4 ms·

Yes Germany has both general IT guidelines and specific codes for hospitals. Also high levels of IT security are required by law for hospitals. And those standa

Yes Germany has both general IT guidelines and specific codes for hospitals. Also high levels of IT security are required by law for hospitals. And those standards, guidelines and analysis of industry sector typical problems are made publicly available by a government agency funded with tax money. However: Despite a law being in place since 2015 many hospitals are still underdeveloped when it comes to IT and IT security in particular.

linuxftw 6y ago
Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. "We met all the standards, we shouldn't be accountable." If the brakes go out on your care, and you smash into a building, even though it was recently serviced to whatever 'standards' are you liable? Yes. And then it will be up to you to pursue the manufacturer of the car, who will claim they met all standards, so they're not liable. See how it works?
- Majromax 6y ago
  > Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. And that's important. You have to have some place to draw the line between "we did nothing and we're all out of ideas" and "what do you mean you didn't write your own operating system from scratch and hire fifteen security experts to continuously analyze it for un-patched zero-day exploits?" That's where industry standard "best practices" come in. Once some sort of standard is issued (by regulation) or accepted (by industry), it becomes the thing that a Reasonable Person does. Meeting that standard is then usually sufficient to avoid charges of (or additional liability for) negligence. > If the brakes go out on your car, and you smash into a building In this case, you're liable because you carry strict liability for your actions as a driver. However, proof that you've kept the car in working order would be sufficient to escape any criminal charges (dangerous operation of a vehicle, for example)
- Jon_Lowtek 6y ago
  I would need to give you a very deep dive into how europa and germany especially handle this so you can understand it ... I often forget how different the way people think about regulations is in the USA. On the surface: There is a joint initiative of the Federal Office of Civil Protection and Disaster Assistance (BBK) and the Federal Office for Information Security (BSI) which work with domain experts to define the abstract standards for critical infrastructure. There are more specialized sets where the German Hospital Federation (DKGeV) has more influence in how to make it happen for hospitals in particular. The whole regulation is set up to focus on continuous improvement, risk management, escalation processes, investigation of breaches and the like. It is related to ISO27001, but goes beyond that. Maybe comparing it to MilSpec makes it understandable to citizens of the USA: we want our hospitals IT infrastructure to be like the navy wants its warships: made out of steel, with redundant systems and sane compartmentalization so it can withstand most attacks. And we are willing to invest billions of tax money to get our existing hospitals up to these standards, because many are like viking longboats: they stay afloat and cure disease, but they are not protected against torpedoes. A hospital looses most of its infrastructure to a some ransomware? There is an investigation by the supervisory body into the technical and organizational details of the specific security incident and they really don't care about certifications printed by some private company that claims to have audited the hospital. The expected result is a "how this hospital intents to prevent this type of incident in the future" document. These standards are not about certifications of industry sector mediocrity waved around to shift blame and win liability cases in court. Also I don't think liability cases work that way over here, but i am not a lawyer.
cortesoft 6y ago
So did the hospital violate it?
- Jon_Lowtek 6y ago
  They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere. What do you think? I don't think there is a single hospital that completely fulfills those standards. The bar is very high and the umbrella organization of hospitals says there must be millions per hospital invested to reach the requirements. In unrelated news: a new law was passed today, after years of preparation, that includes a 4.3 billion euro investment of tax money into hospital IT systems.
  - krn 6y ago
    > They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere. Wouldn't simply using a cloud-based B2B service with something like Chrome OS / Cloudready instead of Windows solve the entire problem? If that wouldn't work for data privacy or network availability reasons, it could be an open-source self-hosted server application, accessible locally only through a REST API. And the server security? Just use something like self-updating RHEL CoreOS with a bunch of isolated containers, which greatly limits the entire attack surface. > I don't think there is a single hospital that completely fulfills those standards. Why can't a single technical solution be designed and supported for all state-owned hospitals in Germany?
    - jacobush 6y ago
      The problem is not in any particular stack. It’s system design overall. All your mentioned alternatives could just as easily fail if not properly secured.
      - krn 6y ago
        > The problem is not in any particular stack. It’s system design overall. Are you aware that unlike Windows, Chromium OS has been designed from the ground up with security in mind[1]? And that it can run on almost any hardware[2]? > All your mentioned alternatives could just as easily fail if not properly secured. Software has to be designed and chosen with security in mind from the beginning. If a hospital is running Windows Server instead of automatically-updating, minimal Container Linux[3], it has a much larger attack vector space. These two factors alone (a proper client OS, and a proper server OS) can reduce the probability of a successful ransomware attack to almost zero. [1] https://www.chromium.org/chromium-os/chromiumos-design-docs/security-overview https://www.chromium.org/chromium-os/chromiumos-design-docs/... [2] https://get.neverware.com/healthcare/ https://get.neverware.com/healthcare/ [3] https://getfedora.org/en/coreos https://getfedora.org/en/coreos

linuxftw 6y ago

Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. "We met all the standards, we shouldn't be accountable." If the brakes go out on your care, and you smash into a building, even though it was recently serviced to whatever 'standards' are you liable? Yes. And then it will be up to you to pursue the manufacturer of the car, who will claim they met all standards, so they're not liable. See how it works?

