Data for 40M Target shoppers was stolen via the Target HVAC system network interfaces
Intro
I’m developing OpenCRO - the AI chief risk officer for medtech.
Just finished cycle-5 of the project. OpenCRO agents developed 1501 risk models for AI-enabled medical devices.
Yeah!
Don’t get me wrong. It was not easy.
There were a lot of twisty, thorny problems to solve. Still not finished.
You can’t just prompt a language model with FDA submission number and expect it to come up with a risk model. I’ve written about my trials and tribulations here, here and here. You need a system of agents with well-defined tasks.
As of this morning I have 25 agents being supervised - I’m not keeping track - so I asked the capo agent (the supervisor) to tell me how many we have right now:
And the agents use backend services:
Why we need an AI Risk Officer
AI has changed the way we code. Our coding chops have atrophied. Code quality has plummeted and exploits have accelerated.
MedTech operates on a 1-10 year design, build, regulatory and quality cycle.
Attackers operate on a 1-5 day cycle.
We need to know what risks count before the attackers and how much the damage costs.
I’m almost there.
When I started developing OpenCRO - I used the agents and got the time down from 60 days to 14 days. Proved it with a paying customer.
Then 2 days. Then 2 hours. Now 60s.
What risks really count for your business?
No question is more important for implementing an effective program of cybersecurity for your MedTech company. The management board, IT and security practioners cannot expect to mitigate risk effectively without knowing the sources and cost of threats to the organization.
Modern healthcare organizations and pharma depend on their information processing systems in order to conduct business.
The prevailing security model predicates defense in depth of these systems. The most common strategies are to mitigate risk with network, cloud and application security products.
These products are reactive countermeasures; blocking network ports and services, detecting known application exploits, or by blocking entry of malicious code to the network.
Is your security implementation likely to be effective in the long-term?
Can attacks on your customers and patients be neutralized with defensive means only?
In other words, is there a “black-box” security solution for a MedTech business?
The answer is clearly no.
A reactive network defense tool such as a firewall cannot protect exploitation of software defects and an application firewall is no replacement for in-depth understanding of company-specific systems or system configuration vulnerabilities.
17 years ago I introduced a methodology called Business Threat Modeling.
You can download the methodology for free.
Business Threat Modeling is a continuous threat assessment process for software development organisations that employs a systematic risk analysis of complex software systems along with quantitative evaluation of how well wremoving software defects reduces risk.
Business Threat Modeling is based on four basic tenets, that are discussed at greater length in this article. The four tenets are:
Security assessment of complex software systems
Quantitative evaluation and financial justification for security countermeasures
Explicit communications between developers and security
Sustain continuous risk reduction
THE PROBLEM: DEFECTIVE SYSTEMS ARE INSECURE SYSTEMS
This seemingly obvious observation is graphically borne out in 2 large-scale examples of data breaches that happened almost 10 years ago: WannaCry andTarget.
WannaCry ransomware - the NSA was keeping it a secret
A single vulnerability can be exploited in large numbers if left unpatched in widely-used software.
The WannaCry ransomware outbreak in 2017 was largely due to an unpatched vulnerability in Microsoft Windows, affecting hundreds of thousands of computers globally.
WannaCry was initially discovered by the U.S. National Security Agency (NSA), and codenamed “EternalBlue”.
The timeline after the NSA discovery shows an interesting chain of events.
The U.S. National Security Agency (NSA) did not publicly disclose the "EternalBlue" vulnerability. Instead, it was leaked by a hacking group called "The Shadow Brokers."
In April 2017, The Shadow Brokers released a set of hacking tools, including the EternalBlue exploit, that they claimed were stolen from the NSA. Shortly after the leak, Microsoft released a patch (MS17-010) for the vulnerability on March 14, 2017. This was about two months before the WannaCry ransomware attack began on May 12, 2017.
Given the timeline, Microsoft's patch was available before the WannaCry attack started, but many systems remained unpatched and were thus vulnerable to the ransomware.
It's not clear how Microsoft became aware of the vulnerability before the Shadow Brokers leak, but some have speculated that the NSA informed Microsoft about it once they realized there was a risk of the exploit being leaked or discovered.
