Emerging Cyber Risk

Out of Control in the Driver’s Seat

Security researchers provide haunting proof of how vulnerable our high-tech vehicles really are.
By: | April 20, 2016 • 5 min read
car hacking

You’re tooling down the highway when suddenly your car’s A/C turns on to full blast. Then the radio fires up and switches to a Hip-Hop station.

You’re startled when the wipers turn on, wiper fluid obscuring your view of the road for a moment.

Advertisement




You’re frantically trying to turn it all off when your car loses power completely, leaving you stranded on a busy stretch of road with no shoulder, a semi closing in fast from behind you.

That sounds a little a scene from a spy thriller or maybe even the “X-Files,” but it happened to the driver of a 2014 Jeep Cherokee as researchers Charlie Miller and Chris Valasek hacked into and took control of it.

The duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.

Miller and Valasek first made headlines in 2013, when they publicized their success hacking into Ford and Toyota models. At that time, they only managed to accomplish the attacks while their PC was plugged into the vehicles’ diagnostic ports.

Only two years later, the duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.

They found they could do it from absolutely anywhere, so long as they had an internet connection. Most disturbing of all, they identified a loophole that could be used to attack multiple cars at once — creating a wirelessly controlled automotive botnet encompassing hundreds of thousands of vehicles.

The team published part of the project online and later demonstrated their “progress” at the 2015 Black Hat conference.

Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get.

After Miller and Valasek published their results, Fiat Chrysler issued a recall for 1.4 million vehicles affected by the vulnerability exploited by the team. The automotive industry has been on high alert ever since, even while they simultaneously boast about models equipped with more and better technology.

Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get. The push toward autonomous vehicles will only increase those vulnerabilities.

“We are a long way from securing the non-autonomous vehicles, let alone the autonomous ones,” said Stefan Savage, a computer science professor at the University of California, San Diego, during an Enigma security conference early this year.

Autonomous isn’t necessarily synonymous with “connected,” however, even for early entrants to the commercial autonomous vehicle space.

Advertisement




Daimler’s Freightliner Inspiration, the world’s first road-ready self-driving truck, “doesn’t rely on ‘connectivity’ or wireless communication to/from the outside world to drive itself,” said Dan Holden, manager of corporate risk and insurance for Daimler Trucks North America.

“Rather, the system is self-contained, meaning it uses production cameras and radars as inputs to determine the vehicle position and keep it centered in its lane.  Therefore the Inspiration truck is as secure from a cyber perspective as production vehicles today.”

More Frightening Than Fiction

Until cyber vulnerabilities can be addressed, it doesn’t take a broad stretch of the imagination to see what the future implications could be for this type of attack. Consider a few scenarios:

  • The vehicle of a courier transporting sensitive documents is disabled in a remote location, where armed thieves are waiting to steal the documents.
  • A high-level executive receives a message alerting him that ransomers have control of his teen daughter’s car — with her in it — and will drive it off of a bridge if he doesn’t pay $10 million in Bitcoin.
  • A ring of thieves finds a way into the systems of a trucking fleet’s rigs through its onboard camera system, enabling it to stop the trucks remotely so teams can hijack the cargo.
  • An extreme hactivist group decides to “brick” every car in Los Angeles, disrupting businesses and lives until its demands are met.
  • An attacker hacking into a commercial truck’s system disables the brakes, sending the truck careening into a school bus in the middle of an intersection.

Keep in mind that even less extreme types of hacking could create vulnerabilities for both individuals and businesses.

Miller and Valasek proved their ability to wirelessly hack a vehicle for surveillance, tracking GPS coordinates, measuring speed, and tracing routes. When a vehicle’s onboard systems are connected to the driver’s smartphone, the smartphone is also at risk for attack, and any data stored in it is fair game, including passwords and credit card information.

Government and Industry Respond

Miller and Valasek’s work is part of what inspired the drafting of an automotive security bill introduced last year. The Security and Privacy In Your Car Act (the SPY Car Act) would require cars sold in the U.S. to meet certain standards of protection against digital attacks and privacy.

The bill’s creators surveyed 20 carmakers and discovered that only seven used independent security testing to check their vehicles’ security, and only two had tools in place to stop a hacker intrusion.

Several Japanese companies are working on automotive cyber security technology.

In March, the FBI, along with the Department of Transportation and the National Highway Traffic and Safety Administration, published an advisory on the realities of hackable vehicles and making recommendations to increase security.