Majromax 6y ago
> Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. And that's important. You have to have some place to draw the line between "we did nothing and we're all out of ideas" and "what do you mean you didn't write your own operating system from scratch and hire fifteen security experts to continuously analyze it for un-patched zero-day exploits?" That's where industry standard "best practices" come in. Once some sort of standard is issued (by regulation) or accepted (by industry), it becomes the thing that a Reasonable Person does. Meeting that standard is then usually sufficient to avoid charges of (or additional liability for) negligence. > If the brakes go out on your car, and you smash into a building In this case, you're liable because you carry strict liability for your actions as a driver. However, proof that you've kept the car in working order would be sufficient to escape any criminal charges (dangerous operation of a vehicle, for example)
Jon_Lowtek 6y ago
I would need to give you a very deep dive into how europa and germany especially handle this so you can understand it ... I often forget how different the way people think about regulations is in the USA. On the surface: There is a joint initiative of the Federal Office of Civil Protection and Disaster Assistance (BBK) and the Federal Office for Information Security (BSI) which work with domain experts to define the abstract standards for critical infrastructure. There are more specialized sets where the German Hospital Federation (DKGeV) has more influence in how to make it happen for hospitals in particular. The whole regulation is set up to focus on continuous improvement, risk management, escalation processes, investigation of breaches and the like. It is related to ISO27001, but goes beyond that. Maybe comparing it to MilSpec makes it understandable to citizens of the USA: we want our hospitals IT infrastructure to be like the navy wants its warships: made out of steel, with redundant systems and sane compartmentalization so it can withstand most attacks. And we are willing to invest billions of tax money to get our existing hospitals up to these standards, because many are like viking longboats: they stay afloat and cure disease, but they are not protected against torpedoes. A hospital looses most of its infrastructure to a some ransomware? There is an investigation by the supervisory body into the technical and organizational details of the specific security incident and they really don't care about certifications printed by some private company that claims to have audited the hospital. The expected result is a "how this hospital intents to prevent this type of incident in the future" document. These standards are not about certifications of industry sector mediocrity waved around to shift blame and win liability cases in court. Also I don't think liability cases work that way over here, but i am not a lawyer.

cortesoft 6y ago

So did the hospital violate it?

Jon_Lowtek 6y ago
They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere. What do you think? I don't think there is a single hospital that completely fulfills those standards. The bar is very high and the umbrella organization of hospitals says there must be millions per hospital invested to reach the requirements. In unrelated news: a new law was passed today, after years of preparation, that includes a 4.3 billion euro investment of tax money into hospital IT systems.
- krn 6y ago
  > They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere. Wouldn't simply using a cloud-based B2B service with something like Chrome OS / Cloudready instead of Windows solve the entire problem? If that wouldn't work for data privacy or network availability reasons, it could be an open-source self-hosted server application, accessible locally only through a REST API. And the server security? Just use something like self-updating RHEL CoreOS with a bunch of isolated containers, which greatly limits the entire attack surface. > I don't think there is a single hospital that completely fulfills those standards. Why can't a single technical solution be designed and supported for all state-owned hospitals in Germany?
  - jacobush 6y ago
    The problem is not in any particular stack. It’s system design overall. All your mentioned alternatives could just as easily fail if not properly secured.
    - krn 6y ago
      > The problem is not in any particular stack. It’s system design overall. Are you aware that unlike Windows, Chromium OS has been designed from the ground up with security in mind[1]? And that it can run on almost any hardware[2]? > All your mentioned alternatives could just as easily fail if not properly secured. Software has to be designed and chosen with security in mind from the beginning. If a hospital is running Windows Server instead of automatically-updating, minimal Container Linux[3], it has a much larger attack vector space. These two factors alone (a proper client OS, and a proper server OS) can reduce the probability of a successful ransomware attack to almost zero. [1] https://www.chromium.org/chromium-os/chromiumos-design-docs/security-overview https://www.chromium.org/chromium-os/chromiumos-design-docs/... [2] https://get.neverware.com/healthcare/ https://get.neverware.com/healthcare/ [3] https://getfedora.org/en/coreos https://getfedora.org/en/coreos