[SecurityRatty] tag: sentinel

Achieve PCI Compliance with Novell Sentinel"

Thu, 18 Sep 2008 09:00:00 +0000

(Source: Novell) Security trends and hacking techniques are continually changing, and the Payment Card Industry Data Security Standard (PCI-DSS) continues to evolve. To stay ahead of these trends and prove compliance, your organization needs a powerful solution for collecting and monitoring user activity.

Blamestorming

Fri, 12 Sep 2008 02:03:42 +0000

So, let's recap the sequence of events:

The Sun-Sentinel newspaper in Fort Lauderdale accidentally republishes a six-year-old news story about the bankruptcy of UAL. It wasn't on the home page, but instead buried somewhere inside the web site.
Google's news crawler (an automated thing, remember) finds the story and incorporates it as part of its news feed.
Investors see the story, and immediately react. When UAL's stock plunged 76% to a low of $3, Nasdaq shut down trading. Eventually trading resumed, and the stock closed at just under $11, losing about 11%.
United blamed Tribune Company (the owner of the Sun-Sentinel) for "irresponsibly" changing the date on the story and demanded a retraction.
Tribune Company blamed Google, claiming they've had issues with Google's crawler "for months."

Who will blame be shifted to next?

Look -- if people haven't realized by now that the Internet pretty much lacks a delete function, then (IMNSHO) it becomes the requirement of each and every one of us to pay close attention to what we're reading, to use our own big brains and fine-tuned bullshit detectors to suss out whether something makes sense.

Since this is my blog, I'm going to parcel out blame the way I see it:

United: 0%. If the concept of "negative blame" made any sense, then I'd actually write −∞ (that's a negative infinity, in case your character set is different than mine).
Google: 5%. How can an automated crawler know that a newly-dated story isn't really new? Well, those folks over there at Google are smart. Certainly it shouldn't be that difficult to compare a "new" article against existing ones. Content hashes won't work as a comparison tool, because the date would be included in the hash computation, thus making the hashes different anyway. Full-text comparisons? Sure, it would take a lot of horsepower. Perhaps not every "new" story needs comparison, but at least the crawler could submit to the comparator any stories that ought to be verified (say those with the word "bankruptcy" in them).
Tribune Company: 30%. Hey guys, you changed the date on the article. Don't go blaming someone else for your screw-up.
Investors: 65%. If you're using an automated news aggregator (remember, an aggregator is not a source of news) to make major financial decisions -- decisions that affect the livelihoods of thousands (maybe millions) of people -- well, you're a moron. You should know that incorrect information can be just as instantly available as correct information. Verify potentially damaging claims before engaging in reckless behavior.

What's this got to do with security? I don't know, maybe nothing directly related. But it certainly raises the question -- what if someone intentionally wanted to cause nearly permanent damage to a person or a corporation? Malicious content, disguised as "news," certainly seems to have become a potentially successful attack vector this week.

Worried about a social engineering attack on a massive scale? I suspect that what happened Monday (8 September) was the largest social engineering attack in history -- although I wouldn't classify it as intentionally malicious. Just you wait until the idea spreads.

Automation Gone Wrong

Wed, 10 Sep 2008 17:00:04 +0000

We’ve talked about the changing nature of the data center and the critical role that even more automation – from virtual machine movement to runbook tools to auto-remediation and more – will have in trying to manage data center operations in real-time. But it’s always a balancing act. How “smart” can automated processes really be? What really should be automated versus requiring some level of human scrutiny and decision-making?

Well here’s a story where the tradeoff for speed and efficiency caused a massive stock dump erroneously.

Apparently, many traders use automation software that trolls the Web for news stories and then, depending on what it finds, executes stock trades automatically. It was United Airline’s bad luck that an old article about its 2002 bankruptcy-court filing showed up on Google’s news service and somehow made it to the list of most popular stories. In one of a series of mistakes here, the story had no date on it – which means Google’s algorithm for assessing popularity didn’t have a way to exclude it as an “old” story – OR (because there are conflicting accounts) the South Florida Sun-Sentinel actually put “today’s” date on the page that the story appeared on. This got picked up by the Income Security Advisors newsletter and sent over to Bloomberg News as a one-line brief. Plus there’s the inevitable conspiracy theory that people manipulated the web traffic for this story to adversely affect UAL. Regardless, on Monday afternoon, the stock plunged 76% in less than a day.

