7 ms·

Hospitals are incredibly important services that has under-invested into cybersecurity. A lot of medical devices are on very old systems (Windows XP) with no up

• thr0wawayf00 5y ago
  > Their #1 goal is saving people's lives, not messing with IT issues Technically, profit tends to be the #1 goal, at least in the US. Consequentially, this also drives a lack of investment in cybersecurity. Also, US hospitals have some of the most opaque pricing and billing processes of any industry that I can think of, which makes it much easier for them to recoup losses from patients that can't pay by shifting those costs onto the insurance provider and other patients who can pay. This is one of the reasons why basic things like bandages cost so much in an ER. Despite efforts to bring transparency to medical billing, hospitals are still resisting the push to publish pricing and explain their business models in more detail. We've become so culturally desensitized to the state of US healthcare that we're now just defending it as "we really can't expect hospitals to do any better than they are right now", and that kind of apathy really scares me. As the healthcare sector continues to be consumed by private equity, I don't expect to see the situation to improve. Again, it's all about profit, saving lives is secondary.
  • dragontamer 5y ago
    > Technically, profit tends to be the #1 goal, at least in the US. Consequentially, this also drives a lack of investment in cybersecurity. UK's hospitals fare no better in terms of cybersecurity. This is about the culture of nursing / doctors / hospital administrators, which is largely shared between USA and UK. This isn't a systemic issue that is solved by nationalizing health care like UK did. USA health care system, culturally, is about saving lives. Whether our system matches it is another story. But the underlying people largely do the right thing. ------ I think the systemic issues regarding health care / infrastructure / investments are wholly independent of this cybersecurity issue.
    • MattGaiser 5y ago
      In that case it is a culture of low salaries and tech being a support function. Governments aren't paying market salaries for tech and are not willing to have highly technical people in many leadership roles.
      • pc86 5y ago
        Many governments aren't willing to have highly technical people in any leadership roles. I've worked with government IT departments before where 100% of management (not an exaggeration) was non-technical, as in had never been a developer, sys admin, or any type of engineer. From the front line managers the whole way up to the "CIO."
        • MattGaiser 5y ago
          Oh I get it. I was a government dev too and sometimes (I went through 3 managers in a year once) we had non-technical management too.
    • cromka 5y ago
      > USA health care system, culturally, is about saving lives. With all respect, but for someone who had lived in the US after moving from EU, I'd say it's first and foremost about making money. It saves lives where saving is needed, but I'd argue vast majority of cases are outpatient and the culture is strikingly blunt about milking the patient.
• tyingq 5y ago
  It's not the main problem, but one problem with Hospital IT is doctors making IT decisions. I hear from others there's a similar problem with IT around lawyers.
  • dragontamer 5y ago
    There's a bit of responsibility from us IT / cybersecurity folks. Our system is setup that we defend the networks we've been assigned to. The greater cultural problems are someone else's problem. We don't actually look outside of our own networks. Hospitals getting hacked? Well, that's sad, but not our problem. Not until they pay us at least. ------ Granted, I'm not sure what we _should_ be doing about this issue. But at least acknowledging our current culture would be a step forward. Good IT security comes from the top, from a culture of security.
    • deleted 5y ago
      [deleted]
    • p_l 5y ago
      Some of that is due to being told to not touch them. There's strong cultural memory of safety, security, or just sound planning being thrown out by non-IT people, till even new hires quickly start getting instinct to bunker down.
  • bluedino 5y ago
    Hospitals have terrible budgets. There's never money to buy anything. Doctors make big salaries, but there's so much administrator bloat, it's similar to colleges.
    • wongarsu 5y ago
      If they can afford both administration bloat, then the money is clearly there. I'm not sure I can pity them for spending their money unwisely.
  • blackearl 5y ago
    People who are in highly educated fields but aren't IT adjacent somehow get that idea that computers are not that difficult. Doing IT for doctors and lawyers is usually frustrating.
• wayoutthere 5y ago
  Our hospital system is actively collapsing right now. They have chronically underinvested in “run the business” activities and taken any capital out of the system through buybacks and large capital expense budgets for building new facilities. I don’t see any way out of this crisis other than public ownership of hospitals — or a lot fewer hospitals and a lot more people dying at home or in the street because the system was too broken to care for them. Knowing this country, I’m sad that this choice is likely a foregone conclusion.
