5 ms·

> I understand the author is saying "it's not that easy" and I agree completely with that, but I don't agree that it means you're doing your job well. Could y

> I understand the author is saying "it's not that easy" and I agree completely with that, but I don't agree that it means you're doing your job well. Could you elaborate what you mean by this? It seems to me that your comment just highlights another set of problems that should (in theory) motivate people to think more clearly about the ways their system communicates with the internet. I don't see where you disagree with the blog author. Or are you saying that it's fundamentally impossible to improve security in internet-connected systems because people are not equipped to do so?

flumpcakes 2y ago
There's no reason for digital signage inside an airport to be connected to the internet (or running enterprise security software either). The author seemingly doesn't agree with this. Hospital computers should not be connected to the internet. If you are receiving real-time updates directly from a vendor, you are connected to the internet. Ideally updates should come from a central source internally to the organisation that has been vetted and approved by the organisation itself. Clearly CrowdStrike knows this and that's why they offer N, N-1, N-2 updates for their falcon sensor. It's easier to remote into a box and just pull updates from the internet though. Granted I have not had dozens of jobs, but the only place I have worked where security was treated as the first class issue that it is, (and this type of CrowdStrike incident probably wouldn't have happened), is at one of the largest financial services companies in the world. And it did not hamper development, it actually improved it because you couldn't make stupid mistakes like relying on externally hosted CDN content for your backend app. But for people that don't do their job well, it's a pain. "Hey why doesn't my docker image build on a prod machine, why can't I download from docker hub?"
- karmarepellent 2y ago
  Just to add to this: Apart from the security aspect of hosting your software dependencies internally, it also gives you the added benefit of better availability and performance. As you mentioned in your other comment however, this presumes a certain mindset in people where they are willing to plan upfront and are mindful of the dependencies their software needs. As you say, just pulling whatever from Docker hub is certainly easier. Internally hosted repositories also allow you to pull and install updates at your own pace, possibly days after they have been released upstream. So if a patch is borked you won't be affected.
  - worthless-trash 2y ago
    I hate to be that guy but 'back in my day', that was called "testing/production" deployments.
- horsawlarway 2y ago
  I don't really think you're speaking from a spot that's actually considered the requirements of the system. Ex - you say this: > Hospital computers should not be connected to the internet. But then you immediately jump onwards, as though what you've said is obvious common sense - but I don't think it is. Can you explain to me why you believe hospital computers shouldn't be connected to the internet, and then discuss and weigh the downsides of NOT connecting them? Because there I think that comment exposes the exact mindset that the author was discussing... no obvious appreciation or understanding of the situation, just an ill-informed off-the-cuff remark. Can you tell me how you plan to implement cross facility dosage tracking for patients? Can you let me know how you're going to send CT scans or x-rays to correct expert? Can you tell me how that patient's records are going to be updated, how billing is going to be generated, or how their personal doctor is going to be notified of their condition? I can think of a LOT of reasons that hospital computers really should be connected to a network. Maybe not every computer, maybe not every network, but even that distinction appears to be far beyond the thought you put into it before immediately saying "Hospital computers should be connected to the internet". You're basically making the author's point for him here.
  - bornfreddy 2y ago
    The answer is simple: security. Attacker needs a way into the machine to control it. Granted, there are some obscure vectors of attack that don't need network connectivity (Stuxnet), however the game becomes much harder for the attacker when they have no direct connection to the target system. Many countries solve this by having a separate network for hospitals, but it is not the only way. In general, it is a trade-off between security and convenience. Yes, you can't send an e-mail without an Internet connection (well... not easily). But do you need to? From the computer that controls the MRI machine? Or is it just easier to say "we need Internet because updates"?
    - kwhitefoot 2y ago
      >you can't send an e-mail without an Internet connection Of course you can.
- jstanley 2y ago
  > Hospital computers should not be connected to the internet. But then how will doctors google the patients' symptoms? If your answer is "they should already know all that is required to do their job without looking it up online", then consider whether you hold yourself to the same standard. I don't.
  - karmarepellent 2y ago
    It is hard to make assumptions about what parent means by that statement, given that there are degrees in which a system can be "connected to the internet". For example, every request coming in or going out, as well as SSH access, could go through a proxy. I would still call that being "connected to the internet", but it's different from giving your server a public IP address.
  - rightbyte 2y ago
    They could have designated internet connected computers and other computers for admin tasks and processing x-rays etc. Having the hospital admin and some machines connected outwards seems like a recipe for killing patients.
    - kelnos 2y ago
