4 ms·

I remember having a conversation with someone who worked in Health Cyber Security a few years ago. They pointed out their MRI machine depended on an Windows Se

I remember having a conversation with someone who worked in Health Cyber Security a few years ago. They pointed out their MRI machine depended on an Windows Server 2K3 machine, which they didn't patch, networked on the corporate network (to access/transmit results). I asked why they couldn't patch or upgrade it, to which they responded: > "Every time we change patch or change the software configuration we need to have it re-certified before we can use it on a patient, and that takes months and $10,000's" I really hope we'll see some movement in the health security space, maybe leveraging SDN/Micro-segmentation or Identity-Aware-Proxy software like Hashicorp Boundary, but these aren't (really) zero-cost and add friction/delays to accessing the information you need about your patient... Time will tell.

dman 6y ago
Sounds like a job for kubernetes
iforgotpassword 6y ago
I recently heard a similarly scary story about a German hospital. They are still running some machines for patient data management on XP since funding for that software stopped long ago. What's especially funny is how the software is .NET based so you'd think it's less likely to break on a Windows update.... And I can't really agree with everyone solely blaming the attackers. Bad people exist. You don't leave your front door wide open when you leave your house either and then act all surprised if you get robbed. I don't really let "don't blame the victim" count here. A malware attack is not like a natural disaster that just happens. Don't build your house on quicksand. Maybe it's actually good this happens now and that it's "just" ransomware. Because maybe it raises awareness and leads to better security. Next time it might be a coordinated attack by a state actor that doesn't just have money on their mind.
raverbashing 6y ago
They have the money and the resources to lobby whoever genius orgs came out with these rules to come up with better ones.

dman 6y ago

Sounds like a job for kubernetes

iforgotpassword 6y ago

I recently heard a similarly scary story about a German hospital. They are still running some machines for patient data management on XP since funding for that software stopped long ago. What's especially funny is how the software is .NET based so you'd think it's less likely to break on a Windows update.... And I can't really agree with everyone solely blaming the attackers. Bad people exist. You don't leave your front door wide open when you leave your house either and then act all surprised if you get robbed. I don't really let "don't blame the victim" count here. A malware attack is not like a natural disaster that just happens. Don't build your house on quicksand. Maybe it's actually good this happens now and that it's "just" ransomware. Because maybe it raises awareness and leads to better security. Next time it might be a coordinated attack by a state actor that doesn't just have money on their mind.

raverbashing 6y ago

They have the money and the resources to lobby whoever genius orgs came out with these rules to come up with better ones.