3 ms·

So what you're saying is that someone is going to steal the entire medical database of everyone and that's somehow going to be more "scalable" than stealing pap

So what you're saying is that someone is going to steal the entire medical database of everyone and that's somehow going to be more "scalable" than stealing paper records? If that database contained everyone's medical data it will not fit on anything that anyone non-state/non-corporate actor can aquire, and if you have state actor or corporate level of budget one could easily scale stealing paper medical records. I'm not so sure it's going to be easier to compromise super-guarded database compared to a lot of paper records, would like some hard numbers, but those are going to be hard to get.

gruez 8y ago
>If that database contained everyone's medical data it will not fit on anything that anyone non-state/non-corporate actor can aquire source? that might be the case if you're including all the high resolution imagery, but I'd imagine all the text records can't be that big. >and if you have state actor or corporate level of budget one could easily scale stealing paper medical records that would either require an operation lasting weeks/months to hit all the doctors offices (with a small crew), or hitting all tho doctors offices at the same time (huge crew). the former increases risk of detection exponentially, as someone is going to notice eventually, and once people find out, capture of your crew by the police will be inevitable. the latter is also risky because you're going to make a lot of noise assembling said crew, and one of them is going to snitch on you. in contrast, if all the records were centralized in one online database, all you'd have to do is have a small team of experienced hackers hack it from a the safety of a country with no extradition treaty. low risk of one of them snitching on you AND low risk of capture. >I'm not so sure it's going to be easier to compromise super-guarded database compared to a lot of paper records, would like some hard numbers, but those are going to be hard to get. I'm sure on an individual level, it's definitely easier to burgle a doctor's office than a super secure government database. but see last paragraph about scaleability.
- Avamander 8y ago
  > as someone is going to notice eventually That's going to be true with the database theft too. > All you'd have to do is have a small team of experienced hackers hack it from a the safety of a country with no extradition treaty I'm not so sure that's won't raise any red flags anywhere (foreign IP and possibly a lot of data being transferred). Imo it should, but we can't really know? I agree with rest of what you said though.
  - gruez 8y ago
    >That's going to be true with the database theft too. at that point, all the data is already gone. whereas with burgling doctors offices, they've been noticed within a few dozen break-ins. >I'm not so sure that's won't raise any red flags anywhere (foreign IP and possibly a lot of data being transferred). Imo it should, but we can't really know? that depends on how the system is accessed. if it's some webapp on some government intranet running off some random computer (that's also used for other stuff), then it's pretty easy to hide your tracks by compromising one of those machines. even if they have egress alerts (doubt it) it'd be pretty trivial to go for the high value to size ratio files first (text files), and exfiltrate over a long period of time.

gruez 8y ago

>If that database contained everyone's medical data it will not fit on anything that anyone non-state/non-corporate actor can aquire source? that might be the case if you're including all the high resolution imagery, but I'd imagine all the text records can't be that big. >and if you have state actor or corporate level of budget one could easily scale stealing paper medical records that would either require an operation lasting weeks/months to hit all the doctors offices (with a small crew), or hitting all tho doctors offices at the same time (huge crew). the former increases risk of detection exponentially, as someone is going to notice eventually, and once people find out, capture of your crew by the police will be inevitable. the latter is also risky because you're going to make a lot of noise assembling said crew, and one of them is going to snitch on you. in contrast, if all the records were centralized in one online database, all you'd have to do is have a small team of experienced hackers hack it from a the safety of a country with no extradition treaty. low risk of one of them snitching on you AND low risk of capture. >I'm not so sure it's going to be easier to compromise super-guarded database compared to a lot of paper records, would like some hard numbers, but those are going to be hard to get. I'm sure on an individual level, it's definitely easier to burgle a doctor's office than a super secure government database. but see last paragraph about scaleability.

Avamander 8y ago
> as someone is going to notice eventually That's going to be true with the database theft too. > All you'd have to do is have a small team of experienced hackers hack it from a the safety of a country with no extradition treaty I'm not so sure that's won't raise any red flags anywhere (foreign IP and possibly a lot of data being transferred). Imo it should, but we can't really know? I agree with rest of what you said though.
- gruez 8y ago
  >That's going to be true with the database theft too. at that point, all the data is already gone. whereas with burgling doctors offices, they've been noticed within a few dozen break-ins. >I'm not so sure that's won't raise any red flags anywhere (foreign IP and possibly a lot of data being transferred). Imo it should, but we can't really know? that depends on how the system is accessed. if it's some webapp on some government intranet running off some random computer (that's also used for other stuff), then it's pretty easy to hide your tracks by compromising one of those machines. even if they have egress alerts (doubt it) it'd be pretty trivial to go for the high value to size ratio files first (text files), and exfiltrate over a long period of time.