Target - stealing 40M payment cards via the air-conditioning systems
The Target data breach that occurred in 2013 compromised the payment card data of 40 million Target customers. The attack was a result of a complex series of events:
Initial Entry through a Third Party: The attackers initially gained access to Target's network by stealing credentials from a third-party HVAC vendor, Fazio Mechanical. It is believed that the credentials were stolen through a spear-phishing attack on Fazio Mechanical, making phishing a distant origin of the breach but not the direct cause of Target's breach.
Movement within the Network: After gaining access to Target's network using the HVAC vendor's credentials, the attackers were able to move laterally within the network, eventually accessing the point-of-sale (POS) system.
Malware Installation: The attackers then installed malware on the POS systems to scrape and transmit credit card data before it was encrypted and sent to the payment processor.
Exfiltration: The stolen data was periodically collected by the attackers and sent to external servers.
So, while phishing played a role in the initial stages by compromising a third-party vendor, it was not the direct method used to breach Target's systems.
The breach underscored the importance of taking a systems approach to protecting transaction processing systems, including securing third-party vendor access and ensuring robust network security segmentation (i.e. making it impossible for attackers in the HVAC network to get on the stores network).
Software vulnerabilities - this has been going on for over 25 years
The Carnegie Mellon Software Engineering Institute (SEI) reports that 90 percent of all software vulnerabilities are due to well-known defect types (for example using a hard coded server password or writing temporary work files with world read privileges). All of the SANS Top 20 Internet Security vulnerabilities are the result of “poor coding, testing and sloppy software engineering”. See the latest SANS Critical Information Security 2023 controls here.
Why don't organizations do more to improve their production systems quality?
Let’s examine commitment to quality at three levels in an organization: end-users, development managers and senior executives.
Users are conditioned to accept unreliable software on their desktop.
Development managers are inclined to accept faulty software as a tradeoff to meeting a development schedule.
Senior executives, while committed to quality of their own products and services, do not find security breaches sufficient reason to become security leaders with their enterprise systems because:
They usually receive conflicting proposals for new information security initiatives with weak or missing financial justifications.
The recommended security initiatives often disrupt the business.
The need to understand operational risk
Network and application security products are reactive means used to defend the organization rather than proactive means of understanding and reducing operational risk.
Today’s defense in depth strategy is to deploy multiple tools at the network perimeter such as firewalls, intrusion prevention and malicious content filtering.
The defense-focus is primarily on outside-in attacks, despite the fact that the majority of attacks on customer data and intellectual property are inside out. The notion of trusted systems inside a hard perimeter has practically disappeared with the proliferation of Web services, SSL VPN and convergence of application transport to HTTP.
A reactive network defense tool such as a firewall cannot protect exploitation of software defects and cloud application security that relies on databases of vulnerabilities is no replacement for in-depth understanding of specific source code or system configuration vulnerabilities.
In the past few years - the defense-focus has grown quickly to protecting data and software running in the cloud. And - yes - even the multi-billion dollar cloud security market, dominated by Israeli cybersecurity vendors like WIZ, is still a reactive approach to protecting the business.
THE OBJECTIVE: COST EFFECTIVE SYSTEM DEFECT REDUCTION
It is rare to see systematic defect reduction projects in production software running in the healthcare provider enterprise, apparently, if it were easy, everyone would be doing it. So what makes it so hard?
Current development methodologies (including Agile) used by internal development teams are a bad fit for threat analysis of production software systems.
The cost of finding and fixing a bug in a production system is regarded as too high.
The application developers and IT security teams don’t usually talk to each other. The larger the organization, the more they lose when information gets lost in the
cracks.
We can meet these challenges in a cost-effective way by establishing three tenets:
Use a risk analysis process that is suitable for production software systems.
Collect data from all levels in the organization that touch the production system and classify defects for risk mitigation according to standard vulnerability and problem types.Provide executives with financial justification for defect reduction.
Quantify the risk in terms of assets, software vulnerabilities, and the organization’s current threats.Require the development and IT security teams to start talking.
Explicit communications between software developers and IT security can be facilitated by an online knowledge base and ticketing tool that provide an updated picture of well-known defects and security events.
About OpenCRO
OpenCRO is an AI chief risk officer for medtech. It analyzes cyber and privacy risk to revenue, regulatory, reputation, and patients.
Given a FDA submission number.
In 60s.
In dollars.
And then I’ll show you how to minimize your risk at a minimum cost.
Fixed outcome, fixed price, in a yearly subscription with unlimited support.
Drop me an email if you want to see your product superiority and risk analysis.