3 ms·

That makes me wonder whether the usual malware came from phishing or vulnerabilities. If it's phishing, typical staff clicking suspicious emails and opening UR

That makes me wonder whether the usual malware came from phishing or vulnerabilities. If it's phishing, typical staff clicking suspicious emails and opening URLs and attachments, there isn't a lot the hospital can do to stop it. A bit of blocking around external emails and shady attachments will help, but people will still fall for it quite often. If it's remote vulnerabilities, probably some unpatched systems, it's risky because that could parallelize the whole hospital anytime, but as long as the vulnerability is patched by the ransomware it's still cheaper than doing the maintenance.

wcip 7y ago
>If it's phishing, typical staff clicking every suspicious email uncarefully opening URLs and attachments, there isn't a lot the hospital can do. Not give typical staff the user permissions required to encrypt all the databases and delete the backups? Too bad info sec is so full of snake oil salesmen, obvious practical solutions exist for these type of problems they just generally don't involve spending six figures on a product so nobody is interested in them.
nradov 7y ago
The impact of staff clicking suspicious emails can be almost entirely eliminated by severely restricting user permissions. Only a special set of administrator accounts should be allowed to execute untrusted binaries. Regular users can only run trusted whitelisted applications.