141–150 of 201 posts
% curl -L 'https://techcrunch.com/2020/01/10/medical-images-exposed-pacs/' curl: (7) Failed to connect to guce.advertising.com port 443: Connection refused WTF? I have a lying DNS server, and it's getting ridiculous. Here's the outline for people who care about privacy/tracking/GDPR, etc. https://outline.com/Ep5u4K
Without it just doing -o to an .html opens fine in the browser for reading. I feel like I'm missing something here.
Earlier quoted context omitted.
Curious, why would a doctor decline to use basic password auth?
I have had a doctor tell me that his time was too important to waste it typing passwords. I had another one tell me, quite dramatically, "someone could die" while he was typing in a password. It's a profession where many have an "interesting" perspective on information protection. I have tons of tragicomic security stories from dealing with health care providers.
Might some doctors leave the smartcard in the reader for a PC they often use, then walk away? Yes, yes they might, and that is a behaviour you can start fighting with peer pressure, but doctors are right to think passwords are a waste of their time.
Earlier quoted context omitted.
Its the IT job to provide security without having to inconvenience the user. you can't just add extra layer of inconvenience for the sake of security. Your ultimate goal should be to provide security without adding additional inconvenience to the user or without having the user to notice it at all.
Just curious, are you joking, or are you serious?
Earlier quoted context omitted.
Curious, why would a doctor decline to use basic password auth?
I have had a doctor tell me that his time was too important to waste it typing passwords. I had another one tell me, quite dramatically, "someone could die" while he was typing in a password. It's a profession where many have an "interesting" perspective on information protection. I have tons of tragicomic security stories from dealing with health care providers.
As an IT or security personel your job is to support them and assure security without creating extra friction or productivity loss. Yes it is hard but that is the challenge.
This is what a often neglected by security professional and just blaming the user.
An odd line from the article, wherein it states that security researchers don’t blame vendors, but the physicians and hospitals that fail to properly secure the software. I have never, in all my years of working in healthcare, seen a hospital or physicians office directly install and manage PACS. They pay a third-party - usually the vendor - to install, configure, and walk them through it. Maybe a behemoth system lik…
I’ve been the IT vendor in this scenario. While I’m sure there are plenty of inept vendors not doing their part to ensure the systems they implement are secure, a big part of it is doctors and their work culture. Many doctors see themselves as too important to deal with security. They have an attitude of “I went to school for medicine, not computers! How dare you ask me to use a computer.” They are not only technolog…
Secondly, doctors are busy and have unpredictable workloads. They also have limited ability to delegate or ask for help if they are oversubscribed. This means if you add 10 minutes to their day, it will actually extend their working day by 10 minutes, and the things they have to do may take them until 10pm at night or worse (I semi-regularly finish documenting things after midnight, and I am not working night shift). They are understandably allergic to things which seem to increase the amount of stuff they have to do.
Unfortunately, if you are a small IT vendor trying to introduce a service or a product to a large hospital (the bigger it is, the bigger the problem), you are going to have a difficult time. This is just the reality, which we can complain about, but there it is.
There are strategies which can improve uptake and reduce resistance, but they only really work for large well-resourced vendors who are doing large projects:
1. Get the hospital to create a role for a doctor to be the clinical lead of whatever IT infrastructure you are trying to implement.
2. Bundle a large number of changes together, including obviously beneficial ones which save time (like an integrated EMR or paperless ordering) with important ones (like proper auth).
3. Make sure the institution has a lot of skin in the game, usually due to a large financial investment, or meeting some performance indicator, or keeping up with another competing institution.
4. Get the institution to reduce the workload when new systems are being implemented. This might sound obvious, but it makes a difference if you give doctors a bit of breathing room to adapt to a new service.
5. Publish some metric of how well each group of doctors is using a service in an email each week that gets sent to everyone.
6. Constantly remind everyone of why things are better after something has been implemented. I get hospital wide emails all the time about bake sales and other useless stuff, nobody sends emails celebrating or outlining why a recent change in IT infrastructure is making a positive difference. The only IT emails that get sent are when something is broken. Not surprisingly, this makes everyone sceptical of any new IT system.
7. Avoid direct face to face contact between doctors and the IT vendors. Doctors don't want to talk to the IT people, and IT people don't want to talk to the doctors. It just isn't useful, and everyone leaves feeling unsatisfied. Disconnect the technical expertise from people that don't understand why it matters. Find some other way to interact, through support staff, clinical leads etc.