      If the admin computers aren't connected to the internet, how do patients interact with the administrative staff, for things like appointments, referrals, etc.? If the x-ray processing isn't connected to the internet, how do the x-rays & the radiologist's evaluation end up in the patient's record, or in a place where the patient can download their imaging results?
  - flumpcakes 2y ago
    This information (looking up symptoms) would be better served by a curated internal wiki that all practitioners have access to. Not google.
    - deleted 2y ago
      [deleted]
- devbent 2y ago
  > Hospital computers should not be connected to the internet. Scheduling an urgent care appointment is connected to my account at the hospital network. When I step into the hospital and get tests done, everything is automatically uploaded to a web portal where I can view it and doctors can easily forward my test results to other facilities. Lot of the imaging work is actually done at third party facilities but they still show up in my medical records , presumably having been forwarded. When my appointment begins my doctor can look up any comments I left when scheduling the appointment so she knows why I'm there. Is it possible all the different buildings and facilities that are part of the hospital Network I belong to which extends across multiple counties across my state could all be running on their own private isolated network that is air gapped with medical records manually transferred over to the web portal via sneaker net? Sure, but no one is going to do that.
  - reaperducer 2y ago
    When my appointment begins my doctor can look up any comments I left when scheduling the appointment so she knows why I'm there. Or, you could… you know… talk to her. I work for a healthcare company that runs several hospitals and primary care clinics. When you become a patient, you're given a little notebook and a branded pen so that inbetween appointments, the patient writes down every little health question and problem they have. When the patient shows up for the appointment, the little notebook is reviewed by the doctor. Convenience should not always trump security.
    - devbent 2y ago
      That sounds like an absolute nightmare. I'd lose the pen and paper within 30 seconds. I much prefer being able to send a quick message to a healthcare provider on my phone and have them get back to me same or next day. Especially for the "should I come in for this rash?" types of questions. (I got MRSA at the gym one time!) At my child's pediatrician I can upload images through the web portal and have a nurse call me back anytime of the day or night. If there's any follow-up questions at my child's next appointment, his doctor has full access to all communications that happened through both text message and the web portal. This kind of 24-hour digitally connected healthcare access with a huge boon as a first-time parent and made life a lot easier, especially when incidents like when my son woke up at 3:00 in the morning screaming and then projectile vomited 6 ft across his room (which by the way, was nothing to worry about and apparently completely normal... So long as it just happened once.)
flumpcakes 2y ago
> Or are you saying that it's fundamentally impossible to improve security in internet-connected systems because people are not equipped to do so? Yes - but I don't think think it's that hard. There's 90% easy work to be more secure than most out there. It just requires expertise and for people to change how they work. Instead people spend $bn on cyber security when you can get 97% of the way there by following good standards and knowing your systems. I am by no means perfect, I spent all day Friday fixing hundreds of machines manually that had BSOD'd from CrowdStrike. In this case the vendor had made it impossible to do my job well because they offered zero control on how these updates are rolled out - there is no option to put them through QA first. Unlike the sensor itself, which we do roll out gradually after it has been proofed in QA.
- karmarepellent 2y ago
  I agree with you. Unfortunately my place of work has a habit of buying snake-oil security appliances as well which seems to magically absolve everyone from actually thinking about security deeply themselves. Rather ironically said appliance (that basically acts as a man-in-the-middle in remote access) prevents me from going the last mile in securely configuring my systems. I would not be surprised if the appliance self-updates, but I'm not sure. Regardless you could make the case that practices like these do not improve overall security, but instead just cost a large amount of money that you could hire three security-minded engineers from.
myself248 2y ago
I interpreted it as "Software is crap, and it's hard to make crap work offline. The problem is not the offline, it's the crap." The question is where to lay the blame for the crap, and how to change that. I would love to see the author's "lists" turned into a table of sorts, and then any given piece of software could be rated by how many situations on each list it works in without modification, works in with trivial config tweaks, works in with more elaborate measures, or cannot work in. Turn the whole table green and your software is more attractive to certain environments.
- karmarepellent 2y ago
  I don't think it's always the software that is to blame. Sure there is software that wants to self-update and only accepts one upstream update source run by the vendor, instead of allowing users to run their own mirror and control update distribution to some extent. But there are also cases where the software could be perfectly run in air-gapped systems but people are unwilling to put in the work (for some reason or another). For example everyone could run their own Docker image mirror that only contains images that are actually needed and pulls them from upstream with some delay. Docker allows you to pull images from your own registry. But not veryone is willing to operate their own registry.

