3 ms·

Should people in those industries have access to the outside web on the computers that have even a smidge of access to data that must be kept private by law? I'

by hehheh 10y ago

Should people in those industries have access to the outside web on the computers that have even a smidge of access to data that must be kept private by law? I'd say "no" -- I can't think of a scenario in which a healthcare device needs access to Google or hacker news or whatever. They could just use a whitelist and replace all CAs on the computer with a (set of?) private CA(s) that allow the user to do work on information that requires such security.

paulddraper 10y ago
There are internet-based patient management systems. Yes, it is possible to explicitly list all certificates you need, or you could simply use the same PK infrastructure as the rest of the world.
jcrawfordor 10y ago
Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. Basic measures like blocking webmail providers are extremely unpopular with employees and produce huge executive pushback, a whitelist approach to internet access like you propose would just be a total non-starter. Imagine if you yourself worked in that environment, where your computer could only access a few select websites because you have access to restricted information (which you almost certainly do) - I mean, most tech workers I know are deeply upset about not having local admin on their machines. What you're proposing is about a thousand steps more restrictive.
- cmiles74 10y ago
  People work in much worse conditions everyday. Most everyone I know owns a cell phone that has internet access, people can always use those. I don't think expecting people who access restricted data also using machines that lack internet access is that big a deal.
- crpatino 10y ago
  > Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. I bet 100 years ago it was considered unrealistic to tell white collar employees that they could not bring booze to the office. Today it is a firing offense in most jurisdictions. After all, people are already aware there is a distinction between their professional personna and their private self. They know there are things you do under one identity but not under the other, and viceversa. Merely adding one tiny thing to the list will do little. Sure, executives will push back. I bet they pushed back even harder when accountants told them that "No, you cannot put your stripclub bill into the corporate credit card; and I don't care if it was a business expense, either." That's the meaning of being a professional: telling the higher-ups that there are hard rules (natural or otherwise) that don't give a flying-fuck about their social status. Doctors know it, lawyers know it, accountants know it, but for some reason IT people does not seem able to figure that out. Compensation aside, the social prestige that comes with each of those professions is directly proportional to their ability (and duty) to enforce those standards regardless of what their rich and powerful bosses think about it.
  - true_religion 10y ago
    It's difficult to hold professional standards without a professional association backing you up. Doctors and lawyers would capitulate to client requests if they didn't have the backing of the professional associations, and in many times law. If you attempt to force your lawyer to violate ethics, and their document it and complain then no lawyer will work for you. If you attempt to force a doctor to violate ethics, then not only will no doctor work for you, but you might actually get jail time.
user5994461 10y ago
> Should people in those industries have access to the outside web ... They don't have it.
zaphar 10y ago
You would have to lock such machines down such that they have no direct connection to the internet and no way to get data off of them via portable disk storage. In practice this is enough of an impediment to getting actual work done that it's unrealistic. You are basically asking companies to create SKIF's. For a defense contractor working in intelligence it is often the case that they work in SKIF's provided by the Government. But in healthcare it's probably unreasonable to expect it.

by hehheh 10y ago

paulddraper 10y ago

There are internet-based patient management systems. Yes, it is possible to explicitly list all certificates you need, or you could simply use the same PK infrastructure as the rest of the world.

jcrawfordor 10y ago

Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. Basic measures like blocking webmail providers are extremely unpopular with employees and produce huge executive pushback, a whitelist approach to internet access like you propose would just be a total non-starter. Imagine if you yourself worked in that environment, where your computer could only access a few select websites because you have access to restricted information (which you almost certainly do) - I mean, most tech workers I know are deeply upset about not having local admin on their machines. What you're proposing is about a thousand steps more restrictive.

cmiles74 10y ago
People work in much worse conditions everyday. Most everyone I know owns a cell phone that has internet access, people can always use those. I don't think expecting people who access restricted data also using machines that lack internet access is that big a deal.
crpatino 10y ago
> Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. I bet 100 years ago it was considered unrealistic to tell white collar employees that they could not bring booze to the office. Today it is a firing offense in most jurisdictions. After all, people are already aware there is a distinction between their professional personna and their private self. They know there are things you do under one identity but not under the other, and viceversa. Merely adding one tiny thing to the list will do little. Sure, executives will push back. I bet they pushed back even harder when accountants told them that "No, you cannot put your stripclub bill into the corporate credit card; and I don't care if it was a business expense, either." That's the meaning of being a professional: telling the higher-ups that there are hard rules (natural or otherwise) that don't give a flying-fuck about their social status. Doctors know it, lawyers know it, accountants know it, but for some reason IT people does not seem able to figure that out. Compensation aside, the social prestige that comes with each of those professions is directly proportional to their ability (and duty) to enforce those standards regardless of what their rich and powerful bosses think about it.
- true_religion 10y ago
  It's difficult to hold professional standards without a professional association backing you up. Doctors and lawyers would capitulate to client requests if they didn't have the backing of the professional associations, and in many times law. If you attempt to force your lawyer to violate ethics, and their document it and complain then no lawyer will work for you. If you attempt to force a doctor to violate ethics, then not only will no doctor work for you, but you might actually get jail time.

user5994461 10y ago

> Should people in those industries have access to the outside web ... They don't have it.

zaphar 10y ago

You would have to lock such machines down such that they have no direct connection to the internet and no way to get data off of them via portable disk storage. In practice this is enough of an impediment to getting actual work done that it's unrealistic. You are basically asking companies to create SKIF's. For a defense contractor working in intelligence it is often the case that they work in SKIF's provided by the Government. But in healthcare it's probably unreasonable to expect it.