  • dragontamer 5y ago
    We don't have enough nurses/doctors to open new hospitals. It doesn't matter how much money is in the business if there's simply not enough nurses/doctors to go around.
    • wayoutthere 5y ago
      We only don’t have enough doctors and nurses because many have simply left healthcare entirely due to the low pay, impossible conditions and how the administrative tasks of the hospital were being placed on doctors and nurses in addition to their existing jobs with no additional pay. This is all while hospital systems were doing large dividends and share buybacks to extract capital and return it to shareholders. That’s a perfectly fine business model for a manufacturing plant, but we have to ask if that for-profit model makes sense for health care. With a public system, you can just decide to pay doctors and nurses more until you actually have enough of them to run the system. You can make cost / service level trade-offs intentionally rather than “how much capital can we extract before the whole thing collapses”?
      • dragontamer 5y ago
        Doctors are one of the highest paid professions. Nursed are well paid but arguably should be paid more, they're regularly reaching 6 figure salary.
        • throwthere 5y ago
• everforward 5y ago
  I'm not even sure that hospitals are under-investing in security so much as that the current security paradigms are dysfunctional for hospitals (and a few other key industries). The current security paradigm includes a lot of rapid adjustment. Upgrade this package immediately, ship a new binary using an upgraded library, firewall this off right now, etc. I think that might be fundamentally incompatible with an environment where downtime can be counted in human lives. The risk calculations are a lot harder when death is a potential outcome of downtime caused by upgrades. I don't have a magic bullet solution to that, but I do think that gets lost in a lot of the armchair security discussions around hospitals. They operate under very different expectations than the rest of us.
  • Retric 5y ago
    Yes, we should in theory have an option for a completely secure platform for such critical infrastructure. Several attempts at creating such systems have been made in the past, but little effort has been put into actually leveraging them in the wider world.
  • mjevans 5y ago
    Pay for university professors to be experts in maintaining this civil infrastructure, for the maintenance of the commons. Reward bounties to students and volunteers who triage and resolve issues. Have an expressly stated set of goals about the above as well as a core set of stable priority maintained software that gets extra security vetting. Formal analysis, whole classes of students in different locations scrutinizing and learning every line of code, function, and the overall design. Formal validation where possible.
    • wins32767 5y ago
      Have you seen the kind of code professors write?
• bluedino 5y ago
  > Their #1 goal is saving people's lives, not messing with IT issues. Two years ago (October 2020) when COVID first started and hospitals became cyber-attack targets, all the government agencies put out guidelines for them to follow. https://www.cisa.gov/uscert/ncas/alerts/aa20-302a https://www.cisa.gov/uscert/ncas/alerts/aa20-302a As part of this, the hospital I was a sysadmin at sent me to cyber-security training. I was excited at first, it was part of a big healthcare coalition, running out of the top university in the state... And we get to the classes. Most of the people there were the CISO, VP of cyber security, etc. Our entire first day was wasted just getting people signed into the labs. Web-based VMware client, a mix of Windows and Linux virtual machines, depending on the excerise. I realize these people aren't 'hackers'. I realize all of these people don't have VMware or Linux experience. But I felt like I was walking my grandmother through creating an Amazon account. And all of these people are making 6 figures and the head of something security related at the largest hospitals in the state. Insanity. Hopefully these people have very capable staff under them. The second day, we only wasted half a day with getting people to be able to log into a VM and follow step-by-step commands. It was basic stuff, what you'd find in a 'Hacking for Dummies' book. You'd run Kali Linux and do a vulnerability 'attack', analyze some files, patch some software to it was no longer vulnerable... When we got to part that was a short C program illustrating a buffer overflow, I realized the wrong people were attending the class. I think most others did as well as you never heard another peep from the 30 people on the Zoom meeting until the very last day, asking how they could get their continued earning credits or units or whatever they are called.
  • pc86 5y ago
    I don't find it remotely hard to believe that the skills needed to be a 'hacker' and the skills needed to run a security organization for a billion-dollar healthcare organization have zero overlap. You don't want a CISO or VP of CS to be playing around in VMware. That's got nothing to do with their job.