But the real problem here is the growing use of automated programs to trigger stock trades without any human interaction – instead based on news headlines and earnings data. According to the Wall Street Journal, these automated programs were responsible for a very surprising 25% of NYSE trades in the last week of August.

I’m sure we’ll hear more as the lawyers are now involved trying to figure out who should get the blame.

Waukesha County job applicant data exposed in mailing

Tue, 15 Jul 2008 04:07:06 +0000

Technorati Tag: Security Breach

Date Reported:
7/13/08

Organization:
Waukesha County, Wisconsin

Contractor/Consultant/Branch:
Crivello Carlson, S.C.

Victims:
Job applicants from the year 2006

Number Affected:
"more than 130"

Types of Data:
Job applications including, names, addresses, job and education history, salary, and Social Security numbers

Breach Description:
"More than 130 people who applied for a job with Waukesha County in 2006 had their Social Security numbers, employment and salary information, addresses and phone numbers and other personal information released to one of the women who applied for the job. "

Reference URL:
Milwaukee Journal Sentinel
New Richmond News

Report Credit:
Raquel Rutledge, Milwaukee Journal Sentinel

Response:
From the online sources cited above:

Taunya Thomas was horrified when she got a call from a stranger who knew almost everything about her.

The woman on the phone told Thomas she knew her Social Security number, where she lived and worked, how much money she made and where she went to high school and college. She rattled them off, not missing a single digit or fact.

She promised she wasn't going to use the information.
[Evan] Yeah. The government body that exposed the information made the promise that "your Social Security number will remain confidential". So much for promises.

She was calling, she said, because she wanted Thomas and others to know where she had gotten it.

She hadn't stolen it.

Waukesha County sent it to her in the mail, along with the same personal information for more than 130 other people who had all applied for a job with the county in 2006.
[Evan] What's with Wisconsin and mailing confidential information (in error)? This is the third mailing error reported on The Breach Blog coming out of Wisconsin this year.

The woman on the phone, Bernadine Matthews, too had applied for the position as an economic support specialist.

This is Matthews displayed holding the applications. Source: Milwaukee Journal Sentinel

When she didn't get it, she filed a complaint with the Equal Employment Opportunity Commission.

As part of the complaint and the investigation, the EEOC requested copies of all the applications.

The law firm representing the county, Crivello Carlson, sent the applications to Matthews.
[Evan] Really? Any second thoughts about the fact that this may put innocent people at risk?

Waukesha County tried to reclaim the documents sent to Matthews, threatening to get a search warrant and send a lawyer to her house, Matthews said.

When Matthews refused, they insisted she bring the documents to the law firm so they could white-out the private information in the applications.

Again, Matthews refused.
[Evan] At what point does Matthews cross a line. The confidential information on those job applications does NOT belong to her. In my opinion, she has no right to maintain possession of the information. For Matthews to knowingly maintain information that does not belong to her almost seems criminal to me.

The applications would be critical to her discrimination suit, she thought.
[Evan] So risk the disclosure of senstive information belonging to 130 people for your own benefit? If not criminal, it is certainly selfish.

She quickly hired an attorney, copied the documents and sent a set back to the county. She keeps her copies in an oversize safe-deposit box at her bank, she said.
[Evan] Who authorized her to make copies? The data owners (victims) certainly did not.

"I'm not going to be like the county," Matthews said. "I'm going to protect the privacy of the information in this box. Obviously they didn't give a darn about the applicants' privacy."

The Waukesha County employment application specifically states it will protect Social Security numbers.

"Your Social Security Number will remain confidential and will not be copied or released but is required for applicant tracking purposes," the application reads.

Ray Pollen, an attorney with Crivello Carlson, at first said it was no mistake that Matthews received the uncensored applications.
[Evan] So Mr. Pollen sent the information on purpose. Did he stop to think that there might be a problem here? Did it occur to anyone that they should redact the most sensitive information such as Social Security numbers, or names?

He said it was required under federal law that all parties in an EEOC discrimination complaint receive copies of information requested by the agency investigating. He couldn't point to the specific provision.
[Evan] Does a specific provision exist? I cannot think of a single purpose that a Social Security number would serve in this case.

Several days later, Pollen said the EEOC had no such requirement.

"The EEOC is silent on the issue," he said.

Instead it's the state's Equal Rights Division that requires all parties be copied on information requested by the division but even that provision doesn't mandate that attachments - such as the applications - be included. And, Matthew's case was not filed with the state.

"We followed the state's protocol," Pollen said.

