Rendered at 22:19:52 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
btown 7 hours ago [-]
It's worth noting that cybersecurity requirements can be a mechanism of control.
As a government regime, do you want to build an effective surveillance system where health data on large numbers of suspects can be pulled into a data fusion system at the push of a button, once a judicial framework for rubber-stamping is in place? And do you want to be able to pressure vendors into not supporting certain types of research/analysis and even direct patient care that could be construed/presented as counter to the regime's goals?
Both of these are easier when smaller vendors are forced out and larger vendors are the only ones left standing. As such, regulatory capture becomes a mutually beneficial tool to dominant vendors and regulators alike.
There are few coincidences when lobbying is involved. Which is not to say that cybersecurity improvements aren't a good thing! But speed and mechanisms of required rollout need to be balanced. And with the numerous signatories of [0] opposing the rule and describing "unreasonable implementation timelines," it's hard to say that this is entirely done in the interest of patients.
As is the case with SOC2, the "vulnerability scan" requirement here is likely to be meaningless; any automated process that can plausibly be described as instrumental in finding some kind of vulnerability is a "vulnerability scan", so all you have to do is run nmap.
john_strinlai 8 hours ago [-]
they have comment/request for information sessions for HIPAA rule proposals, which your input would be valued.
tptacek 5 hours ago [-]
I don't think the rule would be better with more detailed vulnerability scanning requirements! All these things inexorably become races to the bottom.
sonofhans 4 hours ago [-]
Yes, exactly, the rules are intentionally broad and vague. You can wave paper at most of them and technically succeed. And then when you release accidentally PHI for the first time and your bullshit comes to light, your chickens will come home to roost. Doing a good job on compliance is less about security and more about staying out of jail.
akerl_ 3 hours ago [-]
The ideal flow here is:
1. Do good security and operations.
2. Overlap the minimum subset of your existing good security and operations as evidence for whatever compliance regimes help you get paid.
3. Get paid.
Nobody is suggesting that you bullshit the auditors. They’re suggesting not letting the auditors accidentally trick you into letting step 2 get in front of step 1.
dgellow 8 hours ago [-]
If it is like SOC2 I would expect respected auditors to reject that
morpheuskafka 8 hours ago [-]
But there are no auditors required for HIPAA. Only the government (HHS OCR) itself can enforce the standards.
dgellow 7 hours ago [-]
Thanks for the clarification, in that case the text is indeed really weak. Does that system work in practice, or are companies just claiming they are HIPAA compliant with close to no actual auditing mechanism?
giaour 3 hours ago [-]
It's been a few years since I worked in this space, but HIPAA doesn't really work under the same kind of legal framework. Oversimplifying here, but basically HIPAA defines what constitutes personal health information, how such information may be used, and establishes monetary penalties for improper use and unauthorized disclosure. The law doesn't have any certification standard, no more than the prohibition on stealing cars does.
Maybe there's some kind of third party certification system to support signing information sharing agreements ("BAAs") with other health information systems. I worked at CMS on first-party stuff so I'm not really familiar with how it works in the private sector.
tptacek 7 hours ago [-]
You get that the technical controls in SOC2 are also extremely weak, right?
dgellow 7 hours ago [-]
Sure, yes. The way I understand SOC2 relies on the auditors to set the effective standard. So it really depends who audited you
tptacek 7 hours ago [-]
SOC2 auditors are accountants. A SOC2 auditor verifies only that you're doing what you say what you're doing.
kevin_nisbet 5 hours ago [-]
And the way they verify you are doing what you say you are doing is by asking you to provide evidence, which is usually pretty easy to demonstrate that a policy was followed once or twice, a lot harder for them to pick up consistency issues or exceptions.
randerson 3 hours ago [-]
I've had SOC2 auditors choose a random commit from our GitHub history, then ask to see the associated Jira ticket, logs from the build and deployment, etc. Hard to reliably pass an audit if you don't know which changes they'll drill down into.
They also asked for proof of system-enforced processes (e.g. GitHub branch protection rules and the setting for enforcing peer review for each change) which were basically proof of consistency.
tptacek 2 hours ago [-]
They do that because in the DRL process you specified a change management process involving Github and Jira. If you specified a different process (for instance, Post-It notes applied to the bathroom wall), they would randomly ask for evidence about those Post-It notes.
