3 ms·

> Technically, profit tends to be the #1 goal, at least in the US. Consequentially, this also drives a lack of investment in cybersecurity. UK's hospitals fare

> Technically, profit tends to be the #1 goal, at least in the US. Consequentially, this also drives a lack of investment in cybersecurity. UK's hospitals fare no better in terms of cybersecurity. This is about the culture of nursing / doctors / hospital administrators, which is largely shared between USA and UK. This isn't a systemic issue that is solved by nationalizing health care like UK did. USA health care system, culturally, is about saving lives. Whether our system matches it is another story. But the underlying people largely do the right thing. ------ I think the systemic issues regarding health care / infrastructure / investments are wholly independent of this cybersecurity issue.

MattGaiser 5y ago
In that case it is a culture of low salaries and tech being a support function. Governments aren't paying market salaries for tech and are not willing to have highly technical people in many leadership roles.
- pc86 5y ago
  Many governments aren't willing to have highly technical people in any leadership roles. I've worked with government IT departments before where 100% of management (not an exaggeration) was non-technical, as in had never been a developer, sys admin, or any type of engineer. From the front line managers the whole way up to the "CIO."
  - MattGaiser 5y ago
    Oh I get it. I was a government dev too and sometimes (I went through 3 managers in a year once) we had non-technical management too.
cromka 5y ago
> USA health care system, culturally, is about saving lives. With all respect, but for someone who had lived in the US after moving from EU, I'd say it's first and foremost about making money. It saves lives where saving is needed, but I'd argue vast majority of cases are outpatient and the culture is strikingly blunt about milking the patient.
- bumby 5y ago
  If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? E.g., is there evidence that a large non-profit healthcare system like the VA is substantially better at cybersecurity? While profit no doubt impacts the decisions, it doesn't appear to be the primary driver of cybersecurity lapses.
  - Taywee 5y ago
    I wouldn't. Both goals of maximizing profit and achieving a goal on a minimal possible budget end up cutting costs in places that aren't immediate blockers, where security lies. In my experience, security is a focus at places, either non-profit or otherwise, in one of the following situations: * The organization has one or more squeaky wheel employees that force everybody else to consider security where they wouldn't otherwise. * The organization or another in the same industry has already had a very painful security breach. * Security itself is part of the selling point. Non profits are slightly different, but they still experience many of the same problems because the goal is still getting the most done on the budget you've got.
    - bumby 5y ago
      Yeah, I can see that. I think you’re right. But that feels more to the "cultural" point (i.e., different perspectives having different priorities) than the specific claim specifically that "profits" are the driver.
  - deleted 5y ago
    [deleted]
  - cromka 5y ago
    > If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? I will respond to that partially: where profit is not a primary motive, i.e. in countries where healthcare is public, it tends to be centralized on federal or regional level, and, as such, much of the IT and cybersecurity is a lower, shared cost incurred by the government. Taking my native Poland as an example, there is a single country-wide portal available for patients (http://pacjent.gov.pl http://pacjent.gov.pl), as well as a single, centralized API for doctor/hospital software (https://cez.gov.pl/interoperacyjnosc/interfejsy/ https://cez.gov.pl/interoperacyjnosc/interfejsy/) and a bunch of helper systems (https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-asystentow-medycznych-ram/ https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-as...). Naturally hospitals would have their own 3rd party systems, etc., but the tendency is to unify everything, which logically reduces number of attack vectors. Hopefully someone with a better experience in the field can attest to that.
renewiltord 5y ago
The US healthcare system cannot be primarily about saving jobs or the AMA would not have ever lobbied to restrict residencies to prevent a glut of doctors. Since the AMA is an organization of medical professionals, one must conclude that it reflects their position: protectionism for their field.
- alisonkisk 5y ago
3maj 5y ago
There is a lack of cybersecurity investments in almost every industry. The issue is that the executives making the decisions 1) Usually aren't knowledgable about CyberSec and 2) don't justify the investment because it's not something they can physically point at and take credit for. .
- atmosx 5y ago
  The "economist" proposed a solution: tire cyber-security incidents to the stock market. The approach proposed was something akin to "have someone count and display the incidents of each company and blast radius". I'm not sure if this would actually work.
  - tremon 5y ago
    The other capitalist option is to make cybersecurity insurance mandatory, and impose high fees both to reimburse victims and to some government watchdog/agency (yes, government watchdogs and capitalism can co-exist). Then, it will be in the insurer's best interest to have clients with adequate cybersecurity implementations, and the market can sort it out. At the same time, we should make sure that any insurance company that chooses to pay the criminals instead loses their license to operate.
    - mr_toad 5y ago
      I think that the moral hazard associated with insurance would just make the problem worse.
deleted 5y ago
[deleted]

