Slashdot Mirror
Healthcare Organizations Under Siege From Cyberattacks, Study Says
BigVig209 sends this report from the Chicago Tribune:
"A new study set to be officially released Wednesday found that networks and Internet-connected devices in places such as hospitals, insurance companies and pharmaceutical companies are under siege and in many cases have been infiltrated without their knowledge. ... In the report, the groups found from September 2012 to October 2013 that 375 healthcare organizations in the U.S. had been compromised, and in many cases are still compromised because they have not yet detected the attacks. ... 'What's concerning to us is the sheer lack of basic blocking and tackling within these organizations,' said Sam Glines, chief executive of Norse. 'Firewalls were on default settings. They used very simple passwords for devices. In some cases, an organization used the same password for everything.'"
Not surprising, really. The only time companies get punished for non-compliance is when they are the ones accessing protected health information. No threat of punishment == no compliance.
I am Audience.
We're sorry to tell you that your child passed away from a ping timeout...
In some cases, an organization used the same password for everything.'"
That's not negligence, it's just the Navy keeping up with the times and implementing Single-Sign-On.
Only to idiots, are orders laws.
-- Henning von Tresckow
... their abominable religion thrives where there is pain, suffering, and misery.
So do Christianity, news organizations and weapons manufacturers to name a few ... what's your point?
Recall that at least the original license agreement for Sun Java specified that it must not be used to operate nuclear power plants. That got a lot of ridicule but was arguably a good idea.
From time to time I see posts for medical device coding jobs on craigslist and the like. Quite commonly they require one to have experience with C# .Net.
That doesn't make a whole lot of sense to me. Heart disease runs in my family. If I get a pacemaker, is it going to be running Microsoft Windows?
Please mail me URLs of software employers.
Stop posting AC timothy
... whatever
we start anew... free the innocent stem cells... see you there
so our patrons can still have something to watch... they say. right away the WMD on credit cabalists are hacking the repli-byrds causing them to viciously attack the innocent (until now) byrd watchers, & their keepers. uncomplicate remains the keynote...
By which I do not mean putting some off the shelf software or hardware between your network and the federal ACA system. Rather, have an isolated system distinct from the rest of your network which interacts with the ACA. Give that system no access to the rest of your network or vice versa except through very tightly controlled protocols. Effectively, assume that machine is compromised or at least in extreme danger of being compromised.
Then carry on. Worst case, that isolated system will be infiltrated. But since the Federal ACA system is compromised that's nothing special. Your internal network will remain safe from that vector and you can continue to comply with this federal boondoggle.
Government... we only take them seriously because they threaten to shoot us. No really. Absent threats of violence who would be complying with the ACA at this point? No one. That's all that keeps this bullshit going.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
We need a law (or laws) that place very painful penalties on any business or organization that suffers a data breach through their own negligence.
The right wingers who run a lot of these businesses just love to talk about the magical results we can get by relying on the free market. Well, let's see them put their money where their mouth is. Currently, they can be sloppy with their IT practices and pay virtually no price even when something goes wrong that causes considerable pain to their customers/users and society at large. It's a classic externalized cost. Internalize it via triple-damages penalties or something similar, and I guarantee that their IT practices will improve dramatically in a matter of weeks.
Let me summarize the situation so we can avoid having an article for every industry.
Any business worth any substantial amount of money is, and has been for years, under constant 'cyberattack'.
blindly antisocialist = antisocial
I have been working in health care IT strictly for 6 years now and the problem is not the lack of security at all from my standpoint. It is however the lack of spine in the industry. We have no one that will stand up in this time of change (read up on meaningful use in health care) and say no.....I will not continue to put the customer at risk just to get this project running. Why not? Because it will cost them their job....why? Because the people leading us into things like the government website fiasco don't get what it is they are asking their IT to do - thus causing IT to continuously lay down project after project that is just barely stood up let alone implement it correctly or bother to maintain it properly. I can speak from experience in the small to midsized markets - the give a hoot is broken in favor of timelines and making some ones project a success for their resumes. It will not change until someone has the spine to stand up and explain in layman's terms the how/why these projects cannot continue to be pounded out in neck breaking speed. As an IT person in health care I can honestly say no one listens to us until something is way past broken and it costs them dearly, which causes me to just want to put my head down in defeat and only do what I am told. Why not.....Every one else can right? Feel free to email tyroniuz (the at sign) Gmail dot com if you care to get any more feedback from the downward spiraling trenches of IT
I've been there. The organizations just don't care, it is more important to keep doctors happy. There is very little appreciation for IT and its value. And since there are limited consequences for breaches, there is no motivation to change.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
We are a healthcare startup and we get the usual metasploit attacks, but more important we are phished like crazy.
