Ransomware & HSE

thecretinhop · 13-12-2021 11:21am

lol on password record. i worked on a huge project when i was 18 in public sector. deadline was monday on thursday my manager said im off to london to see the producers. Handed me everything passwords codes etc. de mind boggles to dis day.

BluePlanet · 13-12-2021 11:56am

https://www.boards.ie/discussion/comment/118310348#Comment_118310348

We don't know but the mail filter may very well have picked it up and Quarantined it, recipient gets notified. Recipient then asks IT to release the email.

If the attachment of the email is unscannable, then the mail filter can't determine if it's safe or not. It's up to the users, in this case the recipient to be aware of who is sending them mail. If the sender domain was spoofed then that's another vector.

Well run organisations run phishing campaigns to test their users awareness. I'm betting the HSE have never run one.

Blowfish · 13-12-2021 12:17pm

https://www.boards.ie/discussion/comment/118312928#Comment_118312928

Hospital A seem to have come out of it very well, not just in their reaction, but it seems their overall posture is better than the wider HSE's:

The HSE should prioritise the remediation of critical legacy systems. Immediate efforts should focus on prioritising the upgrade of the NIMIS system, as this is currently inhibiting the upgrade of a significant proportion of 30,000 Windows workstations from Windows 7 to Windows 10.

In considering the acceleration of the NIMIS upgrade, HSE should review if the configuration changes made in one hospital (Hospital A) to enable the application to run on Windows 10 can be more widely implemented, and supported by the vendor, to expedite the central Windows 10 rollout plans (see key recommendation FA1.KR11 g in section 5.1).

So, it turns out upgrading to Win 10 was possible all along, it just needed a bit of effort that 'Hospital A' put in, but the rest of the HSE didn't.

From an InfoSec perspective, there are a lot of pretty failings from the HSE in the report, even stuff as basic as not having an asset register. It seems that the IT end overall has been underfunded and understaffed for a long time and this is the result.

BluePlanet · 13-12-2021 1:50pm

https://www.boards.ie/discussion/comment/118313511#Comment_118313511

I disagree. Particularly with email as the vector. Organisations need to train their staff, and refresh that training every year to recognise phishing, spoofing and social engineering attacks. But if staff are still being stupid and clicking on things they should not, then yes they absolutely get singled out and potentially disciplined. An Oranisation cannot make a bullet proof system that is also secure against people being stupid internally.

seamus · 13-12-2021 2:00pm

https://www.boards.ie/discussion/comment/118314397#Comment_118314397

You can't train people perfectly either though. And these attacks are getting better all the time. It's no longer the Nigerian prince stuff, it's better crafted emails that appear to come from legit contacts.

At the end of the day your system needs to account for the fact that your people are vulnerable - and sometimes malicious. To assume that someone has clicked on something dodgy means the problem is that they're stupid and have ignored their training, is a hole in one's process. Because you're also assuming that nobody else in the company will make the same mistake.

Yes, you absolutely need to train and refresh your staff on security vigilance, but you also need to understand that for 99% of your staff, security is the last thing on their minds. The ICU nurse who uses the computers as a tool to treat their patients is not thinking about Russian hackers, and they shouldn't have to. There should be security systems in the background so that when they are inevitably exhausted, counting down the minutes to the end of their shift and mindlessly click on a link in an email, it doesn't bring down an entire country's health infrastructure.

It's the swiss cheese model of protection. You have many layers of security, each of which assumes the one above it is not perfect. Training staff is just one layer, the one at the top with the most holes. If the layer below fails to catch what falls through, then it's a systems failure, not a people failure.

If every company fired everyone who ever made a mistake and clicked on the wrong thing, most people would have lost their jobs at some point.

L1011 · 13-12-2021 2:17pm

NIMIS being a reason there's still W7 in use has echos of the past - it was a core reason why XP hung around a lot longer too. Always goes in big leap updates that take forever.

BluePlanet · 13-12-2021 2:28pm

https://www.boards.ie/discussion/comment/118314463#Comment_118314463

The problem with making your IT system "bullet proof," particularly for emails, is that your system will end up rejecting a significant percentage of mail and this will be a drag on business. It's finding the right balance of security and end user training.

Igotadose · 13-12-2021 2:34pm

https://www.boards.ie/discussion/comment/118314640#Comment_118314640

There are many problems in the HSE IT systems. An appalling lack of backups is just one. Email security another. Pretty much every aspect of it is fragile. Imagine if they hadn't, somehow, obtained the decryption key. Even with it, it took 3 months to decrypt the servers. 3 months of degraded service during a pandemic.

Servers should be getting regular backups and scrubbed plus serious virus scans.

Plus nothing mentioned in the report about what the hackers got up to between March and May. But from the report and the reporting, there's nothing preventing the exact same hack from occurring as I type this.

13-12-2021 2:42pm

https://www.boards.ie/discussion/comment/118312448#Comment_118312448

prob not worth the aggravation tbh and for the HSE not worth the embarrassment of admitting if there had been.

13-12-2021 2:46pm

https://www.boards.ie/discussion/comment/118314640#Comment_118314640

My father had a CT scan in galway, the results were emailed to Beaumount, a surgeon looked at it and said, stick him in an ambulance to me. 6 hours later he was under the knife and 8 hours later he was sat up in bed eating a ham sandwich. That wouldn't have been possible if the email was in a vault "awaiting moderation".

As part of my job I do phishing tests. Some of the emails I have sent, looking like they are from a bank, look more convincing than genuine emails I have gotten from my own bank. Security training can only go so far.