Several Japanese companies are working on automotive cyber security technology. Panasonic is developing a device that can detect unauthorized network signals and cancel them out. Fujitsu Laboratories and a researcher from Yokohama National University are developing technology that detect an attack, notify the driver, and encrypt signals to allow the vehicle to be stopped safely.

However these technologies are still five years away from commercial availability, as are fully encrypted next-generation automotive networks.

Advertisement




Transportation companies, their clients and every organization with a fleet of its own should be asking questions about the security of the vehicles that are used in the course of their daily operations — and whether they have cover that will respond if their vehicles fall prey to cyber tampering.

“Having insurance coverage in place that would address bodily injury and property damage is something companies should seriously consider as this risk matures,” said William A. Boeck, senior vice president. and insurance and claims counsel for Lockton’s cyber risk practice.

Michelle Kerr is associate editor of Risk & Insurance. She can be reached at [email protected]
Share this article:

RIMS 2016

A Potentially Explosive Reputational Risk

With guns a hot-button emotional issue, employers face tough choices for managing related reputational exposures.
By: | April 7, 2016 • 2 min read
RIMS gun at work

With more Americans passionate about carrying guns in public and more laws allowing it, businesses must assess their risk tolerance and prepare.

Uniform strategies that mitigate the growing risk of gun-related losses for most entities, however, have yet to emerge, leaving employers to define the best plan of action for their unique circumstances and their stance on guns on their premises.

The risks that restaurants, universities and most other entities face include, workers’ compensation losses, general liability exposures and operational challenges, should a shooting force an extended closure.

“”The biggest risk, actually, is reputational,” said Michael P. Lowry, an attorney at Thorndal, Armstrong, Delk, Balkenbush & Eisinger. “So if you can avoid that by taking some preventative measures you are ahead of the game. You are helping to contribute to the company’s bottom line.”

While the growing risk of a mass shooting incident will cause reputational harm, taking a stance on whether to ban guns or welcome customers and employees who pack them also generates reputational backlash from ardent proponents on both sides of the issue, the speakers said.

About five years ago Texas de Brazil posted their policy online stating that the restaurant company was fine with allowing concealed weapons or the open carrying of firearms in states where laws allow those practices.

“We were vilified within the first three days,” said Danielle Goodgion, director of human resources for the Brazilian-style steakhouse and churrascaria with locations across the United States.

“We pulled it off the website. It was not worth the drama.”

Conversely, companies that seek to mitigate the risk of violence by banning guns on their premises face social media attacks from interest groups opposing such policies “and now your brand is being drug through the mud,” Lowry said.

While a simple, uniform policy for mitigating the reputational exposures associated with firearms does not exist, risk managers should identify their risks and develop a plan that best protects their employees, customers and operations, the speakers said.

Each plan, however, comes with its own potential consequences requiring assessment.

Welcoming guns on premises, for instance, expose companies to liability should a weapon accidentally discharge. Posting signs banning guns, on the other hand, could expose the companies to claims from injured parties that the companies were responsible for their safety, Lowry said.

Whatever policies employers adopt, it is important they maintain mechanisms for enforcing those policies.

Employees, for instance, need to know what is expected of them and their responsibility for themselves and customers should a situation arise requiring action.

Goodgion said the company trains employees to respond to gun-violence threats or active shooter situations.

That training works in conjunction with other guidance such as anti-bullying training and exercises for identifying potential workplace dangers, for example, to provide opportunities for teaching how to treat others with dignity and respect and how to respond should violence occur, she said.

“All of that integrates,” Goodgion said. “It’s an evolution. So adding an active shooter response is just one more piece. For me, it was just adding another segment to the training.”

Roberto Ceniceros is senior editor at Risk & Insurance® and chair of the National Workers' Compensation and Disability Conference® & Expo. He can be reached at [email protected] Read more of his columns and features.
Share this article:

Sponsored Content by IPS

Compounding: Is it Coming of Age?

Prescription drug compounding is beginning to turn a corner in managing chronic pain.
By: | April 28, 2016 • 5 min read
IPS_SponsoredContent

The WC managed care market has generally viewed the treatment method of Rx compounding through the lens of its negative impact to cost for treating chronic pain without examining fully the opportunity to utilize “best practice” prescription compounds to help combat the opioid epidemic this nation faces. IPS stands on the front lines of this opioid battle every day making a difference for its clients.  

After a shaky start cost-wise, prescription drug compounding is turning the corner in managing chronic pain without the risk of opioid addiction. A push from forward-thinking states and workers’ compensation PBMs who have the networks and resources to manage it is helping, too.

