Hospitals failing to patch their kit?

[ladymuck]

Doesn't just happen to the NHS. And an hour long wait for a doctor? Surely that doesn't happen outside the UK too? Shocked, I tell you.

Woman dies after hospital is unable to treat her during crippling ransomware infection, cops launch probe • The Register

[Paddy]

I am not up to date on current ransomware and I don't know if there are relevant patches. However, going back ten years, I was consulting on security issues and I traced viruses across the network, and with the help of the HR database managed to find the unknowing culprits. The issues turned out to be that some PCs were showing to be patched when in fact the patch had failed. Doctors and nurses were sharing login sessions to save the bother logging in and out. Doctors on night shift had brought in USB sticks with games on them but also virus infected. Fortunately, the ransomware attack never worked because back-up snapshots were taken every ten minutes.

[_V_]

Pretty tulip. No doubt they are in a country where there is almost no possibility of extradition.

[Old Greg]

Pretty tulip. No doubt they are in a country where there is almost no possibility of extradition.

What's the problem? They're only breaking the law in a specific and limited way.

[minestrone]

I requested a login and permissions to a platform used my the NHS the other day.

The manager forwarded it to her deputy who sent me her username and password and told me to set myself up.

[Paddy]

I requested a login and permissions to a platform used my the NHS the other day.

The manager forwarded it to her deputy who sent me her username and password and told me to set myself up.

On a serious note, I think contractors owe a duty of care to their client. In these circumstances, I would set my account up but also email the deputy outlining why it is not good practice.

[minestrone]

Yeah, I said you might not want to do stuff like that.

IN fact all my emails during the conversation contained some kind of privacy comment, "I don't want to see that", "I shouldn't be seeing that", " I'll get you to do that part". And then I get sent the login.

They know it's wrong, they just dont know how to do what they should know. So it's a time and training issue.

[Old Greg]

Yeah, I said you might not want to do stuff like that.

IN fact all my emails during the conversation contained some kind of privacy comment, "I don't want to see that", "I shouldn't be seeing that", " I'll get you to do that part". And then I get sent the login.

They know it's wrong, they just dont know how to do what they should know. So it's a time and training issue.

I think it's also a culture problem.

[minestrone]

I think it's also a culture problem.

Yeah, the username wasn't the same name as the deputy or manager, and the password of the user was a first name with a 1 on the end, and it wasn't even the first name of the user, deputy or manager.