That's what we're talking about when we say virtually any tool you can come up with will satisfy "vulnerability scans". For Cloudflare, it was nmap. I think they're right about this.
dgellow 7 hours ago [-]
Obviously, yes
akerl_ 7 hours ago [-]
A SOC auditor who tells you that you can’t use an nmap scan to meet SOC2 obligations is a bad SOC auditor, because they’re attempting to enforce a constraint on you that SOC2 does not.
But the far more likely thing is that a medium SOC auditor, upon being told “we do our vulnerability scanning with nmap”, would say “I haven’t heard of nmap. You should use Tenable,” and if you’re letting SOC auditor drive your engineering you’d make a mistake and accidentally think that meant you needed to change your answer for SOC2 and go buy Tenable licenses.
dgellow 6 hours ago [-]
The whole thread drifted way too far from a very mild push back I had regarding the claim « any automated process that can plausibly be described as instrumental in finding some kind of vulnerability is a "vulnerability scan" ».
My experience is that no, SOC2 auditors won’t consider literally any automated process of that sort as compliant. Which in no way implies the auditors are forcing you to use a licensed tool or driving your engineering.
I will stop that thread here, I don’t think that exchange is productive
_hyn3 2 hours ago [-]
If SOC2 relies on competent auditors (and you're right, it does), than it is an ineffective standard (and it mostly is).
tptacek 7 hours ago [-]
No? Like, wildly no? This is a big part of why you pay for the most respected auditors.
dgellow 7 hours ago [-]
I guess we had different experiences. The ones I interacted with were ok and wouldn’t have accepted a simple nmap here
tptacek 7 hours ago [-]
I'm not being snarky when I say that not getting your automated vulnerability scan, whatever it might have been, past your SOC2 auditors is a skills issue. SOC2 audits are not technical and the vulnerability scan control in SOC2 is categorically not meaningful. Cloudflare wrote a whole post about this.
dgellow 7 hours ago [-]
FWIW I agree that SOC2 for automated vulnerability scans has a really low bar and isn’t too meaningful. At no point did I defend SOC2 here. The bar I’ve seen is above “just an nmap”, which is pretty bad standard IMHO. You seem to be reading way too much in my comments
6 hours ago [-]
tptacek 7 hours ago [-]
I brought up nmap. You said you'd expect respected SOC2 auditors to reject it. I don't just think that's not true, I know it not to be true.
dgellow 7 hours ago [-]
I know, that’s already established. I already acknowledged we had different experiences. I have no idea what you’re pushing for at that point
tptacek 6 hours ago [-]
Just to clarify, this is a bugbear of mine. It's nothing personal with you, but I've spent the last 6 years or so evangelizing the idea that people should minimize their SOC2s and not get pushed around by auditors or evidence collection platforms like Vanta, because that drives a lot of terrible security engineering, and the hypercompetent best-staffed security orgs in the industry all push their SOC2 auditors around.
Compliance and security are entirely different practices in a well-run firm. Security can inform compliance. Compliance should not inform security engineering.
If you search my name and "SOC2" in the search bar below, I've expanded on this quite a bit.
rmccue 5 hours ago [-]
As just one data point here, let me say thank you for all your writing on it; it was super useful to have things to point at to say “we don’t have to just blindly do a thing the auditor suggested!” for our SOC2.
john_strinlai 6 hours ago [-]
tptacek just hates soc. its probably not personal.
tptacek 5 hours ago [-]
We got some value from it! I just think it's important to remember what it actually is, rather than axiomatically deriving what you think it should be.
jasonlotito 6 hours ago [-]
> so all you have to do is run nmap.
This is ignorance at best. No one who has ever actually had to do SOC2 compliance legitimately has just run nmap and been done with that.
>No one who has ever actually had to do SOC2 compliance
while i find tptacek's opinions very strong on the subject, you would be extremely mistaken to think those opinions were formed without experience
bob1029 7 hours ago [-]
The institutional moats grow ever wider.