The information is valuable and because it is, healthcare firm staff will be easy pickings for being targets.
They simply don't know what they are doing (for instance, there is a 90% chance your doctor is using SMS/MMS to communicate about patients)
Who else would benefit from knowing your health info? Drug companies could spam you with ads, I suppose, but insurance companies have the most to gain by denying coverage to the "accident prone, chronically ill, and those who might inherit propensities for certain health problems. For health insurers, this has supposedly been fixed under Obamacare, but like taxes, there are many lawyers looking for loopholes and they will certainly find them. And what about life insurance? Those guys would love to have all your medical records...
This story doesn't indicate that this is largely the NSA collecting information in support of further executive adjustments to the Afraudable Care Act. This is just how they operate. "It's better to beg for forgiveness than to get permission or follow legislation. It's even better to deny that you did it than to beg for forgiveness." --Eric Holder
One of my clients is an umbrella organization for a few local community health centers, and there has been a steady stream of empty POST submissions to their website -- at the rate of about 2/second -- for about 4 straight months now. Virtually every hit is from a unique IP address, so the spoofing is either great, or the botnet is enormous. This is normally a VERY low-traffic site, so the attack constitutes about 99% of their traffic at this point.
I'm assuming that the timing of the start of the attacks -- just as the Affordable Health Care Act came into effect -- is not a coincidence. It's a brain-dead attack, and easy to mitigate, but I'm a bit dumbfounded that it continues to this day, despite having no effect on the accessibility of their site at all.
just wants to know which terrorists are going to the hospital and for what treatment. ordinary citizens have nothing to fear, it is only collecting meta-data about your bloodwork, x-rays, mri's......
"...and in many cases have been infiltrated without their knowledge."
That's just a lack of basic courtesy. Whatever happened to the common decency of letting someone know you're about to sneak into their house?
Yes I have. I've read the entire HIPAA and HITECH acts, including the data transfer standards. It takes weeks just to get through the non-standards documents. Luckily I'm paid to do it.
That's not entirely false. There are many references to clarifications that will be provided by the Secretary of HHS (who tends to pass the buck to NIST these days) and also implicit references to industry best practices and explicitly to the "reasonable man" legal standard (which seems to be what you're referring to).
Wrong. The only people who can't be "pinned" are the government regulators themselves - the compliance standards, as officially and legally clarified by the Secretary, explicitly reference things like FIPS 140-2 which have exact requirements. Failure to comply with those is punishable. The weasel-wording you've pointed out serves to protect and empower the regulators who are outside of the congressional legislative process, it does nothing to protect non-compliant hospitals, for example.
It's a consultant's dream alright, for two reasons - one, it's a gold mine because the rules constantly change as the Secretary makes "statements", and two, because people like you are spreading inaccurate information about liability. I can't tell you how many times I've heard fools say that "nobody will prosecute us for this..." setting themselves up for a board-mandated takeover of the IT department by consultants.
sed 's/complying with/breaking/' <previous post >coherent post
That'll teach me to use preview mode... oh well, at least the link worked.
An acquaintance of mine, several years back, worked at a medical coding company called Meddata (based out of Ohio, I believe, and owned by a private equity/leveraged buyout firm) which kept having computer problems, which their inept and incompetent IT sleazoids were unable to prevent. She monitored their systems inhouse, and ascertained that they were being hacked at mercilessly, within the USA region. It didn't take her long to figure it out: the executives there, from a previous company but now in top levels at Meddata, had screwed over numerous people at their previous company (there was, and may still be, a dedicated web site to the lawsuits against that outfit), and people were attempting revenge. Sometimes, it really is that simple.
The Joint Commission (the new name for the organization which used to by known as JCAHO) has recently started to cover the IT side of laboratory systems. Failling this leads to the lab losing their license.