INCIDENT RESPONSE
ROUNDTABLE
ROUNDTABLE
Amgen Data Breach: Third-Party Risk Management or Unforeseen Exploit?
By Cyber Newsroom Editorial Board
|
|
6 min read
Amgen data breach raises questions about risk management and exploit vulnerabilities. Experts debate third-party risk and breach impact.
Darren Cho emphasizes a decisive and urgent approach to incident response in the wake of Amgen's data breach. He believes that the immediate focus should be on containment, triage, and implementing effective incident response (IR) workflows. According to Cho, the lack of transparency regarding the third-party cloud providers, and the specifics of how the breach was executed, are alarming red flags. "Without full visibility into the pathways exploited by attackers, every moment spent without rigorous containment is a potential further risk to patient data and company integrity," he states emphatically. The rapid detection and activation of cybersecurity measures, while critical, are not sufficient if the vulnerabilities that allowed the breach remain unaddressed.
Cho argues that there must be an immediate reassessment of security protocols surrounding third-party providers. He advocates for a more aggressive vetting process and calls for companies to enforce stricter compliance checks. The data breach at Amgen not only exposed sensitive health information but also proprietary details vital to R&D efforts. This, in Cho's view, highlights an alarming oversight in risk management that could have been mitigated through a more comprehensive understanding of vendor security postures. "Waiting for a forensic investigation to reveal the extent of the damage is too late; businesses should be proactive to avoid becoming victims of their own negligence," he concludes.
Ivan Sorrell: takes a technical angle, analyzing the exploitable vulnerabilities in Amgen's cloud infrastructure. He believes that the breach is indicative of a broader issue related to the sophistication of adversarial tactics within the biotechnology sector. Sorrell points out that the focus should not only be on how an exploit occurred but also on the evolving nature of exploit development that is pushing the envelope on cybersecurity defenses. "The adversaries are continuously innovating, and every breach is a testament to the fact that companies—particularly in sensitive fields like healthcare—must keep pace with this changing landscape," he observes.
Sorrell criticizes the existing methods of exploit detection and emphasizes the need for advanced cybersecurity protocols that can adapt to the rapidly changing exploit landscape. He highlights that Amgen's reliance on third-party services may introduce vulnerabilities not only from those providers but from unknown threat actors leveraging exploit techniques. Sorrell underscores that the company must invest in more robust threat intelligence capabilities, which he sees as essential for adapting to emerging threats. "In the race against adversary behavior, we cannot afford complacency; real progress hinges on understanding the tradecraft that led to this incident," he argues passionately.
Leah Sterling approaches the Amgen breach from a legal and regulatory lens, expressing concern over the implications for patient privacy and compliance with existing surveillance laws. She notes that the nature of the data exposed is particularly sensitive—not just because it pertains to proprietary health information, but due to patient rights to confidentiality. Sterling questions how well Amgen is prepared to navigate the legal landscape surrounding data breaches, especially considering the ongoing assessment about their obligations to notify affected individuals. "Failure to comply with privacy regulations not only raises ethical questions but may also expose Amgen to significant liabilities," she cautions.
Sterling advocates for full transparency and accountability in breach reporting. She stresses that the lack of clarity surrounding how many individuals are impacted, along with the broader implications for patient confidentiality, complicates the narrative for both the public and regulators. In her view, companies like Amgen must not only focus on damage control but also proactively communicate their strategies for restoring trust with stakeholders and patients. This proactive stance is essential to mitigate the reputational risks associated with such breaches, particularly in the healthcare sector where trust is paramount.
Mara Bell offers a measured perspective on the Amgen data breach, emphasizing the necessity for better risk management strategies at the board level. While the technical response to the incident is crucial—something she acknowledges—the conversation must also shift towards comprehensive risk assessment and management strategies that take into account the strategic implications of data breaches. Bell expresses concern over the materials reported by Amgen, suggesting a need for deeper introspection on whether their cybersecurity frameworks are aligned with modern risks.
Bell champions a more integrated approach that includes not just IT and cybersecurity personnel but also executive leadership and the board of directors. She argues that ongoing breaches are a reflection of broader organizational vulnerabilities that require a holistic view. "It’s critical for companies like Amgen to bridge the gap between technical cybersecurity measures and strategic risk management frameworks in order to prevent future incidents from occurring," she advises. Bell posits that the current breach could serve as an opportunity for organizational reflection and a reshaping of policies to better mitigate risk.
Noa Keller takes a skeptical stance regarding the quality of threat reporting and intelligence that organizations utilize in response to breaches. She raises concerns about Amgen's abilities to validate the threat intelligence they possess and whether this influenced their response to the breach. Keller argues that a significant factor in their incident response appears to be a lack of actionable intelligence, which may have delayed their reaction to the unauthorized activity. "Without high-quality data to inform their decision-making process, companies risk misallocating resources toward ineffective security measures," she warns.
Keller is particularly critical of Amgen's ongoing investigation and its implications for transparency and stakeholder trust. She emphasizes the necessity for every company to ensure robust validation processes for threat intelligence to avoid falling prey to misinformation. This is a recurring theme in her advocacy for improved cybersecurity practices across sectors. "The quality of reporting plays a pivotal role in shaping corporate responses to breaches; if Amgen fails to emphasize this in their post-incident analysis, they risk repeating the cycle of disorganization and confusion," she concludes.
In summary, the roundtable reveals distinct viewpoints surrounding Amgen's data breach, focusing on varying aspects of vulnerability, risk management, and the broader implications for patient privacy. Darren Cho and Ivan Sorrell urge immediate action to contain vulnerabilities, with Cho prioritizing containment and Sorrell calling for an evolution in exploit detection. Leah Sterling places significant importance on regulatory compliance, while Mara Bell advocates for a comprehensive, board-level risk management strategy. Lastly, Noa Keller brings attention to the quality of threat intelligence and its impact on incident responses. While all participants acknowledge the severity of the incident, their disagreements highlight the multifaceted challenges organizations face in securing sensitive data.