flumpcakes 2y ago

There's no reason for digital signage inside an airport to be connected to the internet (or running enterprise security software either). The author seemingly doesn't agree with this. Hospital computers should not be connected to the internet. If you are receiving real-time updates directly from a vendor, you are connected to the internet. Ideally updates should come from a central source internally to the organisation that has been vetted and approved by the organisation itself. Clearly CrowdStrike knows this and that's why they offer N, N-1, N-2 updates for their falcon sensor. It's easier to remote into a box and just pull updates from the internet though. Granted I have not had dozens of jobs, but the only place I have worked where security was treated as the first class issue that it is, (and this type of CrowdStrike incident probably wouldn't have happened), is at one of the largest financial services companies in the world. And it did not hamper development, it actually improved it because you couldn't make stupid mistakes like relying on externally hosted CDN content for your backend app. But for people that don't do their job well, it's a pain. "Hey why doesn't my docker image build on a prod machine, why can't I download from docker hub?"

karmarepellent 2y ago
Just to add to this: Apart from the security aspect of hosting your software dependencies internally, it also gives you the added benefit of better availability and performance. As you mentioned in your other comment however, this presumes a certain mindset in people where they are willing to plan upfront and are mindful of the dependencies their software needs. As you say, just pulling whatever from Docker hub is certainly easier. Internally hosted repositories also allow you to pull and install updates at your own pace, possibly days after they have been released upstream. So if a patch is borked you won't be affected.
- worthless-trash 2y ago
  I hate to be that guy but 'back in my day', that was called "testing/production" deployments.
horsawlarway 2y ago
I don't really think you're speaking from a spot that's actually considered the requirements of the system. Ex - you say this: > Hospital computers should not be connected to the internet. But then you immediately jump onwards, as though what you've said is obvious common sense - but I don't think it is. Can you explain to me why you believe hospital computers shouldn't be connected to the internet, and then discuss and weigh the downsides of NOT connecting them? Because there I think that comment exposes the exact mindset that the author was discussing... no obvious appreciation or understanding of the situation, just an ill-informed off-the-cuff remark. Can you tell me how you plan to implement cross facility dosage tracking for patients? Can you let me know how you're going to send CT scans or x-rays to correct expert? Can you tell me how that patient's records are going to be updated, how billing is going to be generated, or how their personal doctor is going to be notified of their condition? I can think of a LOT of reasons that hospital computers really should be connected to a network. Maybe not every computer, maybe not every network, but even that distinction appears to be far beyond the thought you put into it before immediately saying "Hospital computers should be connected to the internet". You're basically making the author's point for him here.
- bornfreddy 2y ago
  The answer is simple: security. Attacker needs a way into the machine to control it. Granted, there are some obscure vectors of attack that don't need network connectivity (Stuxnet), however the game becomes much harder for the attacker when they have no direct connection to the target system. Many countries solve this by having a separate network for hospitals, but it is not the only way. In general, it is a trade-off between security and convenience. Yes, you can't send an e-mail without an Internet connection (well... not easily). But do you need to? From the computer that controls the MRI machine? Or is it just easier to say "we need Internet because updates"?
  - kwhitefoot 2y ago
    >you can't send an e-mail without an Internet connection Of course you can.
jstanley 2y ago
> Hospital computers should not be connected to the internet. But then how will doctors google the patients' symptoms? If your answer is "they should already know all that is required to do their job without looking it up online", then consider whether you hold yourself to the same standard. I don't.
- karmarepellent 2y ago
  It is hard to make assumptions about what parent means by that statement, given that there are degrees in which a system can be "connected to the internet". For example, every request coming in or going out, as well as SSH access, could go through a proxy. I would still call that being "connected to the internet", but it's different from giving your server a public IP address.
- rightbyte 2y ago
  They could have designated internet connected computers and other computers for admin tasks and processing x-rays etc. Having the hospital admin and some machines connected outwards seems like a recipe for killing patients.
  - kelnos 2y ago
    If the admin computers aren't connected to the internet, how do patients interact with the administrative staff, for things like appointments, referrals, etc.? If the x-ray processing isn't connected to the internet, how do the x-rays & the radiologist's evaluation end up in the patient's record, or in a place where the patient can download their imaging results?
- flumpcakes 2y ago
  This information (looking up symptoms) would be better served by a curated internal wiki that all practitioners have access to. Not google.
  - deleted 2y ago
    [deleted]
devbent 2y ago
> Hospital computers should not be connected to the internet. Scheduling an urgent care appointment is connected to my account at the hospital network. When I step into the hospital and get tests done, everything is automatically uploaded to a web portal where I can view it and doctors can easily forward my test results to other facilities. Lot of the imaging work is actually done at third party facilities but they still show up in my medical records , presumably having been forwarded. When my appointment begins my doctor can look up any comments I left when scheduling the appointment so she knows why I'm there. Is it possible all the different buildings and facilities that are part of the hospital Network I belong to which extends across multiple counties across my state could all be running on their own private isolated network that is air gapped with medical records manually transferred over to the web portal via sneaker net? Sure, but no one is going to do that.
- reaperducer 2y ago
  When my appointment begins my doctor can look up any comments I left when scheduling the appointment so she knows why I'm there. Or, you could… you know… talk to her. I work for a healthcare company that runs several hospitals and primary care clinics. When you become a patient, you're given a little notebook and a branded pen so that inbetween appointments, the patient writes down every little health question and problem they have. When the patient shows up for the appointment, the little notebook is reviewed by the doctor. Convenience should not always trump security.
  - devbent 2y ago
    That sounds like an absolute nightmare. I'd lose the pen and paper within 30 seconds. I much prefer being able to send a quick message to a healthcare provider on my phone and have them get back to me same or next day. Especially for the "should I come in for this rash?" types of questions. (I got MRSA at the gym one time!) At my child's pediatrician I can upload images through the web portal and have a nurse call me back anytime of the day or night. If there's any follow-up questions at my child's next appointment, his doctor has full access to all communications that happened through both text message and the web portal. This kind of 24-hour digitally connected healthcare access with a huge boon as a first-time parent and made life a lot easier, especially when incidents like when my son woke up at 3:00 in the morning screaming and then projectile vomited 6 ft across his room (which by the way, was nothing to worry about and apparently completely normal... So long as it just happened once.)

