4 ms·

We stopped one healthcare ransomware what about the rest?

9 points by cws 11y ago

deleted 11y ago
[deleted]
- cws 11y ago
  The headline refers to a different narrative that comes in about the middle section of the post, where a ransomware attack on a separate healthcare org was successfully thwarted (and thereby didn't make it into any headlines)
  - DrScump 11y ago
    The wording implies (to me) that the attack was actually successful on multiple computers before it was stopped from getting all the way through. One thing about the article that concerns me, however, is that their appliance was already in place but the ransomware defense was not inherent in their product and requires an add-on product or installation ("Once our ransomware solution was deployed...").
    - cws 11y ago
      Fair enough. Preventing ransomware from getting all the way through is a worthy goal as well. The fewer files they can encrypt, the better. It's hard to stop individual users from download malware onto their own machines, but stopping that malware from moving laterally into network attached storage can mitigate a ton of damage.
    - NickBrackney 11y ago
      Hi DrScump, Author here. There's an important distinction I'd like to clear up, our product is a platform that provides monitoring across a lot of different areas and supports varied use cases. Your concerns would be valid if this was something like not having up to date definitions for a security solution. What we are teasing out here is that the product was deployed to address other business requirements (such as Citrix performance, or Network performance)and our Systems Engineers were working in conjunction with another Healthcare entity to build this solution. Seeing how critical this issue is for all of our customers they then made it available for free to other customers. If Microsoft or VMware built out runbooks for their orchestration products that met the needs of most Enterprises and gave them away for free I would hope people wouldn't see that as a limitation of their platforms but rather validation of its extensibility. We cannot account for every possible use case when we ship the product, but its awesome when we see the community and our SEs come together and build on top of the platform and extend its value.

9 points by cws 11y ago

deleted 11y ago

[deleted]

cws 11y ago
The headline refers to a different narrative that comes in about the middle section of the post, where a ransomware attack on a separate healthcare org was successfully thwarted (and thereby didn't make it into any headlines)
- DrScump 11y ago
  The wording implies (to me) that the attack was actually successful on multiple computers before it was stopped from getting all the way through. One thing about the article that concerns me, however, is that their appliance was already in place but the ransomware defense was not inherent in their product and requires an add-on product or installation ("Once our ransomware solution was deployed...").
  - cws 11y ago
    Fair enough. Preventing ransomware from getting all the way through is a worthy goal as well. The fewer files they can encrypt, the better. It's hard to stop individual users from download malware onto their own machines, but stopping that malware from moving laterally into network attached storage can mitigate a ton of damage.
  - NickBrackney 11y ago
    Hi DrScump, Author here. There's an important distinction I'd like to clear up, our product is a platform that provides monitoring across a lot of different areas and supports varied use cases. Your concerns would be valid if this was something like not having up to date definitions for a security solution. What we are teasing out here is that the product was deployed to address other business requirements (such as Citrix performance, or Network performance)and our Systems Engineers were working in conjunction with another Healthcare entity to build this solution. Seeing how critical this issue is for all of our customers they then made it available for free to other customers. If Microsoft or VMware built out runbooks for their orchestration products that met the needs of most Enterprises and gave them away for free I would hope people wouldn't see that as a limitation of their platforms but rather validation of its extensibility. We cannot account for every possible use case when we ship the product, but its awesome when we see the community and our SEs come together and build on top of the platform and extend its value.