Tricare Medical Targeted
UMUC
Brandon Murchison

Table of Content
Abstract ……………………………………………….3
Tricare/Data Breach……………………………..4
Stolen medical price/Chart…….……………..5
Hackers Motivation………..……………………..6
Conclusion…………………………………………….7
Reference……………………………………………..8

Abstract
Hackers, while this term originally referred to a clever or expert programmer, it is now associated commonly in reference to someone who can gain unlawful access to other computers. A hacker can "hack" his or her way through the security levels of a computer system or network. This can be as simple as figuring out somebody else's password or as complex as writing a custom program to break another computer's security software. Hackers are the reason software manufacturers release periodic "security updates" to their programs. While it is unlikely that the average person will get "hacked," some large businesses and organizations receive multiple hacking attempts a day. In this instance the organization falls under health care, with digital medical records becoming more and more common this allow massive amounts of personal data to become vulnerable to hackers. This paper will cover not only hackers but the motivations of the hackers and ways to help defend and prevent.

Medical records have become similar to finding gold during the California gold rush for identity thieves. This is exactly why healthcare provider’s cyber-attacks have become more and more frequent. These data breaches exposes millions of records that are used by cyber criminals for illegal activities. But why is the data in health care so important? A data Breach in the healthcare industry causes major threat of financial issues for the organization attacked but also an instant inconvenience for those who choose to entrust the organization with personal information that was breached. A particular health care which will be discussed Is Tricare medical, which deals with health insurance for the military, motivation for the hackers and defenders of attacks. Lastly, policy or technology controls to protect the organization against similar attacks.
In 2011, TRICARE medical which is a health insurance that covers military personnel found themselves victim of their own data breach, when they had back up computer tapes that were being transported to another location stolen from one of its contractors in Virginia. The tapes contained names, Social Security numbers, home addresses and, in some cases, clinical notes and lab test results for nearly 5 million patients, making it the largest medical data breach since the Department of Health and Human Services began tracking incidents (UNGERLEIDER, 2012). Although the tapes that was stolen did not contain personal banking or financial information, the data on the backup tapes were however unencrypted and possessed all the key elements, which was previously stated, to steal a person identity. This information wasn’t taking through some form of cyber-attack like through brute force or some so, it was indeed a theft. According to Vacca. J (2013) this theft would fall under the descriptive label of Crackers (criminal hackers): Crackers are hackers with a criminal intent to harm information systems. Crackers are generally working for financial gain and are sometimes called black hat hackers
Regarding to the threat actors the type of people that would go after this information would be black hat criminals because the motive for this crime is financial gain. They would want information that health care providers have because it has all the ingredients that can lead to multiple types of fraud or identity theft and with such a large amount of identities available, like with TRICARE medical (4.9 million) the risk is completely worth the reward in the eye of the criminal. According to a group called cyber squared (2012) there was a forum entitled “The World AND LIVES AT RISK Privacy Forum”. This released information that shows the value of stolen medical information. It stated that stolen medical information had fifty times the original dollar amount of just a stolen social security number. The RSA (2010) also stated the medical identity theft has a ten times average payout compared to a typical identity theft. If someone was receiving $5,000 for a regular identity theft, an medical theft would receive up to $50,000. Why is this? Medical information fraud takes more than twice as long to identify as compared to regular identity theft (RSA, 2010).
Below is a chart retained from Navigant (2011) of breaches from 2011 and 2012 it shows how healthcare providers have increasingly become the number 1 target.

In order to understand the reason for the data breach the motive most must be made clear. Different hackers have different motives, we have the black hat hackers who motives usually start with greed, these are the hackers who are to be responsible for the Tricare medical attacks and other medical organizations data breaches. Then there is the white hat hacker or ethical hacker who motive is to assist others either for recognition or pay, an ethical hacker specializes in penetration testing and in other testing procedures to ensure the security of an organization's information systems. In terms of Tricare medical and other health organizations they used these white hat hackers to find weaknesses and develop ways to lessen the likely hood of a data breach. The first step of course to encrypt all data so in case an incident like Tricare medical happen at least the data is encrypted so the likely hood of it being discovered is improbable. Secondly, TRICARE medical should have a type of detection and prevention software which would be able to recognize and eliminate possible threats. In an article titled A CYBER VICTIM: BILLIONS STOLEN AND LIVES AT RISK (Cyber square, 2011) the mention of a Threat Intelligence seemed as if it would good for prevention, a direct quote from the article states “Threat Intelligence (TI) which is an information security discipline that seeks to recognize and understand sophisticated cyber adversaries, specifically why and how they threaten data, networks, and business processes; while also developing better protective measures against them.” (Cyber square, 2011). However, Tricare medical lacked not only encryption, policy, and a program like the TI program to prevent a theft or hacking. This eventually lead to a lawsuit against the Department of Defense (DOD) for almost 5 billion dollars, the amount requested one thousand dollars per person who information was stolen. The lawsuit was for inadequately protecting sensitive data and “intentional, willful and reckless disregard” for patients’ privacy rights. Unfortunately, the majority of these files were dismissed. The courts saw it as ideal of suing because of the possibility of becoming victim of a data breach is not basis for a claim. Nevertheless this massive lawsuit did bring attention to the importance of protecting data with medical organizations and set up a new beginning of policy change and prevention techniques

Conclusion

TRICARE medical unveiled that a data breech had occurred including Social Security Numbers, names, addresses, phone numbers and personal health data belonging to almost 5 million active and retired U.S. military personnel after unencrypted backup tapes containing the data went missing. The tapes information was from an electronic healthcare application used to capture patient data. The backup tapes were stolen from the car of an employee at Science Applications International Corp. (SAIC), a TRICARE contractor. The breach affects all those who received care at the military’s San Antonio area military treatment facilities between 1992 and Sept. 7. 2011. This theft seemed to be motivated by potential financial gain. Because of the payout of medical records the medical industry will continue to be a risk to non-ethical or Black hat hackers. It’s up to Business leader to use white hat hackers to help strengthen their cyber-attack defense to reassure an incident like Tricare medical will not happen again otherwise risk loss of revenue, embarrassment, operational interruptions, legal issues, and other unforeseen consequences for themselves and the people whose identity was inappropriately handled.

References

RSA. (2010). Cyber Crime and the Healthcare Industry. Retrieved 2012 17-March from RSA: http://www.rsa.com/products/consumer/whitepapers/11030_CYBHC_WP_0710.pdf
Blasco, J. (2012 2-July). Sykipot is back. Retrieved 2012 15-July from Alien Vault: http://labs.alienvault.com/labs/index.php/2012/sykipot-is-back/
Goodrich, M., & Tamassia, R. (2011). Malware. In Introduction to computer security. Boston.
Vacca, J. (2013). Computer and information security handbook (pp. 242-260). Waltham, MA.
Valacich, J. & Schneider, C. (2014). Information Systems Today (Ch. 5). University of Arizona.
Cost of Data Breach Study: Global. (2012, March 1). Ponemon Institute. Retrieved from http://www.symantec.com/
Cyber Squared. (2012, January 1). A CYBER VICTIM: BILLIONS STOLEN AND LIVES AT RISK. Retrieved from http://www.cybersquared.com/wp-content/uploads/downloads/2013/03/Medical-Industry-A-Cyber-Victim-Billions-Stolen-and-Lives-At-Risk.pdf