This stuff is part of the moat which large EMR providers have, they can actually do this stuff. I have seen it at play with Epic, whatever you think about the software, they have worked out some of the sociological aspects, and they understand that once the EMR is delivered, the process doesn't end.
Earlier quoted context omitted.
I have had a doctor tell me that his time was too important to waste it typing passwords. I had another one tell me, quite dramatically, "someone could die" while he was typing in a password. It's a profession where many have an "interesting" perspective on information protection. I have tons of tragicomic security stories from dealing with health care providers.
And they are right. Passwords are probably the wrong thing. Give the doctors a hardware token, a smartcard (and fit smartcard readers to everything doctors might expect to use) or use biometrics. Might some doctors leave the smartcard in the reader for a PC they often use, then walk away? Yes, yes they might, and that is a behaviour you can start fighting with peer pressure, but doctors are right to think passwords a…
> Might some doctors leave the smartcard in the reader for a PC they often use, then walk away? Yes, yes they might, and that is a behaviour you can start fighting with peer pressure, but doctors are right to think passwords are a waste of their time.
At least the hospitals I've been to this is implemented as an rfid tag on their id badge, so it doubles as access control both for physical and software systems (as well as functioning as a charge card of sorts against the employee's company account for things like the cafeteria).
Earlier quoted context omitted.
Sounds like someone has it in for doctors. I worked in healthcare IT for years, before than going to medical school, and now in residency. My experience really does not match yours. As mentioned earlier in the thread, I will agree that doctors in general are quite resistant to technology because they have been fucked over by implementations that are more concerned with billing and regulatory than either better patien…
Why you are resistant is important but you must follow the rules. Bad things beyond your imagination will happen if you click on that email link. The increased scrutiny allows for better patient tracking and care. That needs to be the priority. Regulatory paperwork and billing are the reason why you are putting in information into the computer. Without these the medical centre closes. Getting the correct information…
Earlier quoted context omitted.
I have had a doctor tell me that his time was too important to waste it typing passwords. I had another one tell me, quite dramatically, "someone could die" while he was typing in a password. It's a profession where many have an "interesting" perspective on information protection. I have tons of tragicomic security stories from dealing with health care providers.
Yes password are annoyance, friction and waste of time. Not to mention 2FA that is worse. For the Dr, his upmost concern is to treat the patient not deal with extra layer of annoyance. As an IT or security personel your job is to support them and assure security without creating extra friction or productivity loss. Yes it is hard but that is the challenge. This is what a often neglected by security professional and j…
Earlier quoted context omitted.
Yes password are annoyance, friction and waste of time. Not to mention 2FA that is worse. For the Dr, his upmost concern is to treat the patient not deal with extra layer of annoyance. As an IT or security personel your job is to support them and assure security without creating extra friction or productivity loss. Yes it is hard but that is the challenge. This is what a often neglected by security professional and j…
Hey, thanks for the condescension. You know what else our job as "security personel" (sic) is? Other than literacy, it's matching controls to risk. The guy who talked about "people dying" was a urologist; I can assure you the no one was going to die in his office because of passwords. So, yes, we should reduce friction where it's appropriate, but unless you understand the actual risk model, maybe you should keep your…
So you have to come up with different method.
For the security personal, Dr is the customer, customer is king.
Earlier quoted context omitted.
I’ve been the IT vendor in this scenario. While I’m sure there are plenty of inept vendors not doing their part to ensure the systems they implement are secure, a big part of it is doctors and their work culture. Many doctors see themselves as too important to deal with security. They have an attitude of “I went to school for medicine, not computers! How dare you ask me to use a computer.” They are not only technolog…
Its the IT job to provide security without having to inconvenience the user. you can't just add extra layer of inconvenience for the sake of security. Your ultimate goal should be to provide security without adding additional inconvenience to the user or without having the user to notice it at all.
We trade convenience for security every single day. Ever get locked out of your house because you forgot your keys? Why is that level of inconvenience (requiring keys on doors) okay but it's up to a security team to only implement security solutions which are frictionless and require zero change to workflows?
Further, if we require keys on our doors, why wouldn't we require similar measures on software systems? If they are inconvenient, they are inconvenient compared to what? No security?