Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

cs.dartmouth.edu

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#41

Post by Semaphor »

ssss11 wrote: post #35
jalapenos wrote: post #16

Have had some level of security farce, like described in this paper, in every org I've ever been in. The root cause is failing to hold security staff to a dual mandate: keeping the bad guys out AND keeping the good guys in. Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences. The momen…

Only tangentially related but my wife used to work at a private institute research lab which was affiliated with a large university, and therefore used computing resources. The University IT security staff did a great job enabling 2FA across the entire network.. big job, well done. They didn’t do the slightest bit of requirements analysis of those people using the network such as affiliated research labs. One day my…

> PC3

Physical Containment Level 3 = Biosafety Level 3. I think.

https://en.wikipedia.org/wiki/Biosafety_level#Biosafety_leve...

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#43

Post by MattPalmer1086 »

jalapenos wrote: post #16

Have had some level of security farce, like described in this paper, in every org I've ever been in. The root cause is failing to hold security staff to a dual mandate: keeping the bad guys out AND keeping the good guys in. Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences. The momen…

This is a failure of the business, not security per se. A proper impact analysis of changes should be conducted along with risk analysis to determine if the change is even warranted.

Security themselves aren't usually qualified to know how things will affect everyone and all processes, any more than anyone else is in the business for things outside their domain.

If you allow one bit of the business to run rampant and put their needs ahead of all others, you will get bad outcomes, whether that department is security, or development or IT infrastructure, or marketing, or whoever.

So I disagree with your carrot and stick approach. It's not about holding people who may have a good reason to want something accountable for all the other possible negative effects of it. It requires a business that is properly managing itself and balancing all the differing needs within it.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#44

Post by MattPalmer1086 »

adriancr wrote: post #39
kazinator wrote: post #13

I'm not in healthcare, but I've evaded annoying/inconvenient security crap. One method I used for evading VPNs and using SSH was to have an script running inside the protected network, making an active connection to a SSH server on my machine at home, and set up a tunnel. Then I could use remote desktop through the tunnel. I use the following TXR Lisp program to defeat screen timeouts on Windows: (typedef UINT uint)…

You are likely compromising your employer with this. This is a reverse connection trojan basically and have been around since 2000+. It's weird you haven't been caught yet.

Yep. I found one of my developers doing this once. I had a quiet word with him and told him to stop it, and that we would be actively monitoring. He got the message.

He could just as easily have been fired, or possibly even prosecuted, if someone else had caught him doing it. Maybe he should have been. He was a very good developer though!

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#45

Post by matheusmoreira »

azalemeth wrote: post #33

I've spent a lot of time working as an academic in / out of hospitals. There's a big difference between an academic research centre (where you have, comparatively speaking, a lot of time to sit and think) and the "coal face" of clinical medicine (where the opposite is true). Literally every high-level doctor I have ever worked with: – Knows the passwords of their juniors and shares their password with them – Has a lo…

I have an orthopedist friend. She shared her credentials with one of her residents so he could write down the patient charts. Apparently residents are subhuman doctors in the hospital she worked at because they didn't get accounts to log into the system. The staff was used to sharing their own credentials with them so they could get work done. It was a routine everyday thing.

Then one day a patient died after surgery. Hospital got sued. They pulled up the charts as evidence. Whose name was in there? Hers. She had to legally prove beyond all doubt that she was physically not there in that hospital at the time the event happened and had to explain to a judge that sharing of credentials was routinely done in that hospital.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#46

Post by jalapenos »

ssss11 wrote: post #35
jalapenos wrote: post #16

Have had some level of security farce, like described in this paper, in every org I've ever been in. The root cause is failing to hold security staff to a dual mandate: keeping the bad guys out AND keeping the good guys in. Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences. The momen…

Only tangentially related but my wife used to work at a private institute research lab which was affiliated with a large university, and therefore used computing resources. The University IT security staff did a great job enabling 2FA across the entire network.. big job, well done. They didn’t do the slightest bit of requirements analysis of those people using the network such as affiliated research labs. One day my…

Great case in point. In a well run org, that would've been elevated to a "security incident" just the same as a hack, with their jobs potentially on the line, rather than a week of pleading to them to have mercy.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#47

Post by jalapenos »

hutzlibu wrote: post #37
jalapenos wrote: post #16

Have had some level of security farce, like described in this paper, in every org I've ever been in. The root cause is failing to hold security staff to a dual mandate: keeping the bad guys out AND keeping the good guys in. Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences. The momen…

"The moment they're under carrot-and-stick for not interfering with productivity, as well as preventing intrusions, you get more acceptable outcomes." Suggestions on how to do this?

Give the COO/CTO the last say, not the CISO.

Usually it's the opposite, due to the asymmetry of a terrible unknown and claimed unquestionable remedies vs "it'll certainly slow us down to some degree". The person making the latter argument needs to have far more knowledge in areas outside their domain, and far better debate skills, to prevail. The person arguing the former need only say "hackers" in a solemn tone, to win by default.

Specific security measures should be added at "absolutely needed, beyond reasonable doubt" threshold, not "probably helps", as adjudicated by the leaders of the productive core of the business.

That'd go a long way to stopping them doing nonsense password rolling witch-doctoring.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#48

Post by crabmusket »

> None of this is really surprising to me; any inadequate system seems to have a tendency to create its own shadow workflow that hides problems by working around them.

This reminds me strongly of Seeing Like A State. The formal system only appears to work because it's supported by an informal system devised by actual users.

The system is created according to a "map" or abstraction of the real hospital. But the map is always lacking in detail, may be skewed in various ways, and results in an unrealistic system.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#49

Post by pests »

Danjoe4 wrote: post #23

All healthcare employees have badges they carry everywhere. Just get new ones with chips in them and an associated pin. Add the card scanner dongles for the computers. Access to rooms and supplies that don't need tight security is simply a card tap. Require the pin as well for more important stuff (computer login). Require a biometric as well for really important stuff. Make sure employees know they must report lost/…

Just because I leave my card somewhere useful doesn't mean it's lost and just because Bob has my card doesn't mean it's stolen!

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#50

Post by orbz »

lamontcg wrote: post #19
toomuchtodo wrote: post #15

Earlier quoted context omitted.

Identity and access management is a component of my work at a fintech. The argument isn’t lost on me. A death certificate is a powerful government signal, so while friction should be minimal so as to not be overly burdensome on the practitioner, it is not something you can be careless about from an identity perspective. It calls for strong provenance. If the technology is not transparent, that is a call to improve it…

The legal system can generally deal with anything that falls through the cracks. There's probably not a whole lot of massively society-impacting fraud in the death certificate system if a whole hospital can run off of technically fraudulent records when one guy is signing them all. You could cut down on that by relaxing the technological attempts to "improve" it all and just let the legal system and humans address an…

In this case it’s less fraud and more the fact that it can take months or even years to undo a death certificate during which time one would experience undue hardship. Making it hard to sign is by design.
Post reply on HN