PCI-DSS still takes the cake for most oppressive rules out of all the compliance frameworks. The notion that your system might become "in-scope" is one of the scariest things you have to deal with. Avoiding this designation is almost always easier than satisfying all the controls they prescribe. Stripe & friends have it really good. I don't know who their equivalents are in the health care industry but I am certain they exist.
burnte 4 hours ago [-]
> PCI-DSS still takes the cake for most oppressive rules out of all the compliance frameworks.
My personally most hated compliance ruleset. I've been in Healthcare for over a decade, I'm a HIPAA/data security expert, and PCI compliance is genuinely harder and more nonsensical than HIPAA.
And to be honest, for every ONE healthcare place I've seen that would fail a HIPAA audit, I've seen 20 companies that would fail PCI compliance and by a wider margin. The number one PCI issue I've seen *literally* everywhere is recording/writing down card numbers with CVV. It's strictly forbidden by the rules, and every snall and medium business breaks that rule constantly.
CodesInChaos 2 hours ago [-]
What kind of business writes down credit card numbers (even without CVV)?
Online payments (e.g. e-commerce) usually send such data directly to the PSP, or encrypt it with a PSP controlled key.
And in person payments (e.g. stores and restaurants) use a payment terminal/device, which is presumably PCI DSS compliant and doesn't store such information.
randerson 2 hours ago [-]
I've implemented PCI-DSS and have 12 years of level 1 audits behind me. I actually find their rules to be sane, pretty good security practice. Internally, we made many of the controls standard across the board even for out-of-scope systems because they were sensible and we'd already built the tooling for it. If you implement it well, once you're compliant it is easy to stay compliant.
And yes, there is plenty of incentive to keep things out of PCI scope. I'd say that is PCI working as intended. Why would you want a larger attack surface that touches your credit card data?
kstrauser 7 hours ago [-]
I despise PCI-DSS. A friend owns a small business and has a credit card reader. Due to that, we had to build out a separate LAN so that the reader is on its own precious network, and have to pay an external auditor for a quarterly scan of our external IP. Bullshit past findings were things like “your VPN server supports old encryption algorithms”. “But our clients don’t support them. They select the newer algorithms!” “But they could!” “What do you care? Those clients aren’t even on the same LAN as the scanner.” “PCI-DSS lol!” I have no way of knowing, but I bet the firewall might’ve accidentally blocked the scanning IP from reaching the VPN server port on the retest and called it a day, but surely not.
Basically, Visa and friends externalized their own shitty security and made every other company in the land responsible for wrapping their janky hardware in electronic bubble wrap. A real security framework would’ve said “don’t make a credit card scanner so weak that it can’t survive being on the same LAN as a printer”. Instead, the whole country has to waste billions of dollars mitigating that risk for them.
akerl_ 7 hours ago [-]
> Bullshit past findings were things like “your VPN server supports old encryption algorithms”. “But our clients don’t support them. They select the newer algorithms!”
Given that downgrade attacks are a massive category of attacks for network protocols, and in fact modern protocols go to great lengths to make them impossible, that doesn’t sound very bullshit at all.
CodesInChaos 2 hours ago [-]
The whole VPN requirement sounds like bullshit to me. The terminal should use secure TLS connections to the servers it communicates with, without relying on the security of the (local) network at all.
kstrauser 12 minutes ago [-]
It wasn’t a requirement. They have a VPN server for remote access. The network scan found it and complained even though it’s not related.
akerl_ 1 hours ago [-]
Last I checked, a VPN isn’t required by PCI (or really any other compliance regime). The parent commenter’s infrastructure had a VPN. And once you have a VPN and you’re showing it to the auditors as part of your in-scope infra for PCI, asking you to remediate findings for insecure algorithms allowed in the server config is rational.
kstrauser 6 minutes ago [-]
Eh, not really. The VPN was on the same router that gave the card scanner access to phone home to the credit card company. They weren’t related at all. You couldn’t connect to the scanner’s LAN through the VPN. But since they had the same public IP, the vuln scanner counted them as in scope.
But in reality, why’s that a problem? Is the credit card scanner so tacitly busted that it can’t coexist with other hosts? Does it not use TLS? Doesn’t it pin TLS certs so that it’s not subject to MITM? Is it listening on ports with vulnerable services? There’s no excuse for the scanner being that delicate. It should be able to service an office LAN. And yet, the PCI-DSS group managed to push the responsibility for their hardware onto the network owners rather than making their own hardware robust. That’s nuts.
kstrauser 6 hours ago [-]
If a client doesn’t support an algorithm, you can’t force a downgrade to it. A compensating control is that the clients are managed and only support the newest algorithms, and aren’t vulnerable to a downgrade attack.