flumpcakes 2y ago

> Or are you saying that it's fundamentally impossible to improve security in internet-connected systems because people are not equipped to do so? Yes - but I don't think think it's that hard. There's 90% easy work to be more secure than most out there. It just requires expertise and for people to change how they work. Instead people spend $bn on cyber security when you can get 97% of the way there by following good standards and knowing your systems. I am by no means perfect, I spent all day Friday fixing hundreds of machines manually that had BSOD'd from CrowdStrike. In this case the vendor had made it impossible to do my job well because they offered zero control on how these updates are rolled out - there is no option to put them through QA first. Unlike the sensor itself, which we do roll out gradually after it has been proofed in QA.

karmarepellent 2y ago
I agree with you. Unfortunately my place of work has a habit of buying snake-oil security appliances as well which seems to magically absolve everyone from actually thinking about security deeply themselves. Rather ironically said appliance (that basically acts as a man-in-the-middle in remote access) prevents me from going the last mile in securely configuring my systems. I would not be surprised if the appliance self-updates, but I'm not sure. Regardless you could make the case that practices like these do not improve overall security, but instead just cost a large amount of money that you could hire three security-minded engineers from.

myself248 2y ago

I interpreted it as "Software is crap, and it's hard to make crap work offline. The problem is not the offline, it's the crap." The question is where to lay the blame for the crap, and how to change that. I would love to see the author's "lists" turned into a table of sorts, and then any given piece of software could be rated by how many situations on each list it works in without modification, works in with trivial config tweaks, works in with more elaborate measures, or cannot work in. Turn the whole table green and your software is more attractive to certain environments.

karmarepellent 2y ago
I don't think it's always the software that is to blame. Sure there is software that wants to self-update and only accepts one upstream update source run by the vendor, instead of allowing users to run their own mirror and control update distribution to some extent. But there are also cases where the software could be perfectly run in air-gapped systems but people are unwilling to put in the work (for some reason or another). For example everyone could run their own Docker image mirror that only contains images that are actually needed and pulls them from upstream with some delay. Docker allows you to pull images from your own registry. But not veryone is willing to operate their own registry.