Nhs network security

DavidP24

woody2234 wrote: »

Can the NHS do a factory reset on there PCs ie long press the power button and press F5 or F8 or whichever F key like I can on my HP laptop, would that get rid of the ransomware

Like most corporate IT departments the restore partitions are deleted for security reasons (you would not want users rebuilding systems.

They have a "build" that includes all software they need, most of it is just icons launching remote software that runs in NHS intranet.

Some Doctors have Laptops because they do research or stats, they have network drives and store their data on those drives, anything they keep locally is either vacuumed up or is their responsibility but they are not allowed to take identifiable patient data home. They have reporting systems that export the data for that purpose.

Some departments still do patient letters and believe it or not they send some audio to India to be transcribed, it then has to be checked when brought back.

There is massive potential for improvement but no money.

When something like this happens they tend to nuke the disks and give them rebuilt machines.

debitcardmayhem

Frozen_up_north wrote: »

And Health Secretary Jeremy Hunt cancelled it in 2015 as a cost-saving measure

Oh another dig at the Tories from one assumes a Labour follower with Alzheimers who cannot remember who invented PFI to get things off the government books, oh and that they were in power when Vista came out , and when Windows 7 / 2008 server also came out. Blame everything on the Government of the day so it makes them feel good. Pah.... it's a tech forum not speakers corner.

esuhl

Le_Kirk wrote: »

Well, 12 posts and nobody has mentioned replacing XP with Linux. Come on chaps you are slipping!!

To be honest, I'm wondering if the NHS would be better of using GNU/Linux in a lot of situations, and restricting Windows to medical devices with custom software that would be too costly to upgrade.

I'm no expert in corporate networks, and I don't know how the NHS networks are set up, so I wonder how the support costs and scalability of Linux would compare to Windows. I'd guess it would be relatively(!) easy to move the patient records system to Linux... and leave Windows on systems that absolutely need it...?

Although, with the NHS being killed off due to underfunding, I can't see any money being spent on the IT system for a while.

DavidP24

kwikbreaks wrote: »

From that particular vulnerability yes but it seems many are still running a 17 year old version of Windows which has no regular routine support and doubtless umpteen other vulnerabilities waiting discovery and exploitation.

BTW XP came out in Oct 2001 so not quite 16 years ago, they DO have support and it is patched. It is also in a closed network, although I suspect that it is the public wifi that brought this into the organisations affected and that those sites did not keep them separate. That is unusual because they usually have VPN's for each department to keep Chinese walls between data and to manage traffic efficiently.

I heard guy on Radio this morning who is responsible for 15,000 systems across 5 sites for 15,000 staff, they have all been checked overnight and are all up to date. 4 were XP but they were not connected to the network, they are used with medical equipment that only works with XP.

I do not think people understand the sheer size of the NHS, not sure if is still the case but not ling ago there are only two organisations in the world who employ more people than the NHS.

There are over 415 Trusts, over 1200 hospitals and thousands of satellites building as well as GP surgeries. that one Trust I mentioned earlier is in London and employs 15,000.

Only just over 40 NHS sites were infected in one form or another, the problem is that when something like this happens they shut down everything to stop it spreading while they assess and it is that which is impacting the NHS services.

The front desk of each of those hospitals has at least 3 computers, that is 3600, the same applies to each department, A&E, Cardiology, Renal, etc. Most deliver their updates via group policy from their own servers which are in turn updated by Microsoft (including XP). I imagine those that did not will face the sack unless they can show they pointed out the issues.

I actually think it could have been a lot worse, the way the NHS intranet is configures means that SMB traffic does not go across it, only within specific domains, say a hospital and it's satellites. There are specific connections between two computing facilities but they are a purely IP network. Had this not been the case it could have caused far more damage.

So they now have found a kill switch for the Ransomware, which was coded to stop if it was able to connect to a domain that had not been registered.

https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack

esuhl

debitcardmayhem wrote: »

Oh another dig at the Tories from one assumes a Labour follower with Alzheimers who cannot remember who invented PFI to get things off the government books, oh and that they were in power when Vista came out , and when Windows 7 / 2008 server also came out. Blame everything on the Government of the day so it makes them feel good. Pah.... it's a tech forum not speakers corner.

I don't know about that, but the Tories are killing the NHS right now! They're deliberately underfunding it, probably hoping that people will lose faith in it and everyone (who can afford it) will buy private insurance.

DavidP24

kwikbreaks wrote: »

A rather depressing but I doubt especially surprising for anybody here insight into the state of IT in the NHS. I seriously doubt any other government departments IT is any better. Come to that most corporates I had anything to do with ran their networks on a wing and a prayer.

Is there anywhere with good secure IT?

The Justice department seems to be well funded, that just means they are good a providing a business case. Military was over funded until a few years ago, were spending way over the top on procurement.

It is like any organisation, you have to show the business case, some people are crap at that.

DavidP24

woody2234 wrote: »

Luckily I updated my windows 7 PC on 19th March 2017 and now updating today and using Avast antivirus and Chrome browser also I found this info today see below

1 Mainstream support for Windows 7 ended on January 13, 2015. This means that no new Service Packs are coming for Windows 7, and no new features will be added to the operating system. It does not, however, mean that Microsoft is no longer patching the operating system.

2 Extended support is still ongoing until January 14, 2020. That’s the date Microsoft will stop issuing new security updates for Windows 7.

To be honest I put a lot of the blame for this squarely at Microsoft's door.

They were doing deals with the likes of BT that were a fraction of what they charged the NHS, which is one of the reasons the NHS would not update.

