4 ms·

Schools are pretty bad, too, who are strongly enforced by federal security policies. Recently I had an fMRI done as part of a research program at North Western

by bpchaps 11y ago

Schools are pretty bad, too, who are strongly enforced by federal security policies. Recently I had an fMRI done as part of a research program at North Western and had to sign a bunch of paperwork where it was said that my data would be secured with a best effort. Well, fast forward to last night where I was curious if their psych department had any webservers exposed to the internet, which it shouldn't. I found sip servers, printers with admin rights, routers, personal computers, etc etc etc. HIPAA hell. And that was only on three subnets and only 80/443. I sent their heads of technology an email to see if they could look into it, since I'd prefer that my data not be stolen by anyone who knows how to run wget. They closed the ticket with this: bpchaps, I believe you do have good intentions. That being said, we are already performing regular scans of our systems. If you do stumble upon anything significant, please do contact us again. :(

hodwik 11y ago
UMD has a great class where their cyber security students do pentesting on the school network for credit, simultaneously securing the network and providing a great education. http://www.cyber.umd.edu/sites/default/files/documents/symposium/SecureMD_MC2Symposium_2013.pdf http://www.cyber.umd.edu/sites/default/files/documents/sympo... Nothing to get a network admin to close a hole like an annoying undergrad stopping by your office every day, trying to get his extra credit before the semester is over.
- woodruffw 11y ago
  I'm a UMD student, and I had no idea this existed! I've been hesitant about reporting holes/vulnerabilities in the school's infrastructure until now, but it's reassuring to see that there are official channels for doing so.
- entee 11y ago
  Don't think this was around when I went there, but I'm super excited that it is. I did take a Software Engineering course while I was there that directly interacted with real-world clients and had to ship customer ready software at the end of the semester. It was intense and a fantastic learning experience. I'm biased, but they do it right at UMD. Go Terps!
Aelinsaar 11y ago
My uncle had surgery in a very well regarded hospital in the Northeast US. I visited him in one of their buildings and they were absolutely in a shambles from an IT perspective. Someone with bad intentions and a USB drive of almost any description could probably wreak havoc there.
- smegger001 11y ago
  I know of a local clinic where I live that has decided to stay on Windows XP and just told their staff "not to surf" as their way of dealing with security issues. While in the waiting room when I took my sister in for an appointment I discovered you could look around pretty much anywhere, it has no network security and the doctors computers are on the same LAN as the public unencrypted wifi.
heimatau 11y ago
I'd file a complaint with their bosses. Your privacy is important. If the tech staff won't take HIPAA seriously, their bosses better or they'll lose their job. Don't let this go, please, be proactive.
- bpchaps 11y ago
  Absolutely. I have zero interest in letting this go. :)
  - niels_olson 11y ago
    I helped build a learning management tool for our med school, even set up SSO with their AD. They scanned the hell out of us. And we had flaws. But when the dean said he wanted it on the school's domain, on their server, IT did as told. I don't know the answer. If you do interesting things, there will be bugs. And a university is full of people doing interesting things. If IT locks everything down you end up hamstrung, like the DoD often is. Another kind of pain I know all too well.
    - bpchaps 11y ago
      Oh trust me, I get it. There's definitely a middle ground, though. If you want to know locked down, my last place locked down icmp between vlans for security reasons. Ironically, it's what got me to learn nmap. It was also hell. :)
    - eru 11y ago
      We do lots of interesting things at Google. We are more secure than the average university, I believe.
  - JumpCrisscross 11y ago
    > I have zero interest in letting this go Then file a HIPAA complaint [1]. [1] http://www.hhs.gov/hipaa/filing-a-complaint/index.html http://www.hhs.gov/hipaa/filing-a-complaint/index.html
jrcii 11y ago
This makes me wonder at what point incompetent system administration becomes legal negligence.
jqm 11y ago
This job was posted in my town a few days ago. Must be able to support Server and Office 2000. http://newmexico.jobing.com/lovelace-health-system/it-support-tech/?source=indeed http://newmexico.jobing.com/lovelace-health-system/it-suppor... Is there something I don't know or is it crazy for a hospital to be using MS Server2000 in 2016?

by bpchaps 11y ago

hodwik 11y ago

UMD has a great class where their cyber security students do pentesting on the school network for credit, simultaneously securing the network and providing a great education. http://www.cyber.umd.edu/sites/default/files/documents/symposium/SecureMD_MC2Symposium_2013.pdf http://www.cyber.umd.edu/sites/default/files/documents/sympo... Nothing to get a network admin to close a hole like an annoying undergrad stopping by your office every day, trying to get his extra credit before the semester is over.

woodruffw 11y ago
I'm a UMD student, and I had no idea this existed! I've been hesitant about reporting holes/vulnerabilities in the school's infrastructure until now, but it's reassuring to see that there are official channels for doing so.
entee 11y ago
Don't think this was around when I went there, but I'm super excited that it is. I did take a Software Engineering course while I was there that directly interacted with real-world clients and had to ship customer ready software at the end of the semester. It was intense and a fantastic learning experience. I'm biased, but they do it right at UMD. Go Terps!

Aelinsaar 11y ago

My uncle had surgery in a very well regarded hospital in the Northeast US. I visited him in one of their buildings and they were absolutely in a shambles from an IT perspective. Someone with bad intentions and a USB drive of almost any description could probably wreak havoc there.

smegger001 11y ago
I know of a local clinic where I live that has decided to stay on Windows XP and just told their staff "not to surf" as their way of dealing with security issues. While in the waiting room when I took my sister in for an appointment I discovered you could look around pretty much anywhere, it has no network security and the doctors computers are on the same LAN as the public unencrypted wifi.

heimatau 11y ago

I'd file a complaint with their bosses. Your privacy is important. If the tech staff won't take HIPAA seriously, their bosses better or they'll lose their job. Don't let this go, please, be proactive.

bpchaps 11y ago
Absolutely. I have zero interest in letting this go. :)
- niels_olson 11y ago
  I helped build a learning management tool for our med school, even set up SSO with their AD. They scanned the hell out of us. And we had flaws. But when the dean said he wanted it on the school's domain, on their server, IT did as told. I don't know the answer. If you do interesting things, there will be bugs. And a university is full of people doing interesting things. If IT locks everything down you end up hamstrung, like the DoD often is. Another kind of pain I know all too well.
  - bpchaps 11y ago
    Oh trust me, I get it. There's definitely a middle ground, though. If you want to know locked down, my last place locked down icmp between vlans for security reasons. Ironically, it's what got me to learn nmap. It was also hell. :)
  - eru 11y ago
    We do lots of interesting things at Google. We are more secure than the average university, I believe.
- JumpCrisscross 11y ago
  > I have zero interest in letting this go Then file a HIPAA complaint [1]. [1] http://www.hhs.gov/hipaa/filing-a-complaint/index.html http://www.hhs.gov/hipaa/filing-a-complaint/index.html

jrcii 11y ago

This makes me wonder at what point incompetent system administration becomes legal negligence.

jqm 11y ago

This job was posted in my town a few days ago. Must be able to support Server and Office 2000. http://newmexico.jobing.com/lovelace-health-system/it-support-tech/?source=indeed http://newmexico.jobing.com/lovelace-health-system/it-suppor... Is there something I don't know or is it crazy for a hospital to be using MS Server2000 in 2016?