Healthcare Breach Investigation

# Incident response ASM protocol
INCIDENT_ID="INC-2025-HC-001"
AFFECTED_DOMAINS="healthsystem.org,patient-portal.healthsystem.org"
IR_DIR="incident_${INCIDENT_ID}_$(date +%Y%m%d_%H%M%S)"

mkdir -p "$IR_DIR"/{discovery,analysis,timeline,evidence}
cd "$IR_DIR"

# Rapid asset enumeration
echo "EMERGENCY: Rapid asset discovery initiated" | tee timeline/investigation.log

for domain in $AFFECTED_DOMAINS; do
    echo "$(date): Enumerating $domain" >> timeline/investigation.log
    
    # Fast passive discovery
    subfinder -d "$domain" -all -silent -timeout 5 > "discovery/${domain}_assets.txt"
    
    # Certificate transparency (fast)
    curl -s "https://crt.sh/?q=%.${domain}&output=json" | \
    jq -r '.[].name_value' | head -100 > "discovery/${domain}_ct.txt"
done

# Immediate live host detection
cat discovery/*_assets.txt discovery/*_ct.txt | sort -u > discovery/all_assets.txt
httpx -l discovery/all_assets.txt -silent -status-code -threads 50 > analysis/live_hosts.txt

echo "$(date): Found $(wc -l < discovery/all_assets.txt) assets, $(wc -l < analysis/live_hosts.txt) live" >> timeline/investigation.log

# Identify potential entry points
echo "$(date): Analyzing potential attack vectors" >> timeline/investigation.log

# Look for exposed admin interfaces
grep -iE "(admin|login|portal|dashboard)" analysis/live_hosts.txt > analysis/admin_interfaces.txt

# Check for vulnerable applications
grep -iE "(wordpress|drupal|joomla|jenkins|gitlab)" analysis/live_hosts.txt > analysis/vulnerable_apps.txt

# Scan for exposed databases and services
nmap -iL <(cut -d' ' -f1 analysis/live_hosts.txt) \
    -p 22,23,80,443,3306,5432,1433,3389,5900 -T4 -oN analysis/exposed_services.txt

# Look for development/test environments
grep -iE "(dev|test|staging|demo)" discovery/all_assets.txt > analysis/dev_environments.txt

echo "$(date): Attack surface analysis completed" >> timeline/investigation.log

# Correlate findings with security logs
echo "$(date): Correlating with security events" >> timeline/investigation.log

# Check for recently discovered assets
find discovery/ -name "*.txt" -mtime -7 -exec echo "Recent discovery: {}" \; >> evidence/recent_assets.log

# Identify high-risk findings
cat > analysis/high_risk_findings.txt << EOF
CRITICAL FINDINGS - INCIDENT $INCIDENT_ID

Admin Interfaces Found:
$(cat analysis/admin_interfaces.txt)

Vulnerable Applications:
$(cat analysis/vulnerable_apps.txt)

Exposed Services:
$(grep "open" analysis/exposed_services.txt)

Development Environments:
$(cat analysis/dev_environments.txt)
EOF

echo "$(date): Evidence correlation completed" >> timeline/investigation.log

# The smoking gun
echo "$(date): CRITICAL - Exposed development portal found" >> timeline/investigation.log

# Found: dev-portal.healthsystem.org
# Status: 200 OK
# Technology: WordPress 4.9.8 (vulnerable)
# Admin panel: /wp-admin/ (accessible)
# Last modified: 3 days ago (matches incident timeline)

# Evidence collection
curl -s "http://dev-portal.healthsystem.org/wp-admin/" > evidence/exposed_admin_panel.html
nmap -sV -p 80,443 dev-portal.healthsystem.org > evidence/service_fingerprint.txt

echo "$(date): Attack vector identified - dev-portal.healthsystem.org" >> timeline/investigation.log

# Generate incident timeline
cat > reports/incident_timeline.md << EOF
# Incident Timeline: $INCIDENT_ID

## T-72 hours: Development portal deployed
- dev-portal.healthsystem.org created for testing
- WordPress 4.9.8 installed with default settings
- Connected to production patient database (misconfiguration)

## T-24 hours: Initial compromise
- Automated vulnerability scanner discovers exposed admin panel
- Default credentials (admin/admin) successfully used
- Malicious plugin installed for persistent access

## T-0 hours: Data exfiltration detected
- Unusual database queries trigger monitoring alerts
- Patient records accessed and downloaded
- Security team notified

## T+2 hours: ASM investigation initiated
- Rapid asset discovery reveals forgotten development environment
- Attack vector identified within 4 hours
- Evidence preserved for forensic analysis
EOF

# Generate breach notification report
cat > reports/hipaa_notification.md << EOF
# HIPAA Breach Notification Report

**Incident ID:** $INCIDENT_ID  
**Discovery Date:** $(date -d '2 hours ago')  
**Notification Date:** $(date)  

## Breach Details
- **Affected Individuals:** 15,847
- **Types of Information:** PHI including names, SSNs, medical records
- **Cause:** Unauthorized access via exposed development environment
- **Discovery Method:** Automated monitoring alert

## Immediate Actions Taken
1. Development environment immediately secured
2. All affected systems isolated and analyzed
3. Law enforcement and HHS notified within 24 hours
4. Comprehensive security assessment initiated

## Remediation Plan
1. All development environments inventoried and secured
2. Network segmentation implemented
3. Continuous monitoring expanded
4. Staff security training enhanced
EOF

# Continuous monitoring setup
cat > scripts/healthcare_asm_monitor.sh << 'EOF'
#!/bin/bash
# Healthcare ASM continuous monitoring

DOMAINS="healthsystem.org"
ALERT_EMAIL="security@healthsystem.org"

# Daily asset discovery
subfinder -d "$DOMAINS" -all -silent > daily_assets.txt

# Compare with baseline
if [ -f baseline_assets.txt ]; then
    NEW_ASSETS=$(comm -13 baseline_assets.txt daily_assets.txt)
    if [ -n "$NEW_ASSETS" ]; then
        echo "NEW ASSETS DETECTED: $NEW_ASSETS" | \
        mail -s "URGENT: New Healthcare Assets Discovered" "$ALERT_EMAIL"
    fi
fi

# Update baseline
cp daily_assets.txt baseline_assets.txt
EOF

# Schedule monitoring
echo "0 2 * * * /path/to/healthcare_asm_monitor.sh" | crontab -