Call us now:
The CEO of United Health sat in front of 2 committees yesterday to discuss the impact of the cyber attack, that started in February 2024. Both events are enclosed (https://lnkd.in/dehVmP69).
The sentiment of both committees was that the United Health hack is a national security issue.
In ones opinion the CEO was well prepared, saying as little as possible about the cyber attack and the cyber capabilities of either United Health or Change Healthcare. Avoiding directly question posed about cybersecurity. The CEO stuck to the line of MFA and legacy systems being the cause of the incident.
MFA – Credentials were stolen and used to attack one Change HealthCare server. The server that did not have MFA. MFA is simply a credential security tool, at no point has there been an explanation of how the attacker used the credential to break out of the MFA environment. Or what level of access the particular credentials had to Change systems, or what security was put in place to manage high privileged credentials and systems access (break Glass). Or why the hacker was able to compromise production and backup environments.
Significant emphasis was placed on the Change Acquisition and the lack of systems and security integration and legacy systems that were the reason given why the hack was successful and system backups were compromised.
United Health has no record today of how many people have been compromised by the attack and the extent of the data stolen, after nearly 3 months.
When asked questions about cybersecurity and regulatory compliance the CEO avoided direct answers. When questioned about systems resilience the same response was given, it was an issue with legacy systems acquired during the purchase of Change Health. When questioned the CEO stated that United Health was not allowed to complete due diligence over Change Systems at the time of purchase.
In ones opinion the session was well managed by the CEO, ahead of regulatory investigations and legal actions. Given the national security implications of the attack on United Health one can assume that the CEO will be called back to other committees.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA
Veritas GRC UnitedHealth Group Change Healthcare United States Senate Committee on Finance House Committee on Energy and Commerce
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7191696868391731201