 security by design part 11 security by design part 11 hemraj mon 10202025 637 security by design part 11 joseph f norton sort by latest trending joseph fnorton latest trending image the us cybersecurity and infrastructure security agency defines secure by design to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices data and connected infrastructure this is a very concise statement with a focus on the design of technologybased systems in the real and practical world we live in focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure  security focusing only on design aspects of complex systems will ensure cyber insecurity my personal views about security by design are well known by those who have worked with me or have been my clients throughout my career our digital systems do not stand alone as technology systems only as soon as we deploy technology the technology enters the realm of becoming a system interconnecting and interacting with other systems with which our business operates these business systems are comprised of benevolent technology people and processes interconnecting our business with our customers and suppliers as well as the shared open systems we use such as the world wide web and the internet unfortunately bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations so focusing only on the secure design of technology products is not enough to secure our businesses by design focusing only on the secure design of technology products is not enough to secure our businesses by design  securing our business by design requires hyperattentiveness to the security of the complex digital systems environment of technology data processes and people by the very nature of how complex digital systems work security by design requires that all aspects of security design and operations work in concert continually any gaps mistakes or lack of attentiveness by those who use support or operate our systems including those responsible for oversight and assurance will guarantee a cybersecurity compromise security by design technology data technology process technology people people process people data data process the february 2024 cyberattack triggered a shutdown of change health care s electronic medical claims processing systems leaving doctors and other providers of medical care pharmacies rehabilitation facilities etc without the ability to obtain insurance approval for patient services and thus not receive payment for medical services was a failure of the people process technology aspects of security by design it has been reported that an absence of multifactor authentication reportedly left a remote access application exposed the actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application but i ask is this the true or root failure in this incident  is the lack of twofactor authentication the root cause of the change in health care cyber attack  from my perspective the root cause of this cybersecurity failure is found in the process people domain of security by design this is a classic failure of people not utilizing audit controls processes and or using the appropriate process but not paying attention to the audit controls information the process identified indeed change health care is a relatively recent acquisition of optum which is a subsidiary of united health care prior audits have reportedly highlighted the lack of twofactor authentication at change health care but this information it seems was not acted upon this was highlighted by andrew witty ceo of united health group who testified at a us senate finance committee hearing examining cyberattacks on health care and the change healthcare attack on may 1 2024 the cyberattack has become the costliest in us history healthcare financial management association the auditor for financial analysis of the losses so far is reporting an expected 687 billion in total losses from this breach including equity loss legal fees regulatory fines class action claims pr expenses notification costs and other expenses   687 billion in losses nearly 13 of all americans impacted    joseph f norton is a risk security and crisis management professional he is a founding member and qualified technology executive of the digital directors network chair of the advisory board with next era transformation group and chief security officer with apf technologies he has served as chief security officer svp at atos chief technology officer and head of operations svp at philips chief technology officer svp at novartis executiveinresidence with mckinsey company and chief technology officer at mcdonald s he has also held professional roles during his career with jpmorgan bank oracle sybase and grumman aerospace corporation and the united states navy latest webinars our proven track of record view all image webinar clone of the ciso exchange for a safer digital world image webinar the ciso exchange for a safer digital world image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government popular articles unleashing business potential the power of adaptive enterprise architecture in the digital age businesses must adopt an adaptive enterprise architecture to succeed doug picirillo 15 best practices in salesforce development many businesses have decided to use salesforce s customer relationship management solution kannan venkataraman 