Context is everything. Here, the context is that within this scan environment, it was, in fact, a bullshit finding.
unethical_ban 4 hours ago [-]
Why doesn't every bar with a POS system need a separate vlan for their register?
bob1029 3 hours ago [-]
If you process < 20k online transactions per year you can skip a lot of the requirements.
chopete3 2 hours ago [-]
We recently did PCI-DSS level2 and it was pain in the right place to complete the scans and gaps their scripts find. It took 6 months to complete the audit.
mapt 7 hours ago [-]
I don't understand why there shouldn't be a strict-liability play here on top of penalties for knowing violations.
You lose all your customer's data to a darknet leak? We should be taking a huge chunk out of your balance sheet.
My insurer has disclosed names, social security numbers, and ENTIRE MEDICAL CASEFILES for their entire client base more than once at this point in overlapping data breaches. Why exactly don't they owe me $10k for my trouble, or N% shares of the company? If that's too much, why do these penalties exist for knowing disclosure, if incompetence is so tolerated that knowing disclosure does no damage?
erikerikson 6 hours ago [-]
Penalties are $100-$50,000 per violation (i.e. per leak for each person), up to $1.5 million per year[0]. If in the US (I'm assuming given you mention your health insurance) you can report it to your state insurance commissioner which may have already occurred for your incidents.
There's also possible prison sentences. I just love it when someone wants to "get tough on X" when all the laws are already tough on X and just unenforced. That's how you end up with every American committing three felonies a day without knowing it.
erikerikson 6 hours ago [-]
I'll bite: examples?
Bender 5 hours ago [-]
It's from a topic in a book [1] that is sometimes also discussed on forums. The gist of it is something to the effect of, there are so many laws and so much wiggle room in most of the laws that each person is committing multiple felonies per day without knowing it thus empowering agencies to arrest just about anyone at any given time. The United States of America has the highest incarceration rate of the world is just one small example of that.
I was aware of the de facto state but not the book, thank you for sharing that.
Still, I was hoping for examples.
Bender 4 hours ago [-]
Oh you meant like case law examples. It's a bit of reading but search for examples of case law where a person was convicted on technicalities but not violating the spirit of the law, sometimes later being over-turned. I don't have any examples and I hate to suggest this but maybe start with whatever LLM you use.
erikerikson 2 hours ago [-]
I avoid LLMs but wasn't concerned with case law as much as a specific law on the books, whether used or not. A peer comment offered mishandling of mail not addressed to you.
panny 3 hours ago [-]
Discarding misdirected mail is a felony (18 U.S. Code § 1702). For example, you receive a flyer in the mail addressed to John Smith who previously lived at your address. If it doesn't say "John Smith OR current resident" then discarding that junk mail is a felony. You are supposed to write "Return to sender" on every piece of junk mail or correspondence not addressed to you and put it in the outgoing mail. People discard junk flyers every single day without looking at the address first. Simple things like that.
To tie back into the original discussion on HIPAA, I had a collection agency sending mail addressed to a previous resident to my address once. The return address was the clinic of the patient. I was dutifully writing RTS on every letter and putting it back in the mail, but they would not take me off their nastygram list. That was until I wrote "You know, it's a felony HIPAA violation to be leaking this patient's name and clinic to me after you've been notified of the incorrect address." The collection letters immediately stopped after I did that.
erikerikson 2 hours ago [-]
Good example. I believe the correct behavior is to write "Not at this address" rather than "Return to sender" these days
iamalizard 5 hours ago [-]
[dead]
thewebguyd 6 hours ago [-]
At some point we really should consider a similar system to points on a drivers license for repeat offenders like that. Once, maybe twice come with some serious fines and compensation to victims. 3 times or more? Why are they allowed to continue to be in that business? We can't let repeat offenders be allowed to continue to handle sensitive data.
201984 4 hours ago [-]
I'll bite. Why is it the fault of the organization that gets broken into, rather than the fault of the attackers breaking into it? Even if the defender takes every reasonable defensive measure, they could still get pwned from some zero day that they had no defense against. Should they be fined into oblivion for something like that?