P.I. asked: So anyone who applies for a job with Waukesha County could have their private information disclosed to a non-governmental third-party?

Pollen answered: "We responded to a federal agency's request for information. . . . In my opinion there was no violation of any law or procedure."
[Evan] Let's give Mr. Pollen the benefit of the doubt. Let's say that there was no violation of any law or procedure here. There certainly seems to be a violation of trust, a violation of good judgment, and a violation of privacy. The "if the law don't state it, then I must be able to do it" mentality is one of the reasons we have so many laws. Maybe if we used a little more common sense.

Taunya Thomas called the release of her information to a stranger shocking. She said at a minimum the county should have notified her that her information had been compromised.

"I'm devastated that it's that easy for my information to be disclosed," she said. "For someone to call me and tell me where I worked, where I went to school, recite my Social Security number verbatim to me, that's scary."

Commentary:
This is a very frustrating breach to read about. It is frustrating when someone knowingly discloses confidential information and then tries to justify it. Equally frustrating is when a person that has no right to the information refuses to part with it. In the middle of all of this are 130 innocent people.

I do not claim to know half as much about the law as Mr. Pollen does. His actions may be well within his legal rights for all I know.

Past Breaches:
Unknown

Florida's Agency for Health Care Administration reports a breach

Wed, 09 Jul 2008 07:15:38 +0000

Technorati Tag: Security Breach

Date Reported:
7/7/08

Organization:
State of Florida

Contractor/Consultant/Branch:
Agency for Health Care Administration

Victims:
registered organ donors

Number Affected:
"about 55,000"

Types of Data:
"names, addresses, birth dates, driver license numbers and Social Security numbers"

Breach Description:
"TALLAHASSEE, Fla. - State health officials say a security breach in the Organ and Tissue Donor Registry may have exposed thousands of donors' personal information, including their social security numbers."

Reference URL:
AHCA FAQs
Sarasota Herald-Tribune
WCTV CBS News
Orlando Sentinel

Report Credit:
Sarasota Herald-Tribune

Response:
From the online sources cited above:

TALLAHASSEE, Fla. - State health officials say a security breach in the Organ and Tissue Donor Registry may have exposed thousands of donors' personal information, including their social security numbers.

The Agency for Health Care Administrations said Monday it has corrected the flaw, which may have allowed unauthorized users to view the personal information of roughly 55,000 donors.

"We stopped all access to the database, identified the flaws and corrected them."
[Evan] This breach makes me wonder a couple of things. Is information security testing part of the development lifecycle and change control? I also wonder if AHCA uses a formal change control process with segregated development, test, and production environments.

The database includes donors' names, addresses, birth dates and driver license numbers.

The agency is sending letters to inform individuals of the flaw.
[Evan] What kind of flaw, do you suppose? A Code flaw, an administrative/process flaw, a configuration flaw?

AHCA Secretary Holly Benson said they have not received any indication that the information was accessed inappropriately.
[Evan] No logging? Logging of the systems, processes, and people accessing confidential information is a must. Extensive logging would be able to determine if the information "was accessed inappropriately" (assuming the logs weren't subject to unauthorized modification).

The breach happened on June 20 and was fixed a day later, but officials say they thought it best to make the public aware.
[Evan] What does the "breach happened on June 20" mean? It could mean that a flaw was detected on June 20, but could have been in existence for longer. It could mean that a vulnerability was actually exploited on June 20. I guess it really depends on your definition. I assume that the author means that something changed (code push, updated information, configuration, etc.) on June 20.

"If you have not received a letter our logs note that your information was not affected by this security flaw."

A couple of FAQs:
Q: If I have additional questions regarding this issue, what should I do?
A: You can call 866 757 0677. This number is open Monday through Friday from 8AM to 7PM Eastern.

Q: If I am a registered donor and I receive a letter, does this mean that I am a victim of identity theft?
A: No. It is unlikely that someone has accessed your information or used it inappropriately. It does not mean that you are a victim of identity theft or that the information may be used to commit fraud. The Agency for Health Care Administration wanted to let you know about the incident so you are aware and may take steps as you see fit.
[Evan] Again, poor logging and other detective controls lead to statements such as "It is unlikely that someone accessed...".

Commentary:
Ugh! I am left with too many questions about this breach. On the surface, this breach doesn't look all that significant unless of course, you are a victim. When I read into it more, I realize that I have some serious concerns surrounding process, control, and detection mechanisms used at AHCA. With less detail, it is easier to imagine.

