Network Security Policies

"The portal did not have multi-factor authentication." Andrew Witty, the chief executive of UnitedHealth Group, gave that explanation to the U.S. Senate in May 2024, and it accounted for one of the most damaging attacks on American health care. The portal belonged to Change Healthcare, a company UnitedHealth had bought in 2022 that handles about 15 billion health care transactions a year, such as insurance checks, claims, and payments, for hospitals, doctors, and pharmacies. It was a Citrix portal that let staff open their work desktops from outside, the kind of remote access a VPN policy governs.

Attackers signed in to it on February 12, 2024, with a stolen username and password. Nothing else was asked of them. Nine days later they set off ransomware across Change's systems. Pharmacies across the country couldn't check patients' insurance, clinics couldn't get paid for weeks, and UnitedHealth advanced billions of dollars in loans to keep some of them open. It paid the attackers a ransom of 22 million dollars. Months later it reported that the stolen files held information on about 190 million people.

Organizations set the security rules for their networks in written policies. Each policy sets a minimum standard that one kind of equipment or connection must meet before it joins the network, so the answer to "should this be turned on?" doesn't depend on who happens to be setting it up. A school district, for example, keeps one policy each for its routers, its switches, its VPN, and its wireless networks.

Change's missing control belongs to the VPN policy, the one that governs remote access. It decides who may reach the internal network from outside, and how they prove who they are. A rule requiring a one-time code as well would have left the password useless on its own. The code can come from a phone app or from a key-fob token, whose small screen shows a new number every minute.

A VPN policy also covers how the connection is used. With split tunneling, only the traffic meant for the district goes through the VPN, and everything else leaves the device directly. That other traffic never passes the district's web filter or reaches its logs, so the district can't see or stop it. A district policy can forbid split tunneling, so that while the VPN is on, all of the device's traffic goes through the district's protections.

Routers and switches get their own minimum standards. The district's router policy says nobody signs in with an account stored on the router itself: every login goes through the district's central authentication server, so an account can be shut off in one place when someone leaves. It also says every service a router doesn't need, such as Telnet, an old remote-login service that sends passwords unencrypted, is turned off. A firewall has to stand at the network's edge, on the router or as a separate box.

Anyone who records the traffic of a Telnet sign-in, anywhere along its path, reads the password as it was typed:

login: netadmin
Password: Bluebird#7

The switch policy is what would have closed the robotics lab's wall jack to the student's travel router.

The high school's vulnerability scan, in the lesson on network risk assessment, found that every student shares one Wi-Fi passphrase. List what the district's wireless policy would have to require to end that.

Each person would sign in with their own school account, checked by the district's authentication server through EAP, the Extensible Authentication Protocol, so a student who leaves loses access and a shared password stops being a way in. The same document covers scrambling everything sent over the air with a strong cipher, AES.

Asked whether UnitedHealth required multifactor sign-in, Witty told senators that its policy required it on systems that face the internet. Change, bought less than two years earlier, was still being brought up to UnitedHealth's standards, and this portal hadn't been. A policy protects only the devices that follow it in practice. That is why the district checks every router and switch against its policies, and why a travel router like the one plugged into the robotics lab gets found and removed rather than set up to match.