3 ms·

> I'm pretty much at the point of thinking people need to learn how to write on paper and whiteboards again. Health IT here: won't happen. You need your CT NO

> I'm pretty much at the point of thinking people need to learn how to write on paper and whiteboards again. Health IT here: won't happen. You need your CT NOW. The patient is about to be opened. There is no time to wait for the printer and it's Sunday night. The radiologist is at home examining the data while the scanner runs. And man...security is so bad and it's so hard to convince management to invest into proper security. Also everything that breaks or even slightly slows down workflows is just unacceptable. I'm sweating hard with every wide scale attack out there expecting the next big thing to hit us. The targeted ones I just don't even want to think about.

noduerme 5y ago
Well, that's the scariest thing I've read all week. Just reading your level of stress between the lines here gives me the chills. Why is it so hard to convince them to take security seriously? Especially with hospitals, this should be a national security issue. The consequences are right in everyone's face now. In my case, an attack might be expensive, even dire, but no one would die. I know why I have a hard time pushing security reviews, they're costly and intensive and not sexy for management or investors. But things like this need to make it clear to the c-suite how quickly the wheels can come off.
- Krasnol 5y ago
  It's hard because "we've been doing it this way all the time and nothing happened" is what I hear most of the times. Most of the times I still "sneak" in improvements where I can without disturbing operations but the whole thing needs a proper overhaul and it always is, as we say here: "a dance on the razor blade". What I hear from other colleges and contractors in the sector: it doesn't look better there. I don't want to leave out that there is a certain amount of IT personal which is responsible for it too. Most of them older guys (yes...they really are all guys) who also follow the mantra I mentioned above. There is hope though...there is a certification requirement coming up here in Germany. It covers most of the basic security measures. We fail to cover a significant part of it. We've just passed one of the deadlines. Two are coming up and than there is a certification process. I've presented management with the measures we'd have to take to fulfil those. They've been ignored. The whole issue is being actively ignored or played down. The day will come when it'll be too late and I wonder what will happen. Wouldn't be surprised if I lose my job about it since somebody will have to be blamed or the certification issue will be "made to work out" somehow. Seen that happening before.

noduerme 5y ago

Well, that's the scariest thing I've read all week. Just reading your level of stress between the lines here gives me the chills. Why is it so hard to convince them to take security seriously? Especially with hospitals, this should be a national security issue. The consequences are right in everyone's face now. In my case, an attack might be expensive, even dire, but no one would die. I know why I have a hard time pushing security reviews, they're costly and intensive and not sexy for management or investors. But things like this need to make it clear to the c-suite how quickly the wheels can come off.

Krasnol 5y ago
It's hard because "we've been doing it this way all the time and nothing happened" is what I hear most of the times. Most of the times I still "sneak" in improvements where I can without disturbing operations but the whole thing needs a proper overhaul and it always is, as we say here: "a dance on the razor blade". What I hear from other colleges and contractors in the sector: it doesn't look better there. I don't want to leave out that there is a certain amount of IT personal which is responsible for it too. Most of them older guys (yes...they really are all guys) who also follow the mantra I mentioned above. There is hope though...there is a certification requirement coming up here in Germany. It covers most of the basic security measures. We fail to cover a significant part of it. We've just passed one of the deadlines. Two are coming up and than there is a certification process. I've presented management with the measures we'd have to take to fulfil those. They've been ignored. The whole issue is being actively ignored or played down. The day will come when it'll be too late and I wonder what will happen. Wouldn't be surprised if I lose my job about it since somebody will have to be blamed or the certification issue will be "made to work out" somehow. Seen that happening before.