Past Breaches:
State of Florida:
January, 2008 - Five stolen Florida Department of Children and Families laptops

6,200 people notified of ETSU stolen computer

Mon, 09 Jun 2008 10:45:27 +0000

Technorati Tag: Security Breach

Date Reported:
6/7/08

Organization:
East Tennessee State University

Contractor/Consultant/Branch:
None

Victims:
"students, alumni and staff"

Number Affected:
6,200

Types of Data:
"personal information"

Breach Description:
"JOHNSON CITY, Tenn. - East Tennessee State University has sent a letter to 6,200 people whose identities could be compromised by the theft of a desktop computer."

Reference URL:
Knoxville News Sentinel
News Channel 11

Report Credit:
Knoxville News Sentinel

Response:
From the online sources cited above:

JOHNSON CITY, Tenn. - East Tennessee State University has sent a letter to 6,200 people whose identities could be compromised by the theft of a desktop computer.
[Evan] If an organization is going to allow confidential information to be stored on client computers, then the organization must properly control physical security or provide mitigating controls. Servers are typically stored in climate controlled and physically secured rooms employing enhanced controls such as security cards, biometrics, locked racks, CCTV, etc. If these controls are not present at the client computer, then mitigating controls need to be designed and implemented to counter physical theft. One of the best controls to counter physical theft is encryption. Of course it could be decided that allowing confidential information storage on a client computer poses an unacceptable risk, but this would require some risk management.

someone broke into a locked office and locked suite last month and stole a computer containing private information like social security numbers

there was no sign of forced entry, though the room was locked and a big screen tv was also stolen
[Evan] No forced entry causes me to think that someone did not "break into" the locked office.

the computer is password protected and files cannot be easily accessed
[Evan] Oops, this is not true. In most cases, these files ARE easily accessed.

there is a small possibility that the information could be compromised
[Evan] Based on my last comment, this one should be corrected.

Those who received the letter are asked to notify one of the three major credit bureaus and place a fraud alert on their files.

University Provost and Vice President for Academic Affairs Bert C. Bach said ETSU has set up a Web site with procedures for preventing or dealing with identity theft.
[Evan] I scoured the ETSU web site and couldn't find any information relating to this breach. I wonder if the Web site that Mr. Bach refers to is a secure site and not accessible from the public internet.

Bach said the missing computer was stolen from a secured area on May 17.

ETSU officials are investigating.

Commentary:
I couldn't find much information about this breach other than that which was provided in the two short news reports. When there is little detail, Evan speculates.

Past Breaches:
Unknown

The best way to get customer service? Blog or Twit them

Sat, 24 May 2008 03:44:15 +0000

I was reading an article in the Orlando Sentinel newspaper this morning (I know who reads newspapers anymore), about how so many companies are tracking unhappy customers by monitoring blogs and even twitter messages. It reminded me of a story that Chris Hoff had a while back about Southwest Airlines monitoring his Twitter message

The story in the Sentinel had two opposite corporate views on this. One was Comcast who quickly turned a negative blog post and experience into a positive one by reaching out to the customer and fixing their problem. The customer than ran an updated blog post to commend Comcast. Much the same way Hoff did in his post on Southwest. The polar opposite of this was Spirit Airlines, whose spokesperson according to the article said, "she wasn't concerned and that Spirit doesn't let blog posts affect its policies and procedures." Well a year later that article is still the number 3 search result on Google if you pull up Spirit Airlines. It has over a 1000 comments with many people saying they didn't fly Spirit as a result. I wonder if Spirit Airlines still feels the same way about not listening to blogs?

The article mentions a few other companies that monitor blogs and twitter and message boards. It also mentions a web site called getsatisfaction.com where over 3000 companies monitor to help consumers iron out customer service issues.

They always said the pen was mightier than the sword. In todays world maybe the keyboard is too.

Student hacks Broward Schools and accesses personal information

Mon, 24 Mar 2008 10:22:48 +0000

Technorati Tag: Security Breach

Date Reported:
3/23/08

Organization:
Broward County Public Schools

Contractor/Consultant/Branch:
None

Victims:
District employees and students

Number Affected:
38,000

Types of Data:
"Social Security numbers, addresses, birth dates, names and other personal information"

Breach Description:
"A high school senior accused of hacking into a Broward School District database may have downloaded more than just the private information of 38,000 district employees as originally suspected, according to court records."

