going to help to protect the organization ultimately from attack. We've often been, and there was a huge portion in the last five years to give people full of injury back, so they can install whichever piece of software they decided to test. Those things that have increased the risk and the potential for these attacks would be successful. So addressing those hygiene issues that they're minimums and focusing on the data.
I'm not saying where that data is, it's key to minimizing the work of it. And Sean, do you see any particular weaknesses that seem to stand out when we hear about hack attacks in the healthcare sector? Are those organizations being sloppy in any other particular area more so than other industries? And if so, what area?
So, what area? Healthcare is interesting industry. As a patient, you look at the healthcare industry and say, if you've got a million dollars to spend, where would I rather you spend it? And securing your systems or buying the next medical device that may save my life.
And that's really the balancing act for most healthcare organizations is determining where the most affected place has been their investment needs. And security often is well down the line. So, what we see is that they're typically under invested in security. They're following the bare minimum standards or hoping to follow the bare minimum standards of people without necessarily really thinking through or total riskage to their organization.
They often undervalue the data that they collect. And so, really putting some emphasis around truly thinking about the risk. And understanding that risk profile. And then, utilizing that risk assessment to focus their investment in the areas that they're going to help them to reduce the risk or the life of the breach.
Now, for most of those organizations, we see employee pathway is a big problem. It's one of those challenges. They need to be able to access it. It's pretty quickly, especially though.
The patient is firm in cardiac arrest. I need to know what medications they can't take. So, I've got to balance the accessibility of my information against the need to be able to protect it. I have doctors who potentially move between clinics.
And so, I need to be able to provide them with the freedom of access to patients that they're servicing. And so, really, it's a big balancing act in the response between providing appropriate amount of access as well as limiting it to reduce the footprint. And finally, Sean, if there's one major lesson that is emerging so far from the hacking incident at the World Anti-Doping Agency, what is that lesson that other healthcare-related organizations should be paying most attention to? The biggest lesson, I think, for everyone, whether it's healthcare or any other industry, is not to believe that you're immune to the attacks.
To understand that whatever information you have has some level of value typically. It doesn't matter whether I'm in healthcare, whether I'm in manufacturing. There are components of the data record or the IT systems I run today that has a value. And it's placing enough emphasis on that fact.
And not looking at it with the cause of use it says, I'm not at risk. I think that's true not only for the healthcare industry, but the industry. There is some level of risk today being attacked, whether that's the financial benefits associated with the only credit card data or doing fake wire transfers, or whether that's the more profile of instances of stealing someone else's data or information that they care about to be able to release into the public sector. Thanks, Sean.
Speaking to Sean Curran, I'm Mary Ann Kolbasak-McGhee of Information Security Media Group. Thanks for listening.