3 ms·

If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity s

by bumby 5y ago

If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? E.g., is there evidence that a large non-profit healthcare system like the VA is substantially better at cybersecurity? While profit no doubt impacts the decisions, it doesn't appear to be the primary driver of cybersecurity lapses.

Taywee 5y ago
I wouldn't. Both goals of maximizing profit and achieving a goal on a minimal possible budget end up cutting costs in places that aren't immediate blockers, where security lies. In my experience, security is a focus at places, either non-profit or otherwise, in one of the following situations: * The organization has one or more squeaky wheel employees that force everybody else to consider security where they wouldn't otherwise. * The organization or another in the same industry has already had a very painful security breach. * Security itself is part of the selling point. Non profits are slightly different, but they still experience many of the same problems because the goal is still getting the most done on the budget you've got.
- bumby 5y ago
  Yeah, I can see that. I think you’re right. But that feels more to the "cultural" point (i.e., different perspectives having different priorities) than the specific claim specifically that "profits" are the driver.
deleted 5y ago
[deleted]
cromka 5y ago
> If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? I will respond to that partially: where profit is not a primary motive, i.e. in countries where healthcare is public, it tends to be centralized on federal or regional level, and, as such, much of the IT and cybersecurity is a lower, shared cost incurred by the government. Taking my native Poland as an example, there is a single country-wide portal available for patients (http://pacjent.gov.pl http://pacjent.gov.pl), as well as a single, centralized API for doctor/hospital software (https://cez.gov.pl/interoperacyjnosc/interfejsy/ https://cez.gov.pl/interoperacyjnosc/interfejsy/) and a bunch of helper systems (https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-asystentow-medycznych-ram/ https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-as...). Naturally hospitals would have their own 3rd party systems, etc., but the tendency is to unify everything, which logically reduces number of attack vectors. Hopefully someone with a better experience in the field can attest to that.
- bumby 5y ago
  So if I understand your point correctly, it’s not necessarily that removing the profit incentives directly improves the outcome but rather the improvement is attributable to a better economy of scale?

by bumby 5y ago

Taywee 5y ago

I wouldn't. Both goals of maximizing profit and achieving a goal on a minimal possible budget end up cutting costs in places that aren't immediate blockers, where security lies. In my experience, security is a focus at places, either non-profit or otherwise, in one of the following situations: * The organization has one or more squeaky wheel employees that force everybody else to consider security where they wouldn't otherwise. * The organization or another in the same industry has already had a very painful security breach. * Security itself is part of the selling point. Non profits are slightly different, but they still experience many of the same problems because the goal is still getting the most done on the budget you've got.

bumby 5y ago
Yeah, I can see that. I think you’re right. But that feels more to the "cultural" point (i.e., different perspectives having different priorities) than the specific claim specifically that "profits" are the driver.

deleted 5y ago

[deleted]

cromka 5y ago

> If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? I will respond to that partially: where profit is not a primary motive, i.e. in countries where healthcare is public, it tends to be centralized on federal or regional level, and, as such, much of the IT and cybersecurity is a lower, shared cost incurred by the government. Taking my native Poland as an example, there is a single country-wide portal available for patients (http://pacjent.gov.pl http://pacjent.gov.pl), as well as a single, centralized API for doctor/hospital software (https://cez.gov.pl/interoperacyjnosc/interfejsy/ https://cez.gov.pl/interoperacyjnosc/interfejsy/) and a bunch of helper systems (https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-asystentow-medycznych-ram/ https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-as...). Naturally hospitals would have their own 3rd party systems, etc., but the tendency is to unify everything, which logically reduces number of attack vectors. Hopefully someone with a better experience in the field can attest to that.

bumby 5y ago
So if I understand your point correctly, it’s not necessarily that removing the profit incentives directly improves the outcome but rather the improvement is attributable to a better economy of scale?