Shoot own foot, decline band-aid

Anthem (formerly Wellpoint), continues to confuse some security professionals with their actions. It has become public that they provide services to the US Federal Employees Health Benefits program which means, they are REQUIRED to undergo regular audits of their systems-to of course protect the sensitive data of government employees. There are lots of details but in short, a simple case of a government security requirement due to the type of coverage they provide. They ignored this requirement and apparently (according to the article linked below citing government sources) simply refused to allow auditors the required access to complete their jobs. The government issued a quite negative report as is expected and that is where we sat when the huge breach was announced.

So the big question I have is why did the government not force (either through legal
action or by replacing Anthem as a supplier to the Federal Government) and instead
place Federal Workers at significant risk?

Article on Anthem regarding government failed attempts at required audit(s)

I hope that when the dust settles, the Class Action Lawsuits are completed, and Anthem
has a day of reckoning, that someone in the US Government looks at that question and
ensures that something like this doesn’t happen again. The government had it in its
power, simply as a large “customer” to require compliance and did not-also putting
millions of Americans’ privacy at risk as result of inaction.

The linked article indicates the same government agency attempted AFTER the breach
to assist Anthem via an audit-they apparently are still being refused and ignored as I
type this. I hope that such attitudes (for whatever claimed reason) do not continue for
much longer as it does not bode well for the future of info-sec, especially with such
large (dare I say, “too large to fail”) companies.

Consulting: Need independent analysis or security support? See AI & Cybersecurity Consulting.