MattGaiser 5y ago

In that case it is a culture of low salaries and tech being a support function. Governments aren't paying market salaries for tech and are not willing to have highly technical people in many leadership roles.

pc86 5y ago
Many governments aren't willing to have highly technical people in any leadership roles. I've worked with government IT departments before where 100% of management (not an exaggeration) was non-technical, as in had never been a developer, sys admin, or any type of engineer. From the front line managers the whole way up to the "CIO."
- MattGaiser 5y ago
  Oh I get it. I was a government dev too and sometimes (I went through 3 managers in a year once) we had non-technical management too.

cromka 5y ago

> USA health care system, culturally, is about saving lives. With all respect, but for someone who had lived in the US after moving from EU, I'd say it's first and foremost about making money. It saves lives where saving is needed, but I'd argue vast majority of cases are outpatient and the culture is strikingly blunt about milking the patient.

bumby 5y ago
If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? E.g., is there evidence that a large non-profit healthcare system like the VA is substantially better at cybersecurity? While profit no doubt impacts the decisions, it doesn't appear to be the primary driver of cybersecurity lapses.
- Taywee 5y ago
  I wouldn't. Both goals of maximizing profit and achieving a goal on a minimal possible budget end up cutting costs in places that aren't immediate blockers, where security lies. In my experience, security is a focus at places, either non-profit or otherwise, in one of the following situations: * The organization has one or more squeaky wheel employees that force everybody else to consider security where they wouldn't otherwise. * The organization or another in the same industry has already had a very painful security breach. * Security itself is part of the selling point. Non profits are slightly different, but they still experience many of the same problems because the goal is still getting the most done on the budget you've got.
  - bumby 5y ago
    Yeah, I can see that. I think you’re right. But that feels more to the "cultural" point (i.e., different perspectives having different priorities) than the specific claim specifically that "profits" are the driver.
- deleted 5y ago
  [deleted]
- cromka 5y ago
  > If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? I will respond to that partially: where profit is not a primary motive, i.e. in countries where healthcare is public, it tends to be centralized on federal or regional level, and, as such, much of the IT and cybersecurity is a lower, shared cost incurred by the government. Taking my native Poland as an example, there is a single country-wide portal available for patients (http://pacjent.gov.pl http://pacjent.gov.pl), as well as a single, centralized API for doctor/hospital software (https://cez.gov.pl/interoperacyjnosc/interfejsy/ https://cez.gov.pl/interoperacyjnosc/interfejsy/) and a bunch of helper systems (https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-asystentow-medycznych-ram/ https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-as...). Naturally hospitals would have their own 3rd party systems, etc., but the tendency is to unify everything, which logically reduces number of attack vectors. Hopefully someone with a better experience in the field can attest to that.

renewiltord 5y ago

The US healthcare system cannot be primarily about saving jobs or the AMA would not have ever lobbied to restrict residencies to prevent a glut of doctors. Since the AMA is an organization of medical professionals, one must conclude that it reflects their position: protectionism for their field.

alisonkisk 5y ago

3maj 5y ago

There is a lack of cybersecurity investments in almost every industry. The issue is that the executives making the decisions 1) Usually aren't knowledgable about CyberSec and 2) don't justify the investment because it's not something they can physically point at and take credit for. .

atmosx 5y ago
The "economist" proposed a solution: tire cyber-security incidents to the stock market. The approach proposed was something akin to "have someone count and display the incidents of each company and blast radius". I'm not sure if this would actually work.
- tremon 5y ago
  The other capitalist option is to make cybersecurity insurance mandatory, and impose high fees both to reimburse victims and to some government watchdog/agency (yes, government watchdogs and capitalism can co-exist). Then, it will be in the insurer's best interest to have clients with adequate cybersecurity implementations, and the market can sort it out. At the same time, we should make sure that any insurance company that chooses to pay the criminals instead loses their license to operate.
  - mr_toad 5y ago
    I think that the moral hazard associated with insurance would just make the problem worse.

deleted 5y ago

[deleted]