Anthem CEO Joseph R.
Swedish apologized to Anthem members immediately after the December 2014 data
breach was made public, saying "Anthem was the
target of a very sophisticated external cyber attack." Swedish continued,
in what may become a model for such apologies:
Anthem’s own
associates’ personal information – including my own – was accessed during this
security breach. We join you in your concern and frustration, and I assure you
that we are working around the clock to do everything we can to further secure
your data.
It's a nice trick to have the CEO of a major healthcare payer -- a man whose total compensation package for fiscal 2013 was $16,979,927 -- come across as one of us, just another victim of cybercrime.
But was the Anthem hack really a sophisticated attack?
Because it was clearly pre-meditated and because the attackers spent time identifying the vulnerabilities, it definitely qualifies as well executed, but once the initial intrusion was successful, they didn’t have too far to look. By gaining admin credentials to the database there was nothing ‒ including encryption ‒ to stop the attack. The only thing that did stop it was a lucky administrator who happened to be paying attention at the right time.
There is some speculation that the initial breach at Anthem occurred much earlier than the December 2014 public announcement, perhaps as early as April 2014, and that it was a result of the Heartbleed Bug.
Munro also discusses the earlier CHS and Sony hacks, noting that they too were described as sophisticated or "unprecedented" attacks, and that numerous security analysts had thrown cold water on those descriptions. Let's face it: no board of directors is going to say that they were victims of an attack that a five-year-old could have perpetrated. The PR front likely bears little resemblance to what is going on behind closed doors, where damage is being assessed, and governance, risk management and compliance are being reassessed.
There are always the nagging questions: What should you have known? When should you have known it? Did you exercise due diligence?
I once heard an auditor defined as the person who walks onto a battlefield after the battle is over and bayonets the wounded. I'm not sure that's an apt description of an auditor, but it's a pretty good description of the audited.
