[{"innerBlocks":[],"name":"core\/freeform","postId":127569,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"

Top security lessons from FTC breach reviews<\/h2>
Healthcare organizations need to tighten up information security efforts, such as using best practices in requiring passwords and adopting data protection standards. Using findings from investigations of 50 data breaches across industries, including several at healthcare organizations, the Federal Trade Commission has developed key steps to improving data security. Here are 10 key lessons the FTC has distilled from studying those breaches.<\/p>

Don\u2019t collect personal information that\u2019s not needed<\/h2>
No one can steal what you don\u2019t have. Healthcare organizations, in particular, often collect a wide range of personal information on patients, some of which is not needed for the care that they\u2019re going to provide. Organizations should review their processes to make sure they really need all the information they\u2019re asking for and storing, because that raises the amount of information that needs to be protected, or can do an organization harm if hacked.<\/p>

Hold information only as long as legitimately needed<\/h2>
Many organizations, including those providing healthcare services, often don\u2019t have a game plan for governing the lifecycle of information. For example, holding onto credit or debit transaction information without a business need long after a sale is complete violates bank rules and enables hackers to steal the information and create counterfeit credit and debit cards. Similar risks exist in healthcare data collection as well.<\/p>

Don\u2019t use personal information when it\u2019s not necessary.<\/h2>
Protecting personal information involves being careful about how it\u2019s used. For example, one organization gave service providers access to sensitive consumer data to enable them to develop applications for the organization. In another example, a company used real people\u2019s personal information in employee training sessions and then failed to remove the information from employees\u2019 computers after the sessions were over.<\/p>

Insist on complex and unique passwords<\/h2>
Simple, easily guessed passwords, like 121212 or qwerty, aren\u2019t much better than no passwords at all. These lax practices leave organizations vulnerable to hackers who use password-guessing tools or try passwords stolen from other services in the hope that the organization\u2019s employees use the same password to access its system.<\/p>

Store passwords securely<\/h2>
The FTC reports that one organization stored network user credentials in clear, readable text, and that practice helped a hacker access consumers\u2019 credit card information on its network. Another organization allowed customers to store user credentials in a vulnerable format in cookies on their computers. In a third case, an organization did not have policies prohibiting employees from storing administrative passwords in plain text in personal email accounts. FTC recommends two-factor authentication to protect against password compromises.<\/p>

Guard against brute force attacks<\/h2>
Hackers use automated programs that use computing power to produce potential passwords at a high rate of speed, aiming to find those that unlock access. These brute force attacks work by typing endless combinations of characters until hackers discover someone\u2019s password. To thwart these types of brute force attacks (from automated attempts to log into a network) organizations should suspend or disable user credentials after a certain number of unsuccessful log-in attempts.<\/p>

Protect against authentication bypass<\/h2>
Locking the front door doesn\u2019t offer much protection if the back door is left open. The FTC\u2019s study found one organization that failed to adequately test its web application for widely known security flaws. As a result, the FTC contends that a hacker could easily predict patterns and manipulate URLs to bypass the web app\u2019s authentication screen and gain unauthorized access to the company\u2019s databases.<\/p>

Keep sensitive information secure throughout its lifecycle <\/h2>
Data doesn\u2019t stay in one place. That\u2019s why it\u2019s important to consider security at all stages if transmitting information is a necessity for an organization. The FTC found one organization that used SSL encryption to secure the transmission of sensitive personal information between a consumer\u2019s web browser and its website server\u2014however, after the information reached the server, the company\u2019s service provider decrypted it and emailed it in clear, readable text to the company\u2019s headquarters.<\/p>

Ensure proper configuration<\/h2>
Encryption\u2014even strong methods\u2014won\u2019t protect users if it\u2019s not configured properly. In two FTC cases, the organizations used SSL encryption in their mobile apps, but turned off a critical process known as SSL certificate validation without implementing other compensatory security measures, thus making the apps vulnerable, enabling hackers to decrypt sensitive information.<\/p>

Segment networks<\/h2>
Not every computer in an organization\u2019s system needs to be able to communicate with every other system. IT executives can help protect particularly sensitive data by housing it in a separate secure place on a network. One organization investigated by the FTC didn\u2019t sufficiently limit computers from one in-store network from connecting to computers on other in-store and corporate networks. As a result, hackers could use one in-store network to connect to, and access personal information on, other in-store and corporate networks. The organization could have reduced that risk by sufficiently segmenting its network.<\/p>

","saveContent":"

Top security lessons from FTC breach reviews<\/h2>
Healthcare organizations need to tighten up information security efforts, such as using best practices in requiring passwords and adopting data protection standards. Using findings from investigations of 50 data breaches across industries, including several at healthcare organizations, the Federal Trade Commission has developed key steps to improving data security. Here are 10 key lessons the FTC has distilled from studying those breaches.<\/p>

Don\u2019t collect personal information that\u2019s not needed<\/h2>
No one can steal what you don\u2019t have. Healthcare organizations, in particular, often collect a wide range of personal information on patients, some of which is not needed for the care that they\u2019re going to provide. Organizations should review their processes to make sure they really need all the information they\u2019re asking for and storing, because that raises the amount of information that needs to be protected, or can do an organization harm if hacked.<\/p>

Hold information only as long as legitimately needed<\/h2>
Many organizations, including those providing healthcare services, often don\u2019t have a game plan for governing the lifecycle of information. For example, holding onto credit or debit transaction information without a business need long after a sale is complete violates bank rules and enables hackers to steal the information and create counterfeit credit and debit cards. Similar risks exist in healthcare data collection as well.<\/p>

Don\u2019t use personal information when it\u2019s not necessary.<\/h2>
Protecting personal information involves being careful about how it\u2019s used. For example, one organization gave service providers access to sensitive consumer data to enable them to develop applications for the organization. In another example, a company used real people\u2019s personal information in employee training sessions and then failed to remove the information from employees\u2019 computers after the sessions were over.<\/p>

Insist on complex and unique passwords<\/h2>
Simple, easily guessed passwords, like 121212 or qwerty, aren\u2019t much better than no passwords at all. These lax practices leave organizations vulnerable to hackers who use password-guessing tools or try passwords stolen from other services in the hope that the organization\u2019s employees use the same password to access its system.<\/p>

Store passwords securely<\/h2>
The FTC reports that one organization stored network user credentials in clear, readable text, and that practice helped a hacker access consumers\u2019 credit card information on its network. Another organization allowed customers to store user credentials in a vulnerable format in cookies on their computers. In a third case, an organization did not have policies prohibiting employees from storing administrative passwords in plain text in personal email accounts. FTC recommends two-factor authentication to protect against password compromises.<\/p>

Guard against brute force attacks<\/h2>
Hackers use automated programs that use computing power to produce potential passwords at a high rate of speed, aiming to find those that unlock access. These brute force attacks work by typing endless combinations of characters until hackers discover someone\u2019s password. To thwart these types of brute force attacks (from automated attempts to log into a network) organizations should suspend or disable user credentials after a certain number of unsuccessful log-in attempts.<\/p>

Protect against authentication bypass<\/h2>
Locking the front door doesn\u2019t offer much protection if the back door is left open. The FTC\u2019s study found one organization that failed to adequately test its web application for widely known security flaws. As a result, the FTC contends that a hacker could easily predict patterns and manipulate URLs to bypass the web app\u2019s authentication screen and gain unauthorized access to the company\u2019s databases.<\/p>

Keep sensitive information secure throughout its lifecycle <\/h2>
Data doesn\u2019t stay in one place. That\u2019s why it\u2019s important to consider security at all stages if transmitting information is a necessity for an organization. The FTC found one organization that used SSL encryption to secure the transmission of sensitive personal information between a consumer\u2019s web browser and its website server\u2014however, after the information reached the server, the company\u2019s service provider decrypted it and emailed it in clear, readable text to the company\u2019s headquarters.<\/p>

Ensure proper configuration<\/h2>
Encryption\u2014even strong methods\u2014won\u2019t protect users if it\u2019s not configured properly. In two FTC cases, the organizations used SSL encryption in their mobile apps, but turned off a critical process known as SSL certificate validation without implementing other compensatory security measures, thus making the apps vulnerable, enabling hackers to decrypt sensitive information.<\/p>

Segment networks<\/h2>
Not every computer in an organization\u2019s system needs to be able to communicate with every other system. IT executives can help protect particularly sensitive data by housing it in a separate secure place on a network. One organization investigated by the FTC didn\u2019t sufficiently limit computers from one in-store network from connecting to computers on other in-store and corporate networks. As a result, hackers could use one in-store network to connect to, and access personal information on, other in-store and corporate networks. The organization could have reduced that risk by sufficiently segmenting its network.<\/p>

","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

10 security lessons from FTC breach investigations

More for you