Prescription drug compounding has been around for more than a decade, but after a rocky start (primarily in terms of cost), compounding is finally coming into its own as an effective chronic pain management strategy – and a worthy alternative for costly and dangerous opioids – in workers’ compensation.

According to Greg Todd, CEO and founder of Integrated Prescription Solutions Inc. (IPS), a Costa Mesa, Calif.-based pharmacy benefit manager (PBM) for the workers’ compensation and disability market, one reason compounding is beginning to hit its stride is because some states have enacted laws to manage it more effectively. Another is PBMs like IPS have stepped up and are now managing compound drugs in a much more proactive manner from an oversight perspective.

By definition, compounding is a practice through which a licensed pharmacist or physician (or, in the case of an outsourcing facility, a person under the supervision of a licensed pharmacist) combines, mixes, or alters ingredients of a drug to create a medication tailored to the needs of an individual patient.

During that decade, Todd explains, opioids have filled the chronic pain management needs gap, bringing with them an enormous amount of problems as the ensuing addiction epidemic sweeping the nation resulted in the proliferation and over-consumption of opioids – at a staggering cost to both the bottom line and society at large.

As an alternative, compounded topical cream formulations also offer strong chronic pain management but have limited side effects and require much reduced dosage amounts to achieve effective tissue level penetration. In fact, they have a very low systemic absorption rate.

Bottom line, compounding provides prescribers with an excellent alternative treatment modality for chronic pain patients, both early and late stage, Todd says.

Time for Compounding Consideration

IPS_SponsoredContentThat scenario sets up the perfect argument for compounding, because for one thing, doctors are seeking a new solution, with all the pressure and scrutiny they’re receiving when trying to solve people’s chronic pain problems using opioids.

Todd explains the best news about neuropathic pain treatment using compounded topical analgesic creams is the results are outstanding, both in terms of patient satisfaction in VAS pain reduction but also in reduction potentially dangerous side effects of opioids.

The main issue with some of the early topical creams created via compounding was their high costs. In the early years, compounding, which does not require FDA approval, had little oversight or controls in place. But in the past few years, the workers compensation industry began to take notice of the solid science. At the same time, medical providers also were seeing the same science and began writing more prescriptions for compounding – which also offers them a revenue stream.

This is where oversight and rigor on the part of a PBM can make a difference, Todd says.

“You don’t let that compounded drug get dispensed when you’re going to pay for it without having a chance to approve it,” Todd says.

Education is Critical

IPS_SponsoredContentAt the same time, there is the growing, and genuine, need to start educating the doctors, helping them understand how they can really deliver quality pain management to a patient without gouging the system. A good compounding specialty pharmacy network offering tight, strict rules is fundamental, Todd says. And that means one that really reaches out to work with the doctors that are writing the prescriptions. The idea is to ensure that the active ingredients being chosen aren’t the most expensive sub-components because that unnecessarily will drive the cost of overall compound “through the ceiling.”

IPS has been able to mitigate costs in the last couple years just by having good common sense approach and a lot of physician outreach. Working with DermaTran Health Solutions and its national network of compounding pharmacies, IPS has been successfully impacting the cost while not reducing the effectiveness of a compounded prescription.

In Colorado, which has cracked down on compounding profiteering, Legislative change demanded no compound could be more than $350.00 period. What is notable, in an 18-month window for one client in Colorado, IPS had 38 compound prescriptions come through the door and each had between 4 and 7 active ingredients. Through its physician education efforts, IPS brought all 38 prescriptions down 3 active ingredients or less. IPS also helped patients achieve therapeutic success (and with medical community acceptance). In that case, the cost of compound prescriptions was down to an average of $350, versus the industry average of $788. Nationwide IPS has reduced the average cost of a compound prescription to $478.00.

Todd says. “We’ve still got a way to go, but we’ve made amazing progress in just the past couple of years on the cost and effective use of compound prescriptions.”

For more information on how you can better manage your costs for compound prescriptions, please call IPS at 866-846-9279.

SponsoredContent

BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with IPS. The editorial staff of Risk & Insurance had no role in its preparation.




Integrated Prescription Solutions (IPS) is a Pharmacy Benefit Management (PBM) and Ancillary Services partner to W/C and Auto (PIP) Insurance carriers, Self Insured Employers, and Third Party Administrators who specialize in Workers Compensation benefits management.
Share this article: