The country’s second largest health insurer, Anthem Inc., has confirmed that it is the latest to join a growing list of major corporations to have suffered a serious data breach. Unlike many recent data breaches, Anthem was quick to publicly announce the breach only days after discovering that personal information on as many as 80 million of its customers and employees had been stolen. In this case, it appears that the hackers used rather sophisticated methods, managing to gather names, dates of birth, social security numbers, addresses and email addresses. Although it does not appear that any medical information or financial records were exposed, the information that was taken is more than enough to steal the identities of the affected individuals.
Free eBook: Modern Retail Security Risk – Get your copy now.
For so long, the focus of data breaches has been on credit card data, as stolen credit card data can so readily be turned into cash or goods. However, with the increasing popularity of EMV or chip and pin enabled credit cards, the prevalence of data breaches involving personal information may again rise to the forefront. This is especially true when one realizes the value of a stolen identity can often be far greater over the long term than the value of a stolen credit card. If access to insurance plan information were to have been stolen along with identity information, data thieves would have a good indicator as to which identities were of higher value based on the value of the insurance plan. If thieves focus on the individuals with the highest plan costs, these are likely the people who are more established in their lives, have families, higher incomes and better credit, meaning their identities are worth even more on the black market.
This breach highlights that data security is not an issue limited to those processing credit cards. Businesses of all types must think of the type of information stored in their systems and realize they are only as secure as their weakest system.
These simple methods can help protect businesses from electronic data theft:
- Protect a Location’s Incoming Internet Traffic
The first step in stealing data is finding an avenue into the targeted business. All of a business’ data circuits and its Internet connections must be protected by a robust and adaptable firewall; protecting the business from unwanted incoming traffic.
- Implement Secure Remote Access
When permitting remote access to a network, it is essential that this access is restricted and secure. At a minimum, access should only be granted to individual (not shared) user accounts using 2-factor authentication and strong passwords. Remote access activities should also be logged so that an audit trail is available.
- Keep Anti-Malware Software Up-to-Date
It is critical to keep all anti-virus / anti-malware software up to date with the latest versions and definitions. The companies that make anti-malware software monitor threats constantly and regularly update their packages to include preventive measures and improvements to thwart malware seen in other attacks.
- Update all Operating Systems as Security Patches are Released
Much like anti-virus / anti-malware updates, designers of operating systems are constantly improving their software to prevent hackers from stealing data, especially if a criminal manages to bypass the built-in security. It is essential that the latest security releases and patches be installed on all systems.
- Limit Outbound Internet Traffic
In addition to blocking unwanted traffic from getting into a location, it is always a good practice to selectively block outgoing traffic as well. Many modern breaches involve software that becomes resident on your network and then tries to send sensitive data to the hacker’s system via the Internet. No system can completely prevent unwanted malware or viruses, so a good last line of defense is making sure secure data doesn’t leave your network without your knowledge. The same firewall used in Step One should be configured to monitor outgoing traffic as well as incoming.
By Kevin Watson, CEO of Netsurion
About Netsurion
Netsurion is a leading provider of cloud-managed IT security services that protect small- and medium-sized businesses’ information, payment systems and on-premise public and private Wi-Fi networks from data breaches and other risks posed by hackers. Netsurion’s patented remote installation technology and PCI compliant cloud-based solutions simplify the implementation process and ongoing support. Any sized branch or remote office, franchise or sole proprietor operation can use Netsurion without the costs of onsite support. The company serves the retail, hospitality, healthcare, legal and insurance sectors. www.netsurion.com
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.