    • rasz 5y ago
      I attended CISO course run by Uni of Washington https://www.washington.edu/research/research-centers/center-for-information-assurance-and-cybersecurity-ciac/ https://www.washington.edu/research/research-centers/center-... It was total garbage by clueless paper pushers. Main focus was on securing business agreements delegating responsibility, aka deflecting the blame. There was zero time spend on actually securing anything, it was all theatre or/and way of funneling funds to select companies from private sector (like Kronos).
• chapium 5y ago
  Medical devices running windows 7 or earlier are not allowed on networks anywhere. These devices connect through serial and are accessed over terminal servers. The terminal servers are the vulnerable point.
• atmosx 5y ago
  > Ex: When REvil accidentally hacked an oil-pipeline (instead of a more passive target), the blowback was so severe that REvil disbanded and ran away. It caused an international incident, to the point where Russia has caught the attackers and is offering them up to the USA as a peace offering. On a similar vein: Hackers Apologize to Arab Royal Families for Leaking Their Data https://www.vice.com/en/article/n7nw8m/conti-ransomware-hackers-apologize-to-arab-royal-families-for-leaking-their-data https://www.vice.com/en/article/n7nw8m/conti-ransomware-hack...
• mindslight 5y ago
  > At some point, it becomes more efficient to go after the hackers, rather than trying to defend every single Hospital. I'm sorry, but this is completely backwards. It implies some global authority over communications, which is complete opposite of the Internet environment of communication in spite of hostile noise. Yeah sure it seems mighty cool that the US can pressure Russia to go after a notable group and shut them down. But thinking that can scale up to eliminating "Internet crime" is hopelessly naive. Unless we want to end up with a globally surveilled permission-required network where every node needs some associated identity, as well as making people even more liable for security failings (when their identity gets used as a proxy to attack others), it's a non-starter. What needs to happy is that hospitals, every business, and really every individual needs to develop a small sense of network security. This is akin to how everybody has developed a basic intuition about electricity - ie don't touch it unless you know what you're doing or you will get shocked, start a fire, and/or die. The Internet is a multi-actor environment and connecting your stuff to a multi-actor environment is not free. If you want to avoid increasing the cost, knowing what you're doing can be simply consist of avoiding networked devices, getting explicitly security support and indemnification from the manufacturer, etc. The current culture of just plugging whatever in, proclaiming "works for me!", and then promptly forgetting there could be other implications is what's not sustainable.
• bumby 5y ago
  >What is rather unfortunate, is that we put more importance to our oil-infrastructure than our hospital infrastructure. Just conjecture here, but this may be because the healthcare system is more resilient. Even as bad as it is, disruption to the healthcare system in these attacks is more local and more easily addressed by load shifting. Contrast that to oil infrastructure which may have more single points of failure as well as being more interconnected to the economy as a whole.
• 908B64B197 5y ago
  > Hospitals are why I don't "blame" underinvestment into cybersecurity. Their #1 goal is saving people's lives, not messing with IT issues. You want hospitals to be paying for important equipment, important people, important skills. The whole IT part is just supporting the administrative tasks. And yet everything crumbles and collapses when there's an IT outage. How interesting. These organizations might not be culturally accustomed to have IT at the core of their business/mission, but it very much is. They might not value engineering skills and people in IT, but they have evolved an absolute dependency on those over the years. The issue here is cultural, not technical. These randsomware attacks, breaches and outages are completely self-imposed. They can end anytime as soon as the hospital wants it. All they have to do is value and acknowledge IT as a fundamental pillar of their organization. Else the cycle will endlessly repeat itself.
• dehrmann 5y ago
  > Their #1 goal is saving people's lives, not messing with IT issues. If you're going to adopt a new tool, you maintain it. They seem to sterilize scalpels just fine, so they should be able to maintain second-order tools, too.
• mulmen 5y ago
  I worked in hospital IT for a short time. A lot of the Windows XP machines are connected to that life-saving equipment and that is why there is no upgrade path. Putting administrators on a modern Windows is easy.
• xorcist 5y ago
  > Hospitals are incredibly important services that has under-invested into cybersecurity You can't "invest" yourself to become secure. In theory, perhaps, but it's going to cost you through the nose and beyond. Reasonable security is reall very cheap, but involves saying "no" a lot. That's not something most organizations are very good at, so there's this whole cottage industry thriving on the promise that you don't have to if you buy a lot of expensive products instead. This comment may seem flippant, but beneath that thin veneer it's completely serious. It's not primarily a question of money. No amount of money can upgrade an infrastructure in place to be secure.