Base Deck Flashcards
Questions from Study guide (48 cards)
What was the date and duration of the Change Healthcare breach?
February 12-21, 2024 (9 days). Largest healthcare breach in U.S. history.
What was the attack vector used in the Change Healthcare breach?
Compromised credentials through an unsecured Citrix portal lacking MFA (Multi-Factor Authentication)
How much data was exfiltrated during the breach?
Approximately 6TB of sensitive data affecting 100 million patients and 1.6 million healthcare providers
What percentage of U.S. health claims were affected?
About 40% of all U.S. health claims were impacted
What was the total cost of the breach including ransom?
Exceeded $1 billion, including a $22 million ransom payment to ALPHV/BlackCat
What operational systems were disrupted?
Insurance verification, claims processing, and payment operations nationwide
What is the mnemonic for incident talking points?
Identify All Important Data For Response (I-A-I-D-F-R)
Who was the ransomware group responsible?
ALPHV/BlackCat ransomware group
What cybersecurity framework does UHG use?
NIST Cybersecurity Framework (CSF) 2.0
What is UHG’s current NIST CSF score vs target?
Current: 2.1 (Repeatable), Target: 2.5 (Defined) by FY2026
What is UHG’s weakest governance area score?
Governance scored 1.1, demonstrating unclear accountability and inconsistent practices
What does UHG’s risk tolerance explicitly reject?
Risks jeopardizing regulatory compliance, data integrity, or patient safety
What governance enhancements are proposed?
Updated cybersecurity charters, defined roles, clearer accountability structures, executive simulations, standardized escalation protocols
What is the mnemonic for governance talking points?
Nurture Clear Governance; Reinforce Roles & Guidelines (N-C-G-R-R-G)
Why was governance particularly weak post-Change Healthcare acquisition?
Inconsistent cybersecurity practices across subsidiaries after the acquisition integration
When was the comprehensive security assessment conducted?
August 2024, six months post-breach
What assessment methodologies were used?
NIST CSF and CMMI (Capability Maturity Model Integration)
What was the asset management maturity score?
2.4 - lacking unified visibility across integrated entities
What was the vulnerability management score and why?
1.8 due to inconsistent threat modeling and response practices
What delayed effective incident containment?
Incident response processes varied across business units
What is the target maturity rating by FY2026?
Maturity rating of 3 (Defined) by FY2026
What is the mnemonic for capability assessment?
Assess Security And Validate Incident Remediation (A-S-A-V-I-R)
What are the key remediation roadmap elements?
Standardized methodologies, automated risk assessment tools, consistent post-incident reviews
What are the six strategic initiative categories?
Governance & Risk Alignment, Enhanced Asset & Data Visibility, Modernized Detection & Monitoring, Cyber Resilience & Recovery, Security Culture & Training, Integration & Third-Party Risk Management
