Mathias Consulting Logo
Published on Mathias Consulting (

Bruce Schneier - Beyond Fear

By Robin Mathias
Created Jan 7 2005 - 3:57pm

“You can be vulnerable simply because your systems are the same as everyone else’s.” Bruce Schneier

  1. Security is only as strong as the weakest link. If a crook can enroll as a provider without providing any credentials and can bill using a list of patients stolen from another provider, then all the computer network security in the world is not going to help you. If he can create believable bills, most of your sophisticated algorithms aren’t going to find him. Provider enrollment is just one of many very weak links in healthcare payment.
  2. Class breaks allow a perpetrator to attack several systems with the same ease as he can attack one system. The standardization required under HIPAA [1] is going to make it easier for us to use fraud fighting algorithms developed for one plan to find fraud in another plan, but it will also make it easier for criminals to use the same exact scam in multiple places.
  3. Automation allows attackers to make a huge number of attacks with about the same effort as one attack. The payoff for each attack can be very low, since the cost is low. If I set up a booth at the mall offering free chiropractic exams, I can collect insurance information for hundreds of patients in a weekend. I can bill weekly services for each of those people, while I move to a new location to collect more insurance data. Automation also means that only one attacker has to be smart, while the rest can just use his software or methods to carry out the fraud.
  4. Defense in depth uses multiple counter-measures to protect assets. There is no silver bullet. You’ve got to implement different kinds of security that overlap. This is why HIPAA requires restricted access to locations with sensitive data, as well as passwords, and need-to-know authorization restrictions.
  5. Good security systems are resilient. Every security system fails sometime. Good systems aren’t brought down by a single failure. To be resilient, a system should be dynamic (it can respond to new threats) and should not be overly reliant on secrecy. If your security relies on intruders not knowing that your back door doesn’t lock, it is not a very resilient system. Lots of computer systems have back doors that are only guarded by supposed secrecy.

Source URL: