![What Happens When You Neglect Encryption and Cybersecurity? [Encryption Digest 53] - cover graphic](/_next/image/?url=https%3A%2F%2Fcdn.venafi.com%2F994513b8-133f-0003-9fb3-9cbe4b61ffeb%2Fb4d9cea1-33f5-488c-87bd-0e4378ea6dc3%2Faid_field_img__17ff256475906c6bafc28d070e2b5550.jpg%3Fw%3D864%26h%3D370%26fm%3Dwebp%26q%3D75%26fit%3Dcrop&w=3840&q=75&dpl=dpl_9nMnPWFgUR3MNGqVKD9tfneGCtKt){kind=small}
It’s not uncommon for businesses to assume that a small team manually looking after certificates is sufficient, and that certificate-related outages or theft of cyber data is the type of thing that happens to other companies. But it’s just as easy for large organizations to have the same challenges with expiring certificates.
Recent events demonstrate that businesses and websites of any scale are vulnerable to attack when the proper measures aren’t taken. From governmental encryption vulnerabilities to cybersecurity breaches, neglect and complacency can lead to disaster. Allow these cautionary tales to encourage you to start investing in machine identity management today!
South Africa’s cybersecurity hub exposed by expired certificate for a week
The Cybersecurity Hub is South Africa’s governmental security hub, which plays the vital role of handling cybersecurity threats that South Africa’s residents report in. So it’s not unreasonable to expect that the website would follow security best practices to act as a beacon to those that it serves. One of those best practices is to maintain security certificates that safeguard the connection between a website and a web browser with encrypted keys. If one of those certificates expires, then it can jeopardize protection, as when expired certificates at Equifax contributed to the company’s notorious breach. Granted, renewing certificates can be a challenge with certificate lifecycles now shorter than ever. The Cybersecurity Hub security certificate expired on November 12th and wasn’t resolved until November 19th, a week later.
What could cause this type of security gap in a government-run website? As Venafi experts often point out, one of the biggest challenges with certificate management is maintaining a living record of not only when certificates expire, but where they are located and what they do. Depending on the size of your network, it could take a little while you diagnose and address expired certificates, as was the case with South Africa’s Cybersecurity Hub. This is one of many reasons that machine identity management is a game-changer for any organization, and automating your certificate management can ensure that certificate-related outages really won’t impact your website.
CIO Study: Automation Vital to Address Shorter Lifespans and Massive Growth of TLS/SSL Certificates
Healthcare privacy standards are shockingly low
The U.S. Department of Health & Human Services Breach Portal reported that 418 HIPAA breaches were reported in 2019, compromising the protected health information (PHI) of nearly 35 million Americans. This seems staggering for an industry that should be entirely dedicated to the protection of privacy, and has been mandated to do as much via the 1996 Health Insurance Portability Accountability Act.
It turns out that while the regulations laid out by healthcare companies may seem adequate on paper, they fall short in failing to account for human error. For example, when a healthcare employee’s unencrypted laptop was stolen, the PHI of nearly 4,000 patients were stolen and accessible to malicious third parties. Hospitals have also been guilty of incorrectly disposing of documents and having patient PHI stolen right out of the garbage.
The bottom line is that encryption is terribly important. That being said, there are tangible steps healthcare companies can take to improve compliance with security guidelines. An in-house compliance professional can ensure that access to emails and attachments containing private patient information is restricted to only necessary parties, and block the use of personal and unencrypted devices for official communications.
Why Do You Need a Control Plane for Machine Identities?
Related posts
- 8 Certificate Management Mistakes You Can Avoid
- Fighting for Privacy as a Fundamental Human Right [War on Encryption]
- 7 Data Breaches Caused by Human Error: Did Encryption Play a Role?
Machine Identity Security Summit 2024
Help us forge a new era of cybersecurity
☕ We're spilling all the machine identiTEA Oct. 1-3, but these insights are too valuable to just toss in the harbor! Browse the agenda and register now.