This is a must read letter, relating to the United Health cyber-attack.

← Back to Blog

This is a must read letter, relating to the United Health cyber-attack. On the 1st of May 2024 the Senate Finance Committee requested the CEO of United Health attend a Committee hearing to discuss the the February 2024 cyber attack.

One outcome of the committee hearing is this letter from the Chair of the committee Ron Wyden to the Chair of the Federal Trade Commission(FTC) and the Chair of the Securities and Exchange Commission (SEC), urging both to investigate United Health, the incident and the companies cybersecurity risk management.

The letter exposes more information about United Health and its oversight and assurance of cybersecurity. (I’m not going to discuss MFA).
1. A likely reason the company failed to adopt industry standard cyber defenses is the CISO ‘appears to be unqualified for the job’. The CISO had not worked in a full-time security role before being elevated to the role of CISO in June 2023.

You have to love this quote from the letter: – ‘ Just as a heart surgeon should not be hired to perform brain surgery, the head of cybersecurity for the largest health care company in the world should not be someone’s first cybersecurity job.’

2. The board of directors should be held accountable for appointing someone with no prior cybersecurity experience to the role, and the company’s failure to adopt cybersecurity best practices.
3. The companies Audit and Finance Committee failed to oversee cybersecurity risk.
4. The negligent harm to the company, consumers, investors and national security.
5. The similarities between the United Health attack and the SolarWinds case, as far as the adoption of cybersecurity practices and the consideration given by a reasonable investor.

With the information disclosed above and under the SEC final cyber rule, one would expect United health to be focused on doing whatever is required to support the FTC and SEC in their investigations.

Rachel V. Rose, JD, MBA @Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Johnathan Rudy

Veritas GRC Federal Trade Commission U.S. Securities and Exchange Commission UnitedHealth Group Change Healthcare

#cybersecurityriskmanagement #cybersecurity

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7202043894966960128