It's so grating to read obviously LLM-generated text, even more so from a company that is asking us to hire them for a security audit.
AI writing makes somewhat more sense on tech blogs. Where a business' value proposition is "We are knowledgeable and reliable about computer security", it seems unwise.
usernamed7 7 hours ago [-]
I was thinking the same - makes the article feel very amateur and unprofessional. And I know for a fact that AI can do a better job at writing than this, I doubt they read it and had any sense of how poor the writing actually is.
joncp 3 hours ago [-]
I'm not sure why there's so much negativity in this thread. The listed requirements were already basic table-stakes security standards. IMO, anyone not encrypting all user data at rest, requiring MFA, etc. is bush league.
marsbars241 7 hours ago [-]
Wait a second. If encryption is required for all ephi, that means faxes will finally die, right? Right??? Please!
saltcured 5 hours ago [-]
Nah, in legal compliance minds, faxes are magical, remote, wet ink.
supermdguy 4 hours ago [-]
I think the conduit exception still applies for analog faxes. Which makes no sense, since tapping a fax line is probably way easier than compromising a data center.
theptip 6 hours ago [-]
My thought too. This would be huge if true.
dwa3592 7 hours ago [-]
It really depends on who is testing and enforcing these standards. I have worked in this area, built scalable systems for medicare. The annual pen testing used to be a joke. Any consultant who would come had no clue what was being built, how the process worked - and they wouldn't even care to understand. After a meeting, we'd get the notification that the pen testing was successful. So, on paper you can change any rule - if the consultants you are hiring don't give a shit (which they usually don't)- nothing gets enforced. We would go out of our 'job responsibilities' to do internal testing of all sorts (the external agency would not even do 2% of that).
Cider9986 5 hours ago [-]
As explained here[1], HIPPA makes our medical privacy worse, not better.
I've got this saved and I'll watch it and reply soon, but my kneejerk reaction is "this is someone who probably doesn't actually understand what they're talking about" simply because as someone who is in healthcare IT, I can assure you privacy is taken extremely seriously and I can guarantee medical privacy today is far better than it ever was before.
hoppyhoppy2 4 hours ago [-]
I rarely give credence to opinions about HIPAA from people who don't spell it correctly.
sonofhans 4 hours ago [-]
Oh, I have typed that acronym thousands of times. Thousands. And I’d be surprised if I got it right 90% of the time. I have just enough dyslexia, I think, to make it very hard to be perfect. So perhaps OP is similar.
adampunk 2 hours ago [-]
Perhaps.
MallocVoidstar 3 hours ago [-]
"As explained by" someone regurgitating the views of the "Citizens’ Council for Health Freedom", an anti-vax, right-wing organization that opposes HIPAA, Medicare, and government involvement in healthcare in general.
throw03172019 46 minutes ago [-]
I thought these haven’t been approved/finalized yet?
threecheese 2 hours ago [-]
This was a pleasant surprise; I fully expected a gutting of the rules, based on what’s been on the front page these past few months. I’m glad to see that someone in the federal govt is paying attention to the risk landscape.
saltcured 5 hours ago [-]
Of course they have to double down on yet another compliance regime. Why not converge on an existng NIST 800-53 baseline, or some HHS "tailored" variant? Or CMMC, if they want to push for more strict certification processes instead?
It's getting absurd with how many different compliance regimes a modern research university will have to follow simultaneously, if they do a broad set of defense, energy, basic sciences, and health research as well as having an attached medical school and teaching hospital.
mjevans 7 hours ago [-]
How kind of them to require 2FA without requiring the governments to issue real 2FA tokens for use in signing / interacting. No doubt this will require some rootkit 'authenticator' app on the consumer's purchased mobile device that they are then not allowed to truly own.
pphysch 7 hours ago [-]
TOTP should be totally fine and can be used with very dumb hardware/software.
time0ut 8 hours ago [-]
Interesting. I haven’t fully read through the rule change, but seems like HHS is directly adopting the controls required by HITRUST? I have been out of the industry for a while. Always interesting how the industry shapes regulation and vice versa.
jpitz 6 hours ago [-]
I'm not sure how meaningful it is to adopt some of the controls from HITRUST without any of the consequences.
