BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Why To Consider Partners As Potential Insider Threats Too

Posted November 1, 2011    Peter McCalister

In early September BeyondTrust CMO Brian Anderson covered the news around Stanford Hospital & Clinics medical privacy breach that resulted in 20,000 patients’ personal data being publicly available on a website for nearly a year. At the time the breach was first reported by The New York Times, it was unclear how the data made it onto the website.

guy laptop

Recently, after a $20 million lawsuit related to the breach hit Stanford Hospital & Clinics, the hospital released a statement holding a third party billing contractor responsible for the data breach. According to an October 5th New York Times article, the data breach happened “because a billing contractor’s marketing agent sent the electronic spreadsheet to a job prospect as part of a skills test, the hospital and contractors confirmed this week. The applicant then sought help by unwittingly posting the confidential data on a tutoring Web site.”

Thirty-nine percent of all data breaches involve third-party outsourcers – this according to data pulled from a recent Ponemon Institute study. The lesson we can all learn from the Stanford incident is that organizations, be it a healthcare provider or a national retailer, not only have to monitor their own security, but also that of their associates and vendors. While it is important to provide the information and access necessary for third-party resources to do their jobs, at the same time it’s irresponsible to allow vendors free reign over sensitive data or network assets. An all or nothing approach to granting users access doesn’t work here. Effective privilege identity management coupled with comprehensive knowledge of your partners’ and vendors’ security policies and practices is the best way to safeguard your company’s most valued assets.

Leave a Reply

Additional articles

randy franklin smith

At the End of Day You Can’t Control What Privileged Users Do: It’s about Detective/Deterrent Controls and Accountability

Posted March 31, 2015    Randy Franklin Smith

Live Webinar: Thursday, April 2, 2015 | 10am PT/1pm ET | REGISTER NOW! In this webinar, Security Expert Randy Franklin Smith will look at how to audit what admins do inside Linux and UNIX with sudo’s logging capabilities.

Tags:
, ,
BA_Hacked

British Airways Executive Club Member Accounts Hacked

Posted March 30, 2015    Brian Chappell

British Airways has released information regarding the hacking of a number of their Executive Club (BA’s frequent flyer programme) member’s accounts.

Tags:
, , ,
webinar_ondemand

On Demand Webinar – Why You Still Suck at Patching

Posted March 27, 2015    Lindsay Marsh

On Demand Webinar: Dave Shackleford recounts some of his personal experiences in patch management failure, and breaks down the most critical issues holding many teams back from patching more effectively.

Tags:
,