Hacker News Reader

Comment by Jon_Lowtek | Hacker News Reader

They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere.

What do you think?

I don't think there is a single hospital that completely fulfills those standards. The bar is very high and the umbrella organization of hospitals says there must be millions per hospital invested to reach the requirements.

In unrelated news: a new law was passed today, after years of preparation, that includes a 4.3 billion euro investment of tax money into hospital IT systems.

View on HN

> They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere.

> What do you think?

I don't understand why this apparently seems so obvious to you. I think I would need more information about the attack, the hospital's preparations for such an attack, and the legal and industry-standard security expectations for such a hospital.

The simple fact that an attack took down a hospital's computer systems is not sufficient to conclude that the hospital was negligent in its security. Surely a sufficiently sophisticated actor (e.g. a state) could take down the computers at most hospitals if they chose to.

I did not say that the hospital was negligent

> What do you think?

I think you can follow all the laws and still get hacked, so I don't think the fact that they got hacked tells us much about whether they were following the rules

> They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere.

Wouldn't simply using a cloud-based B2B service with something like Chrome OS / Cloudready instead of Windows solve the entire problem?

If that wouldn't work for data privacy or network availability reasons, it could be an open-source self-hosted server application, accessible locally only through a REST API.

And the server security? Just use something like self-updating RHEL CoreOS with a bunch of isolated containers, which greatly limits the entire attack surface.

> I don't think there is a single hospital that completely fulfills those standards.

Why can't a single technical solution be designed and supported for all state-owned hospitals in Germany?

The problem is not in any particular stack. It’s system design overall. All your mentioned alternatives could just as easily fail if not properly secured.

> The problem is not in any particular stack. It’s system design overall.

Are you aware that unlike Windows, Chromium OS has been designed from the ground up with security in mind[1]? And that it can run on almost any hardware[2]?

> All your mentioned alternatives could just as easily fail if not properly secured.

Software has to be designed and chosen with security in mind from the beginning.

If a hospital is running Windows Server instead of automatically-updating, minimal Container Linux[3], it has a much larger attack vector space.

These two factors alone (a proper client OS, and a proper server OS) can reduce the probability of a successful ransomware attack to almost zero.

[1] https://www.chromium.org/chromium-os/chromiumos-design-docs/...

[2] https://get.neverware.com/healthcare/

[3] https://getfedora.org/en/coreos

What about credentials? Access? Administration? DDOS attacks?

I think you can’t tell the attack space from a glance like that. And there’s ways to properly lock down Windows installations too, patched or not. Careful systems design and planning is key, regardless of exact components.

> What about credentials? Access? Administration?

That has been a solved problem, at least in Chromium OS[1]. Even hardware-based two-factor authentication can be required for all users by a click of a button.

> DDOS attacks?

If it's self-hosted by a hospital locally, most parts of the system should not be available on an open network. If it's not self-hosted locally, the largest European hosting provider, OVH, can survive a 1.1 Tbps DDoS attack[2].

> Careful systems design and planning is key, regardless of exact components.

If the solution is not designed around up-to-date technical components, it can fail regardless of careful planning.

[1] https://support.google.com/chrome/a/answer/1289314?hl=en

[2] https://arstechnica.com/information-technology/2016/09/botne...

You list technical solutions, but I'm talking about organisational failure. What about using too simple password, posting passwords on some semi-public forum, using the same password for several people, using the same account for several people and so on.

In large organisations, the problems are always found in the organisation itself, seldom in whatever tech stack is used. That they used unpatched Windows installations is not the disease, it's a symptom of the disease.

You can enthusiastically treat the symptoms and improve the condition of the patient, but unless you go to the root causes, the patient will find new ways to be ill and you can 't be there to band-aid everything, all the time.

1: I have far too few information to even speculate on how to improve this particular hospitals infrastructure.

2: because Germany is federal-social-democratic, not stalinist.

> because Germany is federal-social-democratic, not stalinist

Ah, "federal" is the right answer here. In many smaller EU countries, there is a single central social-democratic government, which can just fund an open-source solution for all regions to use.

well we can fund an OSS, but i have this feeling you underestimate the complexity of all possible hospitals.

I probably do. In any case, I would design a fundamental core system with an open API for extensions, that could be developed and maintained by third-parties, based on additional requirements by each hospital.

Reply on news.ycombinator.com