Jeremy1026 5 hours ago [-]
Mandatory annual security assessments are going to be brutal for small businesses.
mchusma 3 hours ago [-]
highly irritating. HIPAA was originally designed to be a "portability" standard (meaning easier to share). It has done the opposite. Health data is important to developing a cure, and privacy is unimportant to many people. The world would be better if there we were zero regulation here at all.
ck2 6 hours ago [-]
you can be certain the DOGE kids downloaded as much as they could grab from federal systems about everyone's medical history including the federal e-prescription system
rules for thee but not for me
caycep 6 hours ago [-]
eh how are they going to make the usual small practice do "penetration testing"?
201984 7 hours ago [-]
Is this why every healthcare website has 2FA now? It's so annoying.
burnte 4 hours ago [-]
Medical records are the most valuable records to steal. They contain financial info like SSN for card fraud, but also demographic info that makes it crazy valuable.
iloveoof 3 hours ago [-]
Also, credit can be frozen and credit cards can be canceled. But the medical record, once stolen, can’t be frozen or canceled, so it’s always valuable
iloveoof 4 hours ago [-]
Universal encryption of PHI at rest is going to be INCREDIBLY painful. Hospitals mostly have onprem, locked down mainframe IRIS systems that host data. If the IRIS data is encrypted at rest then it can’t be compressed which means hospitals will have to buy a bunch more hardware which is super expensive, especially these days.
This doesn’t get you much in terms of security. The IRIS system itself is an OLTP so it’s going to need to constantly pass around the encryption key and use it constantly, and if an attacker gets disk access they also will have access to the keys.
So this is a big waste of everyone’s time and money.
CodesInChaos 1 hours ago [-]
Shouldn't full disk encryption be enough to satisfy that requirement?
As a government regime, do you want to build an effective surveillance system where health data on large numbers of suspects can be pulled into a data fusion system at the push of a button, once a judicial framework for rubber-stamping is in place? And do you want to be able to pressure vendors into not supporting certain types of research/analysis and even direct patient care that could be construed/presented as counter to the regime's goals?
Both of these are easier when smaller vendors are forced out and larger vendors are the only ones left standing. As such, regulatory capture becomes a mutually beneficial tool to dominant vendors and regulators alike.
There are few coincidences when lobbying is involved. Which is not to say that cybersecurity improvements aren't a good thing! But speed and mechanisms of required rollout need to be balanced. And with the numerous signatories of [0] opposing the rule and describing "unreasonable implementation timelines," it's hard to say that this is entirely done in the interest of patients.
[0] https://assets.ctfassets.net/opszt4tga0mx/4QrJlGP2EkCiZjgvGx... (2025)
1. Do good security and operations.
2. Overlap the minimum subset of your existing good security and operations as evidence for whatever compliance regimes help you get paid.
3. Get paid.
Nobody is suggesting that you bullshit the auditors. They’re suggesting not letting the auditors accidentally trick you into letting step 2 get in front of step 1.
Maybe there's some kind of third party certification system to support signing information sharing agreements ("BAAs") with other health information systems. I worked at CMS on first-party stuff so I'm not really familiar with how it works in the private sector.
They also asked for proof of system-enforced processes (e.g. GitHub branch protection rules and the setting for enforcing peer review for each change) which were basically proof of consistency.
That's what we're talking about when we say virtually any tool you can come up with will satisfy "vulnerability scans". For Cloudflare, it was nmap. I think they're right about this.
But the far more likely thing is that a medium SOC auditor, upon being told “we do our vulnerability scanning with nmap”, would say “I haven’t heard of nmap. You should use Tenable,” and if you’re letting SOC auditor drive your engineering you’d make a mistake and accidentally think that meant you needed to change your answer for SOC2 and go buy Tenable licenses.
My experience is that no, SOC2 auditors won’t consider literally any automated process of that sort as compliant. Which in no way implies the auditors are forcing you to use a licensed tool or driving your engineering.
I will stop that thread here, I don’t think that exchange is productive
Compliance and security are entirely different practices in a well-run firm. Security can inform compliance. Compliance should not inform security engineering.
If you search my name and "SOC2" in the search bar below, I've expanded on this quite a bit.