How many versions of software to they release with bug after bug after bug, service packs, Important Updates, critical updates and every few months another one.

I think it is high time they put a very lite version of Linux or a Wyse type thin client on every desk with an open source version of office run off a server like RDP, so the PC is effectively a thin terminal. The users would still run their central systems via Citrix or Rdesktop etc and there would be no OS or Office costs and no vulnerability.

There would be some training and retraining for some office staff but that would more than be covered by the saved costs.

I saw this implemented in a an organisation recently, at first I thought it was an SFF but it was a a Dell thin client. Reminded me of a thin client solution I saw in 2007, no local software, all ran on servers, was lightning fast because server to server network traffic was on dedicated 10gb lans and remote desktop client is tiny.

DavidP24

esuhl wrote: »

I don't know about that, but the Tories are killing the NHS right now! They're deliberately underfunding it, probably hoping that people will lose faith in it and everyone (who can afford it) will buy private insurance.

You are ABSOLUTELY right, that is the ConGov goal, I was talking to a senior chap in NHS a few weeks back, reckons in real terms they have taken £30bn out of NHS. They have done most of this by not increasing in line with inflation and the increased population.

The ConGov also screwed up by dismantling the SHA's they paid off these shared services, paid £50k redundancies only for the same people to be re-employed by GP's, the difference being that the GP's are now not benefiting from that management being shared. So there might be 5x as many employed

PFI is one the nastiest things in the NHS and yes it is another reason Blair should have been arrested. It has virtually bankrupted some trusts.

If you ask any high earning salesman or effective accounts receivable clerk they will tell you their secret is to work on the big numbers first. PFI is the obvious target to make savings in the NHS and the way to do it is for breach of contract, these contracts fit in a filing cabinet with 4 drawers but there have been many areas where they are not performing. Even buying them out makes financial sense.

When you look at these 415 Trusts, at the top you see boards of Directors, Chairmans and a massive management structure all making the same decisions 415 times. The obvious thing to do here is to merge Trust executives, county by county, region by region, these are the highest paid but honestly some of them are useless and totally dependent on layers of managers.

My merging the management you would free up the clinicians, give them more say over how their departments are run. In some Trusts they split the secretarial admin roles in a programme to cut staff grades from 4 to 2. The result was a Doctor now has to ask 5 different people what is happening with their patient, oh and it did not save any money because they had to employ temps. Go to any job website and you will see NHS roles that make no sense at all, they are invented to deal with crazy rules and targeting.

To understand this mentality you have to compare how the NHS deals with running late vs how a private medical service that has been outsourced does under the same rules. So the NHS service is running say 30m late, so every patient is not seen on time and is inconvenienced. What the private service does it pluck two or three out of the queue and re-arranges to see them another day or at the end of the day. They do the same for surgeries and it just makes their stats look good.

I have never liked the fact that it is the NHS that trains Doctors through Teaching hospitals and programmes within hospitals, yet the private hospitals make no contribution. They poach staff and steal doctors for several days a week. The impact of this is that the Hospital does not have the staff so they have to outsource and sometimes even rent to the very same organisations who are nicking their staff. The NHS is then forced to use agency staff who are paid way more.

Just to be clear, it was Blair who made NHS organisations price everything so he could justify outsourcing services, he privatised more than Thatcher.

I would solve this by limiting working outside the NHS for 25 years, I would make it illegal to work several days for NHS and several for private, so often a Doctor is late for NHS work because of their private clinics.

Even then I would put an increased employer NI obligation to pay back for that training, this would also apply to Doctors who are self employed. I would cease this practice of renting out wards or theatres which would have the impact of building new hospitals in terms of capacity.

I would stop all these Hospital closure plans, if you are in any doubt about the future of hospitals where you live, look for Maternity and A&E being closed or moved or changed, these are the only services with a legal obligation. Once they move them they can close a hospital.

Most Trusts have lost capacity with short term finance gained by selling their land off, now they have not even got room for staff to park, they are telling Nurses to walk or take the bus before and after a 12 hour shift that may finish at 1am. While the executive of course have plenty of parking spaces! I would buy back that housing, use some of it for staff and some to regain what was lost.

The problem is the turkeys who run the NHS at senior levels will never vote for Christmas so they throw front line services and clinicians under the bus.

Meanwhile the ConGov want people to hate the NHS so that they can outsource more services in return for non exec Directorships years later.

unforeseen

via Citrix or Rdesktop etc and there would be no OS or Office costs and no vulnerability.

You do know that Citrix boxes tend to be running on Windows embedded don't you?. Still need licences.

Oh and not forgetting that you still have to pay Citrix for licences based on the number of users

debitcardmayhem

esuhl wrote: »

To be honest
....snipped....
Although, with the NHS being killed off due to underfunding, I can't see any money being spent on the IT system for a while.

Try researching how many failed , unusable and not fit for purpose IT systems there have been in the NHS during the last 20 years, that have been pulled.

Here's one http://www.independent.co.uk/life-style/health-and-families/health-news/nhs-pulls-the-plug-on-its-11bn-it-system-2330906.html
It's not a new phenomenon it's the good old Government of the day putting out to tender a cost saving which never will be. I worked in the NHS until 1979 when we used systems built around ICL / George III and it took a week to get a report back from the Regional HA. The government has always fiddled with the NHS ever since in the name of efficiency. The only thing that was changed was bureaucracy, if they had left what they had then and invested in true patient care the NHS would still be the envy of the world. Every government in the last 40 years has failed the patient, and the staff, but hey I only believe what I know not what politicians and left/right wing press spout off about. I have been married for 30+ years to a former NHS trust CEO