About three years ago at the Hartford, Conn.-headquartered Aetna, a health plan with more than 37 million consumers, organizational leaders set out to create new security measures for its mobile and web applications that would aim to transform existing controls.
At the core of the initiative was being able to monitor user behavior in real time, says Jim Routh, the chief security officer (CSO) and global information security function leader for Aetna. “As it turns out, security is evolving pretty quickly into a model-driven security realm,” he says in a recent interview. Routh explains that model-driven security centers around frontline security controls in which algorithmic models determine things such as: how much access to give to a consumer, an employee, or a privileged user; whether something running on an endpoint device is malware; or whether a phishing email is being sent through the email infrastructure.
In many cases, notes Routh, it’s the models that are driving security controls; at Aetna, there are 200 models in production today that are doing just that. “And we do a lot of manipulation of the models, which is evolving cybersecurity and physical security practices from conventional to unconventional controls,” he says.
In the interview, Routh spoke to Healthcare Informatics about how Aetna has been able to put these controls in place, why behavioral-based security is so important and more. Below are excerpts of that discussion.
Tell me about your plan at Aetna to monitor users’ behaviors in real time. How did it all begin?
Three years ago we hired a chief data scientist to be dedicated to security, and this was someone with nine years of experience at the NSA (National Security Agency). We asked him to build a large data lake for security, enterprise-wide and to scale, that would be something we could use off-the-shelf to do better cyber hunting, and figure out patterns and anomalistic behaviors across a wide swath of data, and develop broad models for some of our payment business segments.
And he did that exceptionally well. In two-and-a-half years’ time, he had 110 models running in production and it was exactly what we asked him to do. The irony is that during that time we deployed eight other implementations of technology platforms that had embedded unsupervised machine learning to drive controls.
Jim Routh
Can you give some examples of these models?
The first and most significant example from a consumer perspective is when we moved into what we call continuous behavioral-based authentication. And there are two parts to that, with one being that it is continuous. Every time we have designed authentication for any kind of technology, it was an event at the front end of an electronic interaction. So in a web app, you provide the user ID and password, you are in and trusted, with full access to the system. And there is little monitoring thereafter since you’re a trusted entity. Remember, binary controls for authentication can be defeated since they are based on assumption that only the end-user has the information. And that used to be the case with passwords, but it isn’t anymore.
In 2016, three billion credentials were harvested just based on public breach data. Shape Security [a Mountain View, Calif.-based security company] did the analysis based on public breach data, and they believe that the number is actually closer to 10 billion credentials. And there are only 320 million people in the U.S., so the assumption that you are the only one that has your password is no longer valid.
There is actually a tool called Sentry MBA that bad actors could use. So let’s say that they harvest 10,000 e-mail credentials from Yahoo, for example, take those credentials (user ID and password combination) and try it out on any other domain that they wish—and they can do it through a script in the Sentry MBA tool—they will get a 2 percent hit, so they will own 200 accounts from the 10,000 credentials that they attempted. And the reason that 2 percent hit is because you and I, like everyone else, can’t remember passwords for 100 different sites and mobile apps. So we use the same password. So 2 percent of the time you will get a hit just by using the same user ID and password from one domain to the other.
We are reaching the point of when the credential availability will be unlimited, and when that happens, there is no friction stopping a criminal to do this at scale. A growing percentage of authenticated log-ins in an enterprise are done by somebody using someone else’s credentials. So the obsolesces of passwords will continue to grow and grow significantly. It will take a decade to swap out login credentials across all of the enterprises, since that doesn’t happen overnight; 99 percent of authentication today is done through passwords. But in order to solve this problem, we have to recognize that authentication moves from an event to the front end of an interaction to a continuous process. And we are using behavioral attributes gathered electronically, and we apply a risk score to that, and that risk score notifies the application how much access to provide throughout the interaction.
An example is that in a web app, we will have 30 attributes of an end-user’s device configuration, browser configuration, location, and electronic behavioral patterns, and for each one of those we create a numeric value of it. And we have one that identifies the pattern that’s the norm—so it’s capturing data over a period of time for that attribute, recognizing what the norm is, and representing that numerically. Then we take the actual data, turn that into a number, compare it, and it gives us a deviation score, or a risk score, essentially. We add that up across the 30 attributes, aggregate it into one risk score, and that tells the app what the trust level is for that user at that point in time. And that will change; there are thresholds. The app decides what to do with the risk score. Some apps will be highly sensitive and others will be indifferent. So authentication moves from an event to a continuous process and it’s math that is driving it.
We have modified our web and mobile apps to allow us to not only do continuous authentication, but we can change authentication controls any time we wish without writing a line of code. So we push a button from a policy and we can create an authentication control for a unique segment of a consumer market and treat them differently than others, and then adjust authentication controls and the attributes that we take. So when Apple comes out with a picture biometric, we can use that just as much as we use the touch ID. And the consumer chooses the biometric. We take that as an attribute, score it along with the other attributes, and do continuous authentication.
This is in production for a million people today, so it’s not theoretical. Most of the top four banks all have continuous behavioral-based authentication in production. They keep asking for the passwords because they don’t want to tell consumers that they no longer use the passwords, so they just do this in the background. The technology has been around to do this for quite some time. We took four early stage companies that have best-of-breed capabilities to build this infrastructure. We started implementing this last year and hopefully by the end of [2018] all of our consumers will be using it. They will be choosing their biometric of choice and we use all of the other attributes. And the nice thing is they won’t have to remember their password anymore.
What is Aetna’s expected outcome from this work as it relates to keeping bad actors away and protecting users’ data?
With most of the breaches you read about today, the criminals are after credentials. People were scratching their heads three years ago when they started hearing about email passwords being the source of an attack. As it turns out, because we all use the same passwords [for everything], email passwords are good proxies. And combine that with the demographic consumer information that is available for criminals today, all of that can be used to bypass our controls for password reset. [Bad actors] will actually call a call center and will try to convince the phone rep to give them the person’s credentials. And then they own the account, and that’s across any enterprise, regardless of industry. The use of passwords is growing problematic, and it’s because of the credentials combined with the demographic information that is out there in public domain.
Our position at Aetna is that we are telling our consumers that we are moving to this model. We’re giving them choices; they can choose the biometric they wish, or they can choose to keep using a password PIN. Most consumers like the convenience of not having to log into an app. It is a better consumer experience and it’s better from a risk management standpoint. Every time you add security to a consumer, you add friction. But in this case we are adding security and removing friction at the same time. So far, of the million folks using it on the mobile side, 90 percent choose not to use the one-time password and choose their biometric of choice.
From a CISO/leadership level, was it challenging to convince your board to invest in a model like this?
This wasn’t always the case, but convincing leadership of the importance of security is the easiest thing in the world today. And that’s because security is front-page news. So the interesting thing is you can do security for less money, but it involves technique and unconventional controls. And in order to get there, it requires innovation and engineering time.
Aetna is willing to invest our engineering time with early-stage companies. Larger security companies, by default, have to cater to the broadest part of the market. And that’s a good business model for them, but the broadest part of the enterprise market doesn’t happen to have the most knowledge and maturity in security. So these larger companies cater to a dumbed-down version of a capability. We prefer at Aetna to push the innovation to design new controls that change the rules for the threat actors, and we are willing to take risk to do that.