This is ignorance at best. No one who has ever actually had to do SOC2 compliance legitimately has just run nmap and been done with that.
while i find tptacek's opinions very strong on the subject, you would be extremely mistaken to think those opinions were formed without experience
PCI-DSS still takes the cake for most oppressive rules out of all the compliance frameworks. The notion that your system might become "in-scope" is one of the scariest things you have to deal with. Avoiding this designation is almost always easier than satisfying all the controls they prescribe. Stripe & friends have it really good. I don't know who their equivalents are in the health care industry but I am certain they exist.
My personally most hated compliance ruleset. I've been in Healthcare for over a decade, I'm a HIPAA/data security expert, and PCI compliance is genuinely harder and more nonsensical than HIPAA.
And to be honest, for every ONE healthcare place I've seen that would fail a HIPAA audit, I've seen 20 companies that would fail PCI compliance and by a wider margin. The number one PCI issue I've seen *literally* everywhere is recording/writing down card numbers with CVV. It's strictly forbidden by the rules, and every snall and medium business breaks that rule constantly.
Online payments (e.g. e-commerce) usually send such data directly to the PSP, or encrypt it with a PSP controlled key.
And in person payments (e.g. stores and restaurants) use a payment terminal/device, which is presumably PCI DSS compliant and doesn't store such information.
And yes, there is plenty of incentive to keep things out of PCI scope. I'd say that is PCI working as intended. Why would you want a larger attack surface that touches your credit card data?
Basically, Visa and friends externalized their own shitty security and made every other company in the land responsible for wrapping their janky hardware in electronic bubble wrap. A real security framework would’ve said “don’t make a credit card scanner so weak that it can’t survive being on the same LAN as a printer”. Instead, the whole country has to waste billions of dollars mitigating that risk for them.
Given that downgrade attacks are a massive category of attacks for network protocols, and in fact modern protocols go to great lengths to make them impossible, that doesn’t sound very bullshit at all.
But in reality, why’s that a problem? Is the credit card scanner so tacitly busted that it can’t coexist with other hosts? Does it not use TLS? Doesn’t it pin TLS certs so that it’s not subject to MITM? Is it listening on ports with vulnerable services? There’s no excuse for the scanner being that delicate. It should be able to service an office LAN. And yet, the PCI-DSS group managed to push the responsibility for their hardware onto the network owners rather than making their own hardware robust. That’s nuts.
Context is everything. Here, the context is that within this scan environment, it was, in fact, a bullshit finding.
You lose all your customer's data to a darknet leak? We should be taking a huge chunk out of your balance sheet.
My insurer has disclosed names, social security numbers, and ENTIRE MEDICAL CASEFILES for their entire client base more than once at this point in overlapping data breaches. Why exactly don't they owe me $10k for my trouble, or N% shares of the company? If that's too much, why do these penalties exist for knowing disclosure, if incompetence is so tolerated that knowing disclosure does no damage?
[0] https://www.ama-assn.org/practice-management/hipaa/hipaa-vio...
[1] - https://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp...
Still, I was hoping for examples.
To tie back into the original discussion on HIPAA, I had a collection agency sending mail addressed to a previous resident to my address once. The return address was the clinic of the patient. I was dutifully writing RTS on every letter and putting it back in the mail, but they would not take me off their nastygram list. That was until I wrote "You know, it's a felony HIPAA violation to be leaking this patient's name and clinic to me after you've been notified of the incorrect address." The collection letters immediately stopped after I did that.
AI writing makes somewhat more sense on tech blogs. Where a business' value proposition is "We are knowledgeable and reliable about computer security", it seems unwise.
[1] https://www.youtube.com/watch?v=4sfIBRTcRpU
https://odysee.com/@NaomiBrockwell:4/HIPAA:7
It's getting absurd with how many different compliance regimes a modern research university will have to follow simultaneously, if they do a broad set of defense, energy, basic sciences, and health research as well as having an attached medical school and teaching hospital.
rules for thee but not for me
This doesn’t get you much in terms of security. The IRIS system itself is an OLTP so it’s going to need to constantly pass around the encryption key and use it constantly, and if an attacker gets disk access they also will have access to the keys.
So this is a big waste of everyone’s time and money.