Irish health service hit by cyber attack • Hacker News Board

Re: Irish health service hit by cyber attack

#111

Post by roel_v » Fri, May 14, 2021, 2:28 PM UTC

jl6 wrote: post #64

I have a feeling there is a very short security-hygiene checklist that, if followed, could prevent the vast majority of the ransomware attacked that we have seen in the last few years. * Keep all systems up to date with the latest patches. * Have a DR plan and test it regularly. * Make frequent backups, verify them, and keep them offline . Historically organizations have been so bad at backups that the advice has bee…

It's easy to be healthy, just eat right, exercise more, sleep enough and lower your stress levels. Tadaa! The secret to being healthy!

Re: Irish health service hit by cyber attack

#112

Post by ashleyn » Fri, May 14, 2021, 2:31 PM UTC

jupiter909 wrote: post #109

One can do ZFS snapshots so one does not need do insanely huge backups all the time. Just transfer off the diffs as needed. If an attack happens it's pretty easy to roll-back to a known good state. It's also not that complex to set some process in place that does random checksum verification of some files to trigger an alarm that such an attack has taken place. It is really perplexing me that very large institutes do…

Snapshots, RAID, etc are not substitutes for backups

Re: Irish health service hit by cyber attack

#113

Post by moshmosh » Fri, May 14, 2021, 2:33 PM UTC

jupiter909 wrote: post #109

One can do ZFS snapshots so one does not need do insanely huge backups all the time. Just transfer off the diffs as needed. If an attack happens it's pretty easy to roll-back to a known good state. It's also not that complex to set some process in place that does random checksum verification of some files to trigger an alarm that such an attack has taken place. It is really perplexing me that very large institutes do…

Large institutions aren't solving their security problems by hiring a small clutch of FreeBSD elves.

They're hiring consultants to confirm that they've met the requirements of some checklist, which requirements may include "have a plan to fix this obvious problem.... someday. You do? OK, then you're fine". That's much cheaper and is 100% management-class controlled.

Re: Irish health service hit by cyber attack

#114

Post by jonplackett » Fri, May 14, 2021, 2:33 PM UTC

mrob wrote: post #79

jonplackett wrote: post #59

Earlier quoted context omitted.

Politicians always seem to be scared to front-load costs. Happens with military/infrastructure spending all the time - get a cheap initial quote and then get screwed long-term. And with covid. Govs didn't have the courage to lock down early and fast / close borders and cost themselves a lot of money in the short term.

This is rational behavior. Voters cannot distinguish proactive spending from embezzlement. Politicians need to allow the problem to occur to prove that the money is actually needed.

In the case of covid - it would have happened everywhere else. So they would just have looked incredible le smart.

But with IT stuff, yeah it’s tough to justify - but maybe after things like this happen it will be easier. Sometimes you need a Pearl harbour to get stuff done!

Re: Irish health service hit by cyber attack

#115

Post by sumtechguy » Fri, May 14, 2021, 2:36 PM UTC

jl6 wrote: post #98

golergka wrote: post #97

Earlier quoted context omitted.

To be honest, it seems like a lot of part-time hobby projects created by single engineers have better security practices than whole government agencies.

And there’s a good reason for that - security is a human activity as well as a technology, and the more people involved in an organization, the greater the opportunity for miscommunication and diffusion of responsibility. It’s easier to get it right when you can put your arms around the whole thing.

Very good points. I would add these as well.

There is another facet to all of this. Money. Just plain old money. It takes time and money to buy and maintain this sort of software.

The 'hobbyist' also has plenty of time and access to the tools. Whereas an org may only have so much budget for it. Which in effect restricts time to do it, and or how many people you can pay to do it. Also depending on the org you may not even have access to the correct tools and documentation.

From a pure user 'end point' usage the security stuff is either in the way or 'just works'. Fixing security is background and does not get you anything new. So it often gets forgotten or downgraded in a budget game for something more shiny as the user lets out their inner verruca salt.

