3 ms·
Everyone blaming the hospital for mismanaged IT is missing a couple things: 1) Hospitals are usually swiss cheese in terms of vulnerabilities because patient s
by waihtis 6y ago
Everyone blaming the hospital for mismanaged IT is missing a couple things:
1) Hospitals are usually swiss cheese in terms of vulnerabilities because patient safety overrules most security issues. It’s very difficult to patch in time
2) Hospitals tend to have a tricky network and asset profile with security staff potentially inheriting decades of unmapped custom IT
3) Theyre usually underresourced and overworked
- unnouinceput 6y agoFrom January, when management became aware of this particular vulnerability, until September I'd say is more then enough time make a patch. Management can and should be liable just as the attackers. IMO there is no difference, in this case, between them two parties.
- sitic 6y agoApparently a lot of systems were backdoored in January (exploits were available before the patches), so even if the patches were installed right away the backdoor is still there [1]. The malware hackers are now slowly processing their long list of compromised systems. [1] https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019...
- wobblykiwi 6y agoSo I get that the vulnerability should have been patched, but to say that management and the attackers are no different is quite frankly disgusting and a very dangerous thought to have. The attackers clearly had an intent to harm, even if financially, and to lump managers in with them as if they were the ones purposefully breaking the law is unconscionable. Negligent? Yes, perhaps, we don't know the facts. But criminal? Absolutely not.
- unnouinceput 6y agoYes, it is criminal, defined by law. It's called manslaughter.
- srtjstjsj 6y ago4) It's all proprietary incompatible forced-obsolence junk because the government doesn't mandate free software and open prorocols for healthcare.
- pacamara619 6y agoOh yeah, so it's noone's fault again. Just a software problem, no one saw it coming, nothing could be done!