Reference URL:
South Florida Sun-Sentinel

Report Credit:
Joel Marino, South Florida Sun-Sentinel

Response:
From the online source cited above:

A high school senior accused of hacking into a Broward School District database may have downloaded more than just the private information of 38,000 district employees as originally suspected, according to court records.

Investigators also found information about students at the high school he attended, a host of password hacker programs and credit card generators — or software that can falsify credit card information — in a school computer used in February by Michael Wasa, 18, of Tamarac, a search warrant said.
[Evan] Why aren't these computers locked-down? High school students (for the most part) are very "high risk" users. The computers should be well hardened and internet access should be restricted to acceptable site visits.

He was suspended March 6 pending expulsion, but no charges or arrests have been made, said district spokesman Keith Bromery. Investigators also are trying to determine if Wasa worked alone.

A student at J.P. Taravella High in Coral Springs, Wasa was taking several computer classes at the Atlantic Technical Center in Coconut Creek when police say he first accessed the district's database a month ago.

A teacher at the technical school became suspicious of illegal activity after she was unable to access a classroom computer Wasa used on Feb. 26.

The school's information technology team found decrypting software had been downloaded, allowing the user to break into a database and collect teacher and student information from the entire Broward County school system.

School administrators asked Wasa about the hacking on March 4. The records say Wasa "readily admitted he hacked into the school board servers without authorization."
[Evan] Naïve.

He was asked to turn in a thumb drive, which he said contained emergency contact information for Taravella's 3,000 students.

Wasa also is suspected of collecting the Social Security numbers, addresses, birth dates, names and other personal information of district employees ranging from teachers to bus drivers. "There's still no reason to believe that there was criminal intent or that he did anything with the information he was able to retrieve," Bromery said.
[Evan] Breaking into the school's computer systems is against the law. Michael Wasa also had "credit card generators" in his possession. Yet, "There's still no reason to believe that there was criminal intent"?!

Melissa Grimm, a district project manager, told the district's audit committee that the student hacked Pinnacle, an electronic grade book. Both Grimm and Bromery said the payroll has not been affected.
[Evan] Pinnacle Gradebook is made by Excelsior Software. I don't know of any known vulnerabilities and/or exploits for Pinnacle so I wonder if it was just poorly secured in the first place, much like the desktop computer was.

Coconut Creek police, the Broward Sheriff's Office and a district investigations unit are reviewing the case; even the U.S. Secret Service has volunteered to help, said Joe Melita, head of the district's special investigative unit.
[Evan] Sheesh, this has to be intimidating to a high schooler.

"It's a serious matter any time the protection of employee records comes into question," Melita said. "This affects a lot of employees, so we want them to feel comfortable that their information is secure.
[Evan] But their information is NOT secure.

Commentary:
Michael Wasa may have hacked into the school's systems because he was curious, maybe he thought it would be challenge that he could brag about, or maybe he actually had more sinister plans to use the personal information for criminal gain. The fact that he had "credit card generators" in his possession lends some credence to the latter.

Schools that provide computers for their students need to make sure that adequate information security are not forgotten on those computers. For instance, there is no need for a student to have unrestricted internet access, local administrative rights, the ability to install software, etc.

Pinnacle Gradebook is a widely used tool by many schools throughout the county, along with Infinite Campus. I applaud these schools for their intent to provide better school/teacher/parent communication by capitalizing on technology, but equally important are potential security implications.

Past Breaches:
Unknown

The Big Announcement

Wed, 12 Mar 2008 21:03:25 +0000

I’ve not been this pumped about something in a long time. Jeremiah actually has been pulling me into liking this idea for a very long time. I hated it at first. I mean WAFs, bleh. Plus I mean didn’t we already try scanners + WAFs before? Oh yeah the total trainwreck that was AVDL. So one thing I failed to realize was that Jeremiah’s approach is a bit different and when combined with WhiteHat Sentinel (aka NOT a scanner) it is a no brainer.

WAFs generally struggle in a few different areas, the people running them are not web app. security experts and trying to apply a default deny policy, while a great idea in theory, is pretty hard in the real world . There is just way to much movement in most applications to pin it down. Even if the app does not change frequently, WAF admins are very hesitant to even come close to blocking legitimate traffic. What really sold me though is when I saw it in action for the first time. From the Sentinel UI we clicked a button that updated the F5 with a rule to block a vulnerability. The rule is automatically generated based on the vulnerability. We then clicked the retest button and the vulnerability was no longer exploitable . Note my careful choice of words, exploitable VS. “not there anymore”. The vulnerability certainly still exist in the code but now that the attack is blocked the business can decide if this is a good enough solution or they need to go fix the actual flaw.

