5 ms·

The only good thing from this is that hospitals are waking up to the dangers of having weak digital security. Sadly this is the only way of having people invest

The only good thing from this is that hospitals are waking up to the dangers of having weak digital security. Sadly this is the only way of having people invest more in security...

whatatita 6y ago
Unfortunately, so many of the effected hospitals and health practitioners don't really understand the implications of a ransomware attack, the correct public disclosure process, or how to improve their security afterwards. Many hospitals hire a "cyber security expert" to upgrade their system and end up paying a small fortune. There's a budding hospital cyber sales industry more than happy to fleece these institutions.
- officialchicken 6y ago
  They understand fully well, and in fact purposefully do nothing. They've had over a decade of warning and similar incidents. Like all overpaid consultants, they exist as scapegoats for executives who make decisions with sub-optimal results.
tsujamin 6y ago
I remember having a conversation with someone who worked in Health Cyber Security a few years ago. They pointed out their MRI machine depended on an Windows Server 2K3 machine, which they didn't patch, networked on the corporate network (to access/transmit results). I asked why they couldn't patch or upgrade it, to which they responded: > "Every time we change patch or change the software configuration we need to have it re-certified before we can use it on a patient, and that takes months and $10,000's" I really hope we'll see some movement in the health security space, maybe leveraging SDN/Micro-segmentation or Identity-Aware-Proxy software like Hashicorp Boundary, but these aren't (really) zero-cost and add friction/delays to accessing the information you need about your patient... Time will tell.
- dman 6y ago
  Sounds like a job for kubernetes
- iforgotpassword 6y ago
  I recently heard a similarly scary story about a German hospital. They are still running some machines for patient data management on XP since funding for that software stopped long ago. What's especially funny is how the software is .NET based so you'd think it's less likely to break on a Windows update.... And I can't really agree with everyone solely blaming the attackers. Bad people exist. You don't leave your front door wide open when you leave your house either and then act all surprised if you get robbed. I don't really let "don't blame the victim" count here. A malware attack is not like a natural disaster that just happens. Don't build your house on quicksand. Maybe it's actually good this happens now and that it's "just" ransomware. Because maybe it raises awareness and leads to better security. Next time it might be a coordinated attack by a state actor that doesn't just have money on their mind.
- raverbashing 6y ago
  They have the money and the resources to lobby whoever genius orgs came out with these rules to come up with better ones.
FreshFries 6y ago
I've done my fair share of dealing with IT in hospitals and the single biggest source of "none compliancy" I came across was based on the ridicules power doctors yield. They're still treat like Demi G-ds and can and do demand password-less access since they can not be bothered with anything that is not billable, err, in the patient's best interest. The amount of unpatched crappola, the self bought software, of alternative inbound connectivity and hugely expensive machines from well known vendors without even the slightest form of IT security is mind boggling. Add to that the horrendous state of "digital health" which is in its core based on standards like HL7, makes me 100& sure that what we are seeing now it just the humble beginnings.

The only good thing from this is that hospitals are waking up to the dangers of having weak digital security. Sadly this is the only way of having people invest more in security...

whatatita 6y ago

Unfortunately, so many of the effected hospitals and health practitioners don't really understand the implications of a ransomware attack, the correct public disclosure process, or how to improve their security afterwards. Many hospitals hire a "cyber security expert" to upgrade their system and end up paying a small fortune. There's a budding hospital cyber sales industry more than happy to fleece these institutions.

officialchicken 6y ago
They understand fully well, and in fact purposefully do nothing. They've had over a decade of warning and similar incidents. Like all overpaid consultants, they exist as scapegoats for executives who make decisions with sub-optimal results.

tsujamin 6y ago

I remember having a conversation with someone who worked in Health Cyber Security a few years ago. They pointed out their MRI machine depended on an Windows Server 2K3 machine, which they didn't patch, networked on the corporate network (to access/transmit results). I asked why they couldn't patch or upgrade it, to which they responded: > "Every time we change patch or change the software configuration we need to have it re-certified before we can use it on a patient, and that takes months and $10,000's" I really hope we'll see some movement in the health security space, maybe leveraging SDN/Micro-segmentation or Identity-Aware-Proxy software like Hashicorp Boundary, but these aren't (really) zero-cost and add friction/delays to accessing the information you need about your patient... Time will tell.

dman 6y ago
Sounds like a job for kubernetes
iforgotpassword 6y ago
I recently heard a similarly scary story about a German hospital. They are still running some machines for patient data management on XP since funding for that software stopped long ago. What's especially funny is how the software is .NET based so you'd think it's less likely to break on a Windows update.... And I can't really agree with everyone solely blaming the attackers. Bad people exist. You don't leave your front door wide open when you leave your house either and then act all surprised if you get robbed. I don't really let "don't blame the victim" count here. A malware attack is not like a natural disaster that just happens. Don't build your house on quicksand. Maybe it's actually good this happens now and that it's "just" ransomware. Because maybe it raises awareness and leads to better security. Next time it might be a coordinated attack by a state actor that doesn't just have money on their mind.
raverbashing 6y ago
They have the money and the resources to lobby whoever genius orgs came out with these rules to come up with better ones.

FreshFries 6y ago

I've done my fair share of dealing with IT in hospitals and the single biggest source of "none compliancy" I came across was based on the ridicules power doctors yield. They're still treat like Demi G-ds and can and do demand password-less access since they can not be bothered with anything that is not billable, err, in the patient's best interest. The amount of unpatched crappola, the self bought software, of alternative inbound connectivity and hugely expensive machines from well known vendors without even the slightest form of IT security is mind boggling. Add to that the horrendous state of "digital health" which is in its core based on standards like HL7, makes me 100& sure that what we are seeing now it just the humble beginnings.