Re: Irish health service hit by cyber attack

#116

Post by rjmunro » Fri, May 14, 2021, 2:42 PM UTC

grumple wrote: post #67

xen2xen1 wrote: post #66

Earlier quoted context omitted.

Complete, tested tape backups would cure many, many ills. They're out of fashion, but..

Tape backups are ok but still mean significant operational downtime because recovery from tape is slow. This is better for long term data storage than rapid recovery. For recovery, you need more accessible backups. And to test your backup plan.

The time to restore from backups after a ransomware attack is more about figuring out how they got in and closing any back doors then cleaning out the existing systems, applying the latest security updates etc., rather than actually restoring the backups from tape or whatever.

The last thing you want is for your backup to restore whatever back door they installed a few weeks before they launched the actual attack, or to leave the unpatched system (or whatever it was) open and immediately have the attackers encrypt all your files again.

Re: Irish health service hit by cyber attack

#117

Post by coldcode » Fri, May 14, 2021, 2:43 PM UTC

nikhizzle wrote: post #55

new_here wrote: post #21

A lot of these articles don't actually mention specifically how the systems were compromised. Was it a malicious email attachment that propagated through unsecured networks or outdated OS versions? And what data was encrypted? Are we talking regular excel files or actual databases? It would be interesting to have some more detail or case studies so others could know how to fortify infection points and limit the blast…

So I don't have details on this specific case, but I did work in cybersecurity and can comment on the vast majority of similar cases I saw, including some which made the front page. Every single one I remember came from unpatched OS vulnerabilities for which the patch was already available. Regular patching is necessary hygiene for corporate IT, but often the department is understaffed, or frankly told by management…

Missed patching on what, is my question. Windows, MacOS, Linux, routers, servers, networking, etc. - what exactly is being attacked? Sure you should patch everything, but clearly something is being attacked more than others.

Re: Irish health service hit by cyber attack

#118

Post by rjmunro » Fri, May 14, 2021, 2:45 PM UTC

swiley wrote: post #77

kasperni wrote: post #2

Ransomware: Another great "feature" of difficult to trace digital currencies.

This was done before crypto currencies.

But it only became a serious problem because of them.

Re: Irish health service hit by cyber attack

#119

Post by LinuxBender » Fri, May 14, 2021, 2:48 PM UTC

jl6 wrote: post #64

I have a feeling there is a very short security-hygiene checklist that, if followed, could prevent the vast majority of the ransomware attacked that we have seen in the last few years. * Keep all systems up to date with the latest patches. * Have a DR plan and test it regularly. * Make frequent backups, verify them, and keep them offline . Historically organizations have been so bad at backups that the advice has bee…

I would like to add a couple of ideas to the list.

* Also ensure your Production and DR do not use the same automation, or that there is full segmentation in your automation so that if automation goes sideways, or is compromised, your Production and DR are not simultaneously blown away or encrypted.

* If you can't keep backups offline, at least write them to a write-only destination and/or have an enforced vaulting policy that keeps {n} copies in multiple locations and can't even be deleted by super-users. Deletion must require multiple VP's using MFA to log into a thing and "turn a key" so to speak.

Re: Irish health service hit by cyber attack

#120

Post by mywacaday » Fri, May 14, 2021, 2:56 PM UTC

new_here wrote: post #21

A lot of these articles don't actually mention specifically how the systems were compromised. Was it a malicious email attachment that propagated through unsecured networks or outdated OS versions? And what data was encrypted? Are we talking regular excel files or actual databases? It would be interesting to have some more detail or case studies so others could know how to fortify infection points and limit the blast…

I had a hospital appointment this morning, physio said that the attack happened in one hospital and all IT systems were shutdown to prevent it spreading. They were back to paper to manage all appointments. She said the big issue was bed allocation, live count of available beds no longer available and people running between different departments to see if people can be admitted and/or ringing other hospitals to find available beds. Luckily ambulance and COVID vaccination systems not impacted.