13 ms·
In Sweden, there is a private network (Sjunet) which is isolated from the Internet. It is used by healthcare providers. Its purpose is to make computers valuabl
by anticristi 2y ago
In Sweden, there is a private network (Sjunet) which is isolated from the Internet. It is used by healthcare providers. Its purpose is to make computers valuable communication devices (I love how the article points this out), but without exposing your hospital IT to the whole Internet. Members of Sjunet are expected to know their networks and keep tight controls on IT.
I guess Sjunet can be seen as an industry-wide air-gapped environment. I'd say it improves security, but at a smaller cost than each organization having its own air-gapped network with a huge allowlist.
- einpoklum 2y agoAs others suggest: Sjunet is not really "private", in the sense that you can bet that there are unsupervised machines connected to it via some of the legit machines (or via some of the comm. equipment), which are also connected to the rest of the Internet via another Ethernet or WiFi connection. These can in principle expose open ports for interested parties to act as they wish on the "private" network. And they do so despite the reassuring contract which Sjunet members sign.
- kreddor 2y agoDenmark has something quite similar (Sundhedsdatanettet).
- jmnicolas 2y ago> Sundhedsdatanettet What a tongue twister for non danish speaking people :D
- Symbiote 2y agoIn English we would put spaces between parts of a "compound" word. > Sundheds data nettet Sund-hed is "sound-ness" (or even "sound-hood"), i.e. health. > The health data network
- ithkuil 2y agoYep. not putting spaces on compound words doesn't twist the tongue but twist the eyes! Eyetwister
- kwhitefoot 2y agoIn Norway this is called engelsk orddeling and is a source of gentle amusement, or occasionally outbursts of irritation. See https://www.diskusjon.no/blogs/entry/878-orddeling-en-engelsk-epidemi/ https://www.diskusjon.no/blogs/entry/878-orddeling-en-engels...
- skrebbel 2y agoIt’s even better when you know that the proper pronunciation is essentially “soondhldlddlnl” (Source: I speak Danish as a second language. I used to think Georgian was the language with the most consecutive consonants but then I learned how little the Danes respect their vowels so now I know better)
- mrweasel 2y agoSundhedsdatanettet actually runs on "public IPs". They aren't public, they aren't routed and they certainly are not connected to the internet, but they do exist within a public range. Not sure why a private range wasn't picked, but I'd guess it's to avoid conflicts with other networks.
- myself248 2y agoCould that actually provide a benefit, in that if someone accidentally DOES connect it to the public internet, all sorts of things break immediately and obviously? If the two networks are entirely separate, and they absolutely must be, then there's no reason for addressing concerns of one to influence the other one iota. (Except that certain OSes might have baked-in assumptions about things like the 127/8 network, so you'd have to work around those.)
- anticristi 2y agoSjunet also uses public IP, but never exposes those on the Internet. No clue why, probably it turned out to be the easiest solution to avoiding collision with private ranges used at all member organizations.
- nox101 2y agoGiven the state of IT in healthcare in pretty much every other country, is there any reason to believe "Members of Sjunet are expected to know their networks and keep tight controls on IT" has any meaning? Does the government audit every computer on the network? Are they all updated with the latest patches? Do we know people aren't plugging in random USB devices, etc..?
- hulitu 2y ago> Are they all updated with the latest patches? Are the latest patches security updates ?
- jmprspret 2y agoYeah. As someone who has literally been in this industry.. As sad as it is, its a pretty massive ask to expect all healthcare places to have their security "tight". All it takes is one lax clinic or hospital (and truth be told they are ALL lax in their security in one way or another) for it to come crumbling down.
- deleted 2y ago[deleted]
- anticristi 2y agoMy understanding is that the members need to sign a contract to join Sjunet. I'm not sure of penalties, but being kicked out of Sjunet is likely an incentive for decent IT staffing.
- wkat4242 2y agoI kinda wish there was a WAN the way internet used to be in the 90s. With more hobby stuff, no commercial things and no regulations. A bit like tor but without all the creepy stuff I guess.
- simonjgreen 2y agoThere are several overlay WANs for fun and learning. For example, check out DN42.
- wkat4242 2y agoInteresting, thanks! I will check it out.
- NavinF 2y agoI bet that gives hospital IT a false sense of security. A huge intranet is kinda the opposite of modern best practices: https://en.wikipedia.org/wiki/Zero_trust_security_model https://en.wikipedia.org/wiki/Zero_trust_security_model
- actionfromafar 2y agoIt's not exactly like just a WAN or intranet over the Internet. It's a separate network with agreed on availability guarantees.
- nindalf 2y agoThe problem is that you think it’s private but it isn’t. If an attacker wants access they’ll get access. At that point the false sense of security is a hindrance, because systems might not have been secured like they would have been on the public Internet.
- usrnm 2y ago> might not have been secured like they would have been on the public Internet Yes, because we all know how secure the tings on the public Internet are. /s Nobody's saying that a private network doesn't have to be properly secured, you're fighting a strawman argument
- krab 2y agoMaybe knowing there are many institutions on the network is a good motivation to keep services secure. It's apparent any hospital or vendor may be breached. So if you overcome the false sense of security, the separate network will give you another layer of defense.
- jaapz 2y agoWho says they're not securing anything apart from being air-gapped from the internet?
- 2y ago
- sz4kerto 2y agoUK has that (called the HSCN). I don't think it's a good thing. Couple of years ago you had to pay hundreds of dollars for a a TLS certificate because there were only a couple of 'approved' certificate providers. It also provides a false sense of security and provides an excuse to bad security policies. The bandwidth is low and expensive.
- simonjgreen 2y agoIt’s not sure it’s quite the same, HSCN does provide border connectivity to Internet as well as a peering exchange. Sjunet on the other hand is an entirely private network with no border connectivity. I have dealt with both.
- actionfromafar 2y agoWhether an implementation is bad is orthogonal to whether the idea itself is good.
- sz4kerto 2y agoI don't agree fully. If some idea looks really good but implementations tend to be very problematic then the idea is likely presented incompletely or inaccurately, because it carries some hidden/non-apparent risk. Some good-looking ideas almost always result in beneficial implementations, some good-looking ideas almost always result in bad implementations.
- actionfromafar 2y agoSure, let's get to concrete things. What is a separate physical network worth, availability wise? Kind of hard to answer. It depends on the threat model. Even geography.
- ithkuil 2y agoIf all implementations of a "good" idea are bad then that's a strong indication that the "good" idea might have some significant flaws. If the "good" idea has some bad implementations as well as some good implementations (like the swedish network example?) then perhaps you shouldn't dismiss the "good" idea so quickly
- jmnicolas 2y agoNo computers connected to the internet in Swedish hospitals? If there are, a bridge could be made willingly or not. OFC it's more secure than everything on the internet.
- miki123211 2y agoPoland has the little-known "źródło" (meaning "source" in English). It's a network that interconnects county offices, town halls and such, giving them access to the central databases where citizens' personal information are stored. It's what is used when e.g. changing your address with the government, getting a new ID card, registering a child or marriage etc. As far as I know, the "Źródło" app runs on separate, "airgapped" computers, with access to the internal network but not the internet, using cryptographic client certificates (via smart cards) for authentication.