Disabling Macros organisation-wide would not have stopped this. There is countless ways into a network that size. The best protection is ability to identify threats and respond, mitigate and recover.

BluePlanet · 13-12-2021 2:46pm

I thought they had backups, just could not successfully use them. Untested backup solutions are about as good as no backup solutions. HSE are a little unlucky to have been found out. Lots of companies and organisations have Disaster Recovery processes, but if they are not tested then they aren't really a good DR strategy. But it's hard to dedicate resources, money, people and time to DR.

BluePlanet · 13-12-2021 2:56pm

https://www.boards.ie/discussion/comment/118314736#Comment_118314736

Email gateways are normally set to check Sender Policy Framework for example, to prevent spoofing; and then can be set to Quarantine or Drop when incoming mails don't pass that check. But like i said you'll be stopping an absolute ton of mail and it will annoy the business and users and cause a major storm.

There is no perfect solution. It's a good policy to lay some of that responsibility onto the users themselves, and it's probably cheaper than hardening mail systems which will result in rejecting mails you actually want.

72sheep · 13-12-2021 3:36pm

The HSE is the type of organisation that offers €420k to headhunt the lead of Fingal County Council. That new CEO, Paul Reid, is being paid €250k more than his predecessor. Given that level of organisational proficiency, the sequence of events detailed in the report is hardly surprising!

Igotadose · 13-12-2021 8:33pm

Why would someone working for the HSE at a 'patient 0 workstation,' handle e-mail there? Why would suppliers be bothering clinical staff? These all seem like process problems, i.e., HSE might've actually tasked non-clinical staff to do things like order and deal with suppliers.

These are just some random things I just thought up. I expect there's a LOT of process changes the HSE might consider, should they choose to seriously address their fragile IT infrastructure. Again, it seems there's nothing changed to prevent a similar hack at any point in the future.

irishgeo · 13-12-2021 9:48pm

https://www.boards.ie/discussion/comment/118312296#Comment_118312296

Page 7 of the PWC report, right hand column, bullet point 4.

Reliance was placed on a single antivirus

product that was not monitored or effectively

maintained with updates across the estate.

For example, the workstation on which the

Attacker gained their initial foothold did not

have antivirus signatures updated for over a

year.

Seth Brundle · 16-12-2021 1:27pm

Erm...

https://www.irishtimes.com/business/technology/coombe-hospital-hit-by-new-ransomware-attack-1.4756968

BluePlanet · 16-12-2021 2:46pm

https://www.boards.ie/discussion/comment/118316853#Comment_118316853

Clinical staff still have to access computer systems, HR stuff, payroll, computer based training.

TheIrishGrover · 16-12-2021 3:31pm

https://www.boards.ie/discussion/comment/118301907#Comment_118301907

It would be. But phishing mails or other similar mails can be very convincing. Over-worked people flying through mails to try to catch up, it is easy to miss. There is no defense against Layer 8 (Users).

The main takeaway is that the HSE was ripe for this kind of thing to happen. 15 people? They should have dozens. For such a sensitive state organisation, maybe hundreds.

They need dedicated cyber team, proactively investigating potential phishing patterns, running drills, education.
They need dedicated end-point protection team. Making sure that all laptops etc are kept up-to-date.
They need dedicated firewall team.
They need password management tools and multifactor authentication.
They need 24/7 monitoring.

They were told this in advance (Admittedly, these things take time and the breach would probably still have happened had they begun to act on the recommendations). You reduce your budget, race to the bottom/cheapest option and this happens. Basically, you get what you pay for

Xander10 · 16-12-2021 3:45pm

https://www.boards.ie/discussion/comment/118331346#Comment_118331346

I've never seen a HSE admin staff break sweat. It's a bit of a basket case and still unionised?

Blowfish · 16-12-2021 7:10pm

https://www.boards.ie/discussion/comment/118330466#Comment_118330466

Last year, my fiancée was a patient in the Coombe for giving birth. It used to amuse me how backwards technology wise it came across due to their complete reliance on paper. She'd go in for a scan, get handed her paper file at the door, be responsible for bringing it to her appointment, handing it to the doctor/midwife/consultant who'd read a bit, fill in some more and hand it back at the end of the appointment for her to bring it to get checked back in to their records dept.

I stand corrected now. Given the apparent state of the NHN and Coombe networks, sticking to paper records is probably actually the correct approach from a risk perspective.

19-12-2021 9:57pm

https://www.boards.ie/discussion/comment/118332523#Comment_118332523

Any time I attend the Beacon I always have my thick paper records sent to whatever consultant I might be seeing there. Of course my records are also online, but the master record is the paper one as signed off by a doctor.

19-12-2021 10:01pm

https://www.boards.ie/discussion/comment/118331452#Comment_118331452

Pretty much all public service (& health) staff who have specialised core jobs also have admin tasks, and the original attack was a medical worker doing one of these tasks between their busy core role. Nurses have a huge amount of admin type work.

As I’ve said many times in various threads where this comes up, small public service organisations train staff in IT in-house (often through IPA courses) to carry out various IT duties. Then a tech phones up and asks to speak to “the Unix admin” and because you have your folder of papers from your little course you are put on the phone and your name goes down forever more as “Unix Admin @Public Service Branch: RTS”, and then you are designated an all-around expert in your department. That’s the way it has worked, or rather non-really-worked. Most staff members do their darned best, and if they have any taste for tech (or other areas in my organisation) this is utilised. Cheaper than hiring in an additional person who only does x/y task, well as long as they could get away with it. Priorities are changing rapidly.

Ransomware & HSE

Comments