3 ms·

When they hit a hospital, what is the hospital supposed to do? Not negotiate, for some "greater good" and let patients die? https://threatpost.com/ransomware-h

by SamBam 5y ago

When they hit a hospital, what is the hospital supposed to do? Not negotiate, for some "greater good" and let patients die? https://threatpost.com/ransomware-hits-hospitals-hardest/162096/ https://threatpost.com/ransomware-hits-hospitals-hardest/162...

SwanRonson 5y ago
They’re supposed to back up their data and set up proper contingencies. By failing to do so, they are already putting patients lives in the hands of the encryptors.
- SamBam 5y ago
  Yes. Of course they were supposed to do so, then. But they didn't, and now they've been hit. Now, in the real world, what are they supposed to do: pay, or hold out and let the patients die as punishment for the hospital's mistakes?
  - kortilla 5y ago
    Let the patients die. That’s on the hackers hands, not the hospital. Additionally, you’re making a huge assumption that the hackers are willing to escalate themselves to mass murders, which is a big leap most criminals aren’t willing to take.
  - squiggleblaz 5y ago
    > Of course they were supposed to do so, then. But they didn't, and now they've been hit. In order for this to be a useful tactic, there needs to be no defection. The only way there can be no defection is if the legislature prohibits defection. At that point, the hospital is on notice that they have to apply adequate security measures against this kind of attack. For instance, hospitals normally have power supplies that are capable of getting them through foreseeable blackouts. If they're going to rely on computer systems in the treatment of patients, they had better make sure they're secure. Right now, today, it isn't a surprise. And the hackers are on notice that they are effectively killing the patients. The hackers are after the money. If the threat of death will get them the money, they're all for it. If it won't, they'll move on to a country where it does work.
blindmute 5y ago
Yes.
makeitdouble 5y ago
I am sure an IRL hostage situation alrrady happened at an hospital, so we could have the answer in a variety of cases. My opinion would be the hospital should open up to the police and accept their fate whatever the outcome. The gov./police makes the calculation of the impact of X people dying a very public way, the Y amount that is requested, and the ton of other wildcards (e.g. can we catch the gang now ? after the ransom is paid ? void the ransom some way afterwards ? limit the number of death in other ways ? what will the other victims take away fom this case ?). At the end of it there should be a custom approach to that specific situation and not some blanklet policy application. This also assumes a cooperative and somewhat decent police force, which might not be the case everywhere (but then I think we're screwed anyway)

by SamBam 5y ago

SwanRonson 5y ago

They’re supposed to back up their data and set up proper contingencies. By failing to do so, they are already putting patients lives in the hands of the encryptors.

SamBam 5y ago
Yes. Of course they were supposed to do so, then. But they didn't, and now they've been hit. Now, in the real world, what are they supposed to do: pay, or hold out and let the patients die as punishment for the hospital's mistakes?
- kortilla 5y ago
  Let the patients die. That’s on the hackers hands, not the hospital. Additionally, you’re making a huge assumption that the hackers are willing to escalate themselves to mass murders, which is a big leap most criminals aren’t willing to take.
- squiggleblaz 5y ago
  > Of course they were supposed to do so, then. But they didn't, and now they've been hit. In order for this to be a useful tactic, there needs to be no defection. The only way there can be no defection is if the legislature prohibits defection. At that point, the hospital is on notice that they have to apply adequate security measures against this kind of attack. For instance, hospitals normally have power supplies that are capable of getting them through foreseeable blackouts. If they're going to rely on computer systems in the treatment of patients, they had better make sure they're secure. Right now, today, it isn't a surprise. And the hackers are on notice that they are effectively killing the patients. The hackers are after the money. If the threat of death will get them the money, they're all for it. If it won't, they'll move on to a country where it does work.

blindmute 5y ago

Yes.

makeitdouble 5y ago

I am sure an IRL hostage situation alrrady happened at an hospital, so we could have the answer in a variety of cases. My opinion would be the hospital should open up to the police and accept their fate whatever the outcome. The gov./police makes the calculation of the impact of X people dying a very public way, the Y amount that is requested, and the ton of other wildcards (e.g. can we catch the gang now ? after the ransom is paid ? void the ransom some way afterwards ? limit the number of death in other ways ? what will the other victims take away fom this case ?). At the end of it there should be a custom approach to that specific situation and not some blanklet policy application. This also assumes a cooperative and somewhat decent police force, which might not be the case everywhere (but then I think we're screwed anyway)