Detective Controls for Data

A database administrator at Anthem, one of the largest health insurers in the United States, noticed a query running against a database of member records on January 27, 2015. It was running under his own account, and he hadn't started it. He stopped it and raised the alarm, and two days later Anthem confirmed it had been attacked and called the FBI.

The query was the end of an intrusion that had begun almost a year before; queries like it had been running since December. The adversary had already signed in with several administrators' credentials, so to the database every request looked like the work of someone allowed to make it. Records for 78.8 million people were taken: names, birth dates, Social Security numbers, member ID numbers, addresses, phone numbers, email addresses, and employment details including income. Claims and diagnoses weren't among them. What was taken was enough to steal an identity. Anthem notified the people in its records by mail and offered each two years of free identity protection from an outside company.

The online bookstore's customer database holds names, shipping addresses, and order histories. Every time an account reads, copies, or deletes something there, the database writes a line recording the account, the time, the device, the place the connection came from, and what was done. Three of last month's entries, in plain words: the owner's account opened twelve orders on a Tuesday afternoon from the shop's computer; the shipping clerk's account opened forty orders across a weekday; and the shipping clerk's account deleted 85 order records within a few seconds at 11 a.m. on a Wednesday, over a connection from another state. Which one would you look into first?

The deletions should be looked into first, since they fit nothing else the account does. The clerk looks orders up and has never removed one, and has never worked anywhere but the shop. It may still turn out to be harmless. It is exactly the kind of entry the records exist to surface.

The bookstore adds a cheap second control. In the folder with its customer exports it puts a file named like an old backup of card payments, filled with card numbers that belong to nobody. Nothing the shop does ever needs that file, so the system sends the owner an alert the moment anything opens it.

A third control watches for changes instead of reads. The bookstore records a hash of each file that runs its checkout page and compares it with a new hash later; the lesson on integrity hashing works through how.

A fourth option costs real money: a data loss prevention service, run by an outside company, that watches how data is opened, used, and sent across the whole business and flags what looks wrong. The bookstore weighs it against what it holds. Its card payments go through a card processor, so the card data it keeps is small, but the customer list is sensitive, and the rules for handling payment cards require logs of access to card data to be kept and reviewed.

For a shop its size the bookstore skips the service for now and puts the money into software that reads its access records automatically and alerts on entries like those deletions, since nobody at the bookstore has time to read every line by hand.

The controls differ in when they report and in what they can't see. Which of the bookstore's controls would have caught Anthem's adversary soonest, and which would have missed it entirely?

Automated reading of the access records had the best chance of catching it early, even though the logins were real: administrator accounts pulling member records in bulk, far beyond what any administrator's job called for, is the kind of pattern it can flag. A decoy would have fired only if the adversary happened to open it. The hashes would have missed it entirely: the adversary copied records and changed none of them, so every hash would have matched.

The attack had started with phishing emails to one of Anthem's subsidiaries. A federal grand jury indicted a Chinese national and an unnamed partner over the attack in 2019; neither has been brought to court. Anthem agreed in 2017 to a 115 million dollar settlement of the class action brought by the people in its records, approved by a federal judge in August 2018, and it paid the U.S. Department of Health and Human Services 16 million dollars in October 2018 to settle the department's case. The department found that Anthem had not analyzed the risks to its data across the company, had weak procedures for reviewing activity on its systems, and had not detected the intrusion in time.