3 ms·

> Their #1 goal is saving people's lives, not messing with IT issues. Two years ago (October 2020) when COVID first started and hospitals became cyber-attack t

> Their #1 goal is saving people's lives, not messing with IT issues. Two years ago (October 2020) when COVID first started and hospitals became cyber-attack targets, all the government agencies put out guidelines for them to follow. https://www.cisa.gov/uscert/ncas/alerts/aa20-302a https://www.cisa.gov/uscert/ncas/alerts/aa20-302a As part of this, the hospital I was a sysadmin at sent me to cyber-security training. I was excited at first, it was part of a big healthcare coalition, running out of the top university in the state... And we get to the classes. Most of the people there were the CISO, VP of cyber security, etc. Our entire first day was wasted just getting people signed into the labs. Web-based VMware client, a mix of Windows and Linux virtual machines, depending on the excerise. I realize these people aren't 'hackers'. I realize all of these people don't have VMware or Linux experience. But I felt like I was walking my grandmother through creating an Amazon account. And all of these people are making 6 figures and the head of something security related at the largest hospitals in the state. Insanity. Hopefully these people have very capable staff under them. The second day, we only wasted half a day with getting people to be able to log into a VM and follow step-by-step commands. It was basic stuff, what you'd find in a 'Hacking for Dummies' book. You'd run Kali Linux and do a vulnerability 'attack', analyze some files, patch some software to it was no longer vulnerable... When we got to part that was a short C program illustrating a buffer overflow, I realized the wrong people were attending the class. I think most others did as well as you never heard another peep from the 30 people on the Zoom meeting until the very last day, asking how they could get their continued earning credits or units or whatever they are called.

pc86 5y ago
I don't find it remotely hard to believe that the skills needed to be a 'hacker' and the skills needed to run a security organization for a billion-dollar healthcare organization have zero overlap. You don't want a CISO or VP of CS to be playing around in VMware. That's got nothing to do with their job.
- rasz 5y ago
  I attended CISO course run by Uni of Washington https://www.washington.edu/research/research-centers/center-for-information-assurance-and-cybersecurity-ciac/ https://www.washington.edu/research/research-centers/center-... It was total garbage by clueless paper pushers. Main focus was on securing business agreements delegating responsibility, aka deflecting the blame. There was zero time spend on actually securing anything, it was all theatre or/and way of funneling funds to select companies from private sector (like Kronos).
  - seventhtiger 5y ago
    I wouldn't say it's the main focus, but this is an extremely valuable risk treatment. I would say it's underrated. Too many orgs go into do or die mode and try to do everything and do it poorly. Accepting risk is a liability no person in authority ever wants to sign, even if it's accepting the risk of an earth destroying comet. They will ask you to do what you can instead, when you don't have enough resources to even begin implementing the needed controls. Often in info sec governance literally the only way for us to get leadership to accept a realistic scope is to do as much risk transference as possible.

pc86 5y ago

I don't find it remotely hard to believe that the skills needed to be a 'hacker' and the skills needed to run a security organization for a billion-dollar healthcare organization have zero overlap. You don't want a CISO or VP of CS to be playing around in VMware. That's got nothing to do with their job.

rasz 5y ago
I attended CISO course run by Uni of Washington https://www.washington.edu/research/research-centers/center-for-information-assurance-and-cybersecurity-ciac/ https://www.washington.edu/research/research-centers/center-... It was total garbage by clueless paper pushers. Main focus was on securing business agreements delegating responsibility, aka deflecting the blame. There was zero time spend on actually securing anything, it was all theatre or/and way of funneling funds to select companies from private sector (like Kronos).
- seventhtiger 5y ago
  I wouldn't say it's the main focus, but this is an extremely valuable risk treatment. I would say it's underrated. Too many orgs go into do or die mode and try to do everything and do it poorly. Accepting risk is a liability no person in authority ever wants to sign, even if it's accepting the risk of an earth destroying comet. They will ask you to do what you can instead, when you don't have enough resources to even begin implementing the needed controls. Often in info sec governance literally the only way for us to get leadership to accept a realistic scope is to do as much risk transference as possible.