Red Flags Abound in 2013 Anthem Security Audit

A 2013 OPM audit found Anthem (WellPoint) had significant information security deficiencies—assets not subject to routine vulnerability scanning, lax configuration and patch management, no verifiable configuration compliance auditing, and insufficient privileged-user monitoring—and that company policies impeded external auditors; these documented weaknesses preceded a later, "sophisticated" intrusion that resulted in the theft of personal data for tens of millions of patients.