The geek in me is screaming that it still needs to be fixed, the business side is saying that the rule is good enough and I am not going to commit resources to fixing it until that code is worked on again. From the PCI Section 6.6 perspective this gives the business some great options. As our customers are becoming aware of the PCI requirements and the PCI auditors are becoming tougher on web application vulnerabilities we run into a difficult situation. PCI audit is coming up and the app. is riddled with vulnerabilities. I now have to dedicate precious development resources to fix these vulnerabilities ASAP. With this solution I can apply this rules and effectively mitigate the issue.

I am pretty excited to be part of this. I think we have moved the industry forward today, even if it was just a small step. People now have some more options to mitigate risk besides running to the development team with yet another fire.

No related posts

Post from: Grumpy Security Guy

The Big Announcement

Employee fraud at Tenet Healthcare affects 37,000

Mon, 18 Feb 2008 07:26:45 +0000

Technorati Tag: Security Breach

Date Reported:
2/13/08

Organization:
Tenet Healthcare Corporation

Contractor/Consultant/Branch:
None

Victims:
Patients*

*Tenet Healthcare Corp. owns 54 hospitals in a dozen states, including Hilton Head Regional Medical Center and Coastal Carolina Medical Center.

Number Affected:
37,000

Types of Data:
Social Security numbers and other personal information.

Breach Description:
A former employee working in the Tenet Healthcare Corporation billing center in Frisco, Texas has been convicted of identity theft. Terrence Brooks worked for the company for less than two years and stole names, Social Security numbers and other personal information belonging to at least 90 patients, but also had access to 37,000.

Reference URL:
The Beaufort Gazette online story
The Sun-Sentinel online story

Report Credit:
Daniel Brownstein, The Beaufort Gazette

Response:
From the online sources cited above:

A former employee of a locally connected national hospital chain who was convicted of identity theft had access to the personal information of about 37,000 patients, according to a company spokesman.

Terrance Brooks, 30, of Fort Worth, was arrested Nov. 25 when he tried to open a Costco credit card using a state ID with fraudulent information, police said.

The company mailed letters last week announcing the security breach to anyone who could have been affected, said spokesman Steven Campanini.

Tenet also informed victims how to set up free fraud alerts at the nation's three major credit bureaus.

"There's an annoyance factor and we apologize for that," Campanini said. "We recognize consumer privacy is very important and take it very seriously."
[Evan] I am not personally a victim, but I am pretty sure that this surpasses "an annoyance factor" for some people.

The ex-employee worked at a Frisco, Texas, billing center for less than two years, and is confirmed to have stolen the names, Social Security numbers and other personal information of about 90 patients, Campanini said. The company has paid to monitor the credit reports of those victims.

Terrence Brooks, 30, had access to 37,000 other accounts

He pleaded guilty last month to five counts of fraudulent use and possession of identification information and was sentenced to nine months in prison.
[Evan] Only nine months in prison. In 2006, the average time it took victims to recover from identity theft was 607 hours.

He had passed a background check to get the Tenet job. Brooks was immediately fired when the company learned of his arrest.

"What's challenging in this situation is there was an employee intent on committing fraud," Campanini said. "No company can prevent that, but we can have practices in place to immediately address it when it does occur, and that's what we did."
[Evan] I agree that preventing employee fraud is challenging, but reducing risk is very impossible. There are several things that companies can do to reduce the risk significantly (segregation of duties, job rotation, cross-training, etc.). Access to Social Security numbers should require an additional level of clearance and this clearance should be closely scrutinized. The normal "run of the mill" billing work does not require Social Security number access.

"I'm more concerned with what could happen than what has happened," Ashley Latzer a person that received one of the Tenet notification letters.
[Evan] More than an "annoyance"?

Tenet patients concerned about the security of their personal information may call a company hotline at 1-800-553-6101 between 8 a.m. and 6 p.m. weekdays.

Commentary:
I am concerned with how many people in companies have unnecessary access to confidential information. One of the first steps in reduding risk of employee fraud is to limit access to confidential information to only when it is absolutely required. The resolution of most customer service, help desk, and billing calls don't require Social Security numbers, credit card numbers (including CVV2), and other sensitive information.

I don't know enough about how Tenet manages its data and billing center, but I am sure that creative information security solutions could reduce the risk of this happening again.

Past Breaches:
Unknown