News for hackers. Stuff that matters.

A comment on Equifax IT staff had to rerun hackers' queries to work out what was nicked. Parent comment

Re:Equifax IT staff had to rerun hackers' queries to work ou... by jugg1es on Wednesday September 19, 2018 @06:46PM (#18028249)
I work for a healthcare IT company that deals with tons of PHI (protected health information) and we have very strict security practices. New software is extensively evaluated at several points in the SDLC for security issues and access is tightly controlled. Engineers and CEOs have been held personally liable for major breaches (not my company!). Health records are WAY more protected than your SSN. If what happened to Equifax happened to a company like Epic, they would go out of business.
[ Parent | on HN ]
Re:Equifax IT staff had to rerun hackers' queries to work ou... by rficcaglia on Wednesday September 19, 2018 @09:30PM (#18029069)
Epic is not hosted software, it is installed and heavily customized at each hospital. Epic doesn’t have a global db of all patient records.
[ Parent | on HN ]
Re:Equifax IT staff had to rerun hackers' queries to work ou... by specialist on Wednesday September 19, 2018 @08:54PM (#18028887)
None of your systems store patient data encrypted at rest.

Inadvertent data breaches are inevitable.

The very best you could possibly do is access logs and auditing. Which of your customers do any kind of auditing?

[ Parent | on HN ]
Re:Equifax IT staff had to rerun hackers' queries to work ou... by sterwill on Thursday September 20, 2018 @07:59AM (#18031586)
Although at-rest encryption of health data is an addressable part of US health regulations, not a required one, it's almost always done because it's easy and effective. Most electronic health records are encrypted at-rest.
[ Parent | on HN ]
Re:Equifax IT staff had to rerun hackers' queries to work ou... by specialist on Thursday September 20, 2018 @09:57AM (#18032466)
I should have been more clear.

I'm advocating Translucent Database techniques, where patient data is encrypted at the field and row (document) level. Much like a salted password file.

System level encryption still means the admins can still see the data. Therefore, breaches remain inevitable.

[ Parent | on HN ]
Re:Equifax IT staff had to rerun hackers' queries to work ou... by paul_milovanov on Wednesday September 19, 2018 @10:31PM (#18029327)
Hold on, do you know for a fact that EPIC specifically doesn't encrypt data at rest? I'm not questioning your competence/knowledge, just trying to understand specifically what you're saying.
[ Parent | on HN ]
Re:Equifax IT staff had to rerun hackers' queries to work ou... by specialist on Thursday September 20, 2018 @12:48AM (#18029854)
The database or file system is likely (hopefully) encrypted. I'm referring to record and field level encryption. Like this:

Translucent Databases http://a.co/d/5855TYO http://wayner.org/node/46

Think of how password databases don't actually store passwords. Instead they (should) be storing salted and hashed passwords.

---

Please see my other comment about plaintext demographic data vs using unique identifiers.

[ Parent | on HN ]
Re:Equifax IT staff had to rerun hackers' queries to work ou... by jugg1es on Thursday September 20, 2018 @08:29AM (#18031795)
Literally every single system we have stores patient data encrypted at rest.
[ Parent | on HN ]