4 ms·

Many people throw hospital security into the pile of "well, lots of people don't care about infosec!" In my opinion, this stance is incorrect. I've performed s

Many people throw hospital security into the pile of "well, lots of people don't care about infosec!" In my opinion, this stance is incorrect. I've performed security assessments against many different industries, including banks, large enterprise, barely-funded startups, nuclear power facilities, law firms, hospitals, and more. In each of these fields, you see the "good guys" and the "bad guys" in terms of IT security strength. In hospitals, though, the whole field is terrible. The best of the best -- high-tech facilities that actually care about security -- are still doing terribly compared to the average large enterprise. Health records are becoming more valuable, and not just because of blackmail. Insurance fraud and identity theft are feasible if you've stolen someone's health records, and the information stored within is only getting broader. Hospitals wouldn't let their medical tech slip this far. They shouldn't let their security slip, either.

shigawire 11y ago
Hospitals often let their medical tech slip and that's part of the problem. We have a hard enough time getting stuff to work, let alone securing it.
pasbesoin 11y ago
There are many forms of extortion. Until recently, health care insurance coverage and care were one primary route exercised by institutions in the U.S. (Just one example: Roll over and take it at work, or you'll lose your health care.) The ACA was supposed to help address that, but, entering its third year, I at least see significant signs of its being weakened. So... it's not just black hat bad actors. The proliferation of this data, by means legal, or gray, in addition to black, threatens a broad and diverse swath of those who have... less than perfect statistics. Not just in health care, but in general, I've observed a lot of apathy towards security because corporations and large institutions serve a very significant role in diluting responsibility and repercussions. No one person -- at least and especially and including those with actual power to deploy resources against problems -- is really on the hook. Even in the C suite. Hell, it seems that "taking the blame" has become a significant component of such roles: You parachute out, and someone picks you up to play a repeat performance a year or two down the line. No one really answers. And there is a lot of pressure -- below the surface -- to continue making this information more transparent and readily accessible. "Black hats" become a straw man for an industry that, in many respects, in the whole is actually trying to move in the opposite direction. With such discontinuity, is it any wonder that the results are a disaster?

shigawire 11y ago

Hospitals often let their medical tech slip and that's part of the problem. We have a hard enough time getting stuff to work, let alone securing it.

pasbesoin 11y ago

There are many forms of extortion. Until recently, health care insurance coverage and care were one primary route exercised by institutions in the U.S. (Just one example: Roll over and take it at work, or you'll lose your health care.) The ACA was supposed to help address that, but, entering its third year, I at least see significant signs of its being weakened. So... it's not just black hat bad actors. The proliferation of this data, by means legal, or gray, in addition to black, threatens a broad and diverse swath of those who have... less than perfect statistics. Not just in health care, but in general, I've observed a lot of apathy towards security because corporations and large institutions serve a very significant role in diluting responsibility and repercussions. No one person -- at least and especially and including those with actual power to deploy resources against problems -- is really on the hook. Even in the C suite. Hell, it seems that "taking the blame" has become a significant component of such roles: You parachute out, and someone picks you up to play a repeat performance a year or two down the line. No one really answers. And there is a lot of pressure -- below the surface -- to continue making this information more transparent and readily accessible. "Black hats" become a straw man for an industry that, in many respects, in the whole is actually trying to move in the opposite direction. With such discontinuity, is it any wonder that the results are a disaster?