Insider Threats to the Military Health System: A Systematic Background Check of TRICARE West Providers

Background

To address the pandemic, the Defense Health Agency (DHA) expanded its TRICARE civilian provider network by 30.1%. In 2022, the DHA Annual Report stated that TRICARE's provider directories were only 80% accurate. Unlike Medicare, the DHA does not publicly reveal National Provider Identification (NPI) numbers. As a result, TRICARE's 9.6 million beneficiaries lack the means to verify their doctor's credentials. Since 2013, the Department of Health and Human Services' (HHS) Office of Inspector General (OIG) has excluded 17,706 physicians and other providers from federal health programs due to billing fraud, neglect, drug-related convictions, and other offenses. These providers and their NPIs are included on the OIG's List of Excluded Individuals and Entities (LEIE). Patients who receive care from excluded providers face higher risks of hospitalization and mortality.

Objective

We sought to assess the extent to which TRICARE screens health care provider names on their referral website against criminal databases.

Methods

Between January 1-31, 2023, we used TRICARE West's provider directory to search for all providers within a 5-mile radius of 798 zip codes (38 per state, ≥10,000 residents each, randomly entered). We then copied and pasted all directory results' first and last names, business names, addresses, phone numbers, fax numbers, degree types, practice specialties, and active or closed statuses into a CSV file. We cross-referenced the search results against US and state databases for medical and criminal misconduct, including the OIG-LEIE and General Services Administration's (GSA) SAM.gov exclusion lists, the HHS Office of Civil Rights Health Insurance Portability and Accountability Act (HIPAA) breach reports, 15 available state Medicaid exclusion lists (state), the International Trade Administration's Consolidated Screening List (CSL), 3 Food and Drug Administration (FDA) debarment lists, the Federal Bureau of Investigation's (FBI) list of January 6 federal defendants, and the OIG-HHS list of fugitives (FUG).

Results

Our provider search yielded 111,619 raw results; 54 zip codes contained no data. After removing 72,156 (64.65%) duplicate entries, closed offices, and non-TRICARE West locations, we identified 39,463 active provider names. Within this baseline sample group, there were 2398 (6.08%) total matches against all exclusion and sanction databases, including 2197 on the OIG-LEIE, 2311 on the GSA-SAM.gov list, 2 on the HIPAA list, 54 on the state Medicaid exclusion lists, 69 on the CSL, 3 on the FDA lists, 53 on the FBI list, and 10 on the FUG.

Conclusions

TRICARE's civilian provider roster merits further scrutiny by law enforcement. Following the National Institute of Standards and Technology 800, the DHA can mitigate privacy, safety, and security clearance threats by implementing an insider threat management model, robust enforcement of the False Claims Act, and mandatory security risk assessments. These are the views of the author, not the Department of Defense or the US government.

A Fusion Model Based on Dynamic Web Browsing Behavior Analysis for IoT Insider Threat Detection

With the wide application of Internet of things (IoT) devices in enterprises, the traditional boundary defense mechanisms are difficult to satisfy the demands of the insider threats detection. IoT insider threat detection can be more challenging, since internal employees are born with the ability to escape the deployed information security mechanism, such as firewalls and endpoint protection. In order to detect internal attacks more accurately, we can analyze users' web browsing behaviors to identify abnormal users. The existing web browsing behavior anomaly detection methods ignore the dynamic change of the web browsing behavior of the target user and the behavior consistency of the target user in its peer group, which results in a complex modeling process, low system efficiency and low detection accuracy. Therefore, the paper respectively proposes the individual user behavior model and the peer-group behavior model to characterize the abnormal dynamic change of user browsing behavior and compare the mutual behavioral inconsistency among one peer-group. Furthermore, the fusion model is presented for insider threat detection which simultaneously considers individual behavioral abnormal dynamic changes and mutual behavioral dynamic inconsistency from peers. The experimental results show that the proposed fusion model can accurately detect insider threat based on the abnormal user web browsing behaviors in the enterprise networks.

An Investigation of Insider Threat Mitigation Based on EEG Signal Classification

This study proposes a scheme to identify insider threats in nuclear facilities through the detection of malicious intentions of potential insiders using subject-wise classification. Based on electroencephalography (EEG) signals, a classification model was developed to identify whether a subject has a malicious intention under scenarios of being forced to become an insider threat. The model also distinguishes insider threat scenarios from everyday conflict scenarios. To support model development, 21-channel EEG signals were measured on 25 healthy subjects, and sets of features were extracted from the time, time–frequency, frequency and nonlinear domains. To select the best use of the available features, automatic selection was performed by random-forest-based algorithms. The k-nearest neighbor, support vector machine with radial kernel, naïve Bayes, and multilayer perceptron algorithms were applied for the classification. By using EEG signals obtained while contemplating becoming an insider threat, the subject-wise model identified malicious intentions with 78.57% accuracy. The model also distinguished insider threat scenarios from everyday conflict scenarios with 93.47% accuracy. These findings could be utilized to support the development of insider threat mitigation systems along with existing trustworthiness assessments in the nuclear industry.

Tracking the Insider Attacker: A Blockchain Traceability System for Insider Threats

The insider threats have always been one of the most severe challenges to cybersecurity. It can lead to the destruction of the organisation’s internal network system and information leakage, which seriously threaten the confidentiality, integrity and availability of data. To make matters worse, since the attacker has authorized access to the internal network, they can launch the attack from the inside and erase their attack trace, which makes it challenging to track and forensics. A blockchain traceability system for insider threats is proposed in this paper to mitigate the issue. First, this paper constructs an insider threat model of the internal network from a different perspective: insider attack forensics and prevent insider attacker from escaping. Then, we analyze why it is difficult to track attackers and obtain evidence when an insider threat has occurred. After that, the blockchain traceability system is designed in terms of data structure, transaction structure, block structure, consensus algorithm, data storage algorithm, and query algorithm, while using differential privacy to protect user privacy. We deployed this blockchain traceability system and conducted experiments, and the results show that it can achieve the goal of mitigating insider threats.

Authentication Protocol for Cloud Databases Using Blockchain Mechanism

Cloud computing has made the software development process fast and flexible but on the other hand it has contributed to increasing security attacks. Employees who manage the data in cloud companies may face insider attack, affecting their reputation. They have the advantage of accessing the user data by interacting with the authentication mechanism. The primary aim of this research paper is to provide a novel secure authentication mechanism by using Blockchain technology for cloud databases. Blockchain makes it difficult to change user login credentials details in the user authentication process by an insider. The insider is not able to access the user authentication data due to the distributed ledger-based authentication scheme. Activity of insider can be traced and cannot be changed. Both insider and outsider user’s are authenticated using individual IDs and signatures. Furthermore, the user access control on the cloud database is also authenticated. The algorithm and theorem of the proposed mechanism have been given to demonstrate the applicability and correctness.The proposed mechanism is tested on the Scyther formal system tool against denial of service, impersonation, offline guessing, and no replay attacks. Scyther results show that the proposed methodology is secure cum robust.