General / Off-Topic NHS cyber-attack: GPs and hospitals hit by ransomware

[beelbeebub]

The problem there is you now have 2 different OS's to try and keep on top of. Two different versions that will need patching and upgrading. Effectively doubling the work required. Generally desktops haven't been an issue for our site, it's been the servers that got hit - and quite badly.We try and keep a standard set of desktops for example, the base build plus any specialist software for a specific department. OS patches for the desktops isn't a major issue as they can be rebuilt easily (even if locked down by this attack it's not an issue as data shouldn't be saved on the desktop, so you just wipe and rebuild). Updates can be easily pushed out overnight for clients. The servers are more difficult, yes patches need to get applied regularly but that also requires down time. Looks like this time the attack came before the patch went onto a number of servers.Happy to report we've completely recovered and all systems are now patched.

interesting. So the computers you see on receptionist desks, or doctors desks or.nurses stations are effectively just thin clients accessing data from.servers?But the computers that (say) a x ray technician uses to pull up data from an x ray machine and then zoom in, crop, maybe do some measurements on etc ..... are they standard desktops with special software or are they custom machines provided by the supplier, I.e. Here's you x ray machine and here's a custom pc with a special interface card and hardware with special drivers and apps loaded in? Are they maintained by the trust or the supplier.

 

[CMDR Heisenberg B. Damned]

interesting. So the computers you see on receptionist desks, or doctors desks or.nurses stations are effectively just thin clients accessing data from.servers?But the computers that (say) a x ray technician uses to pull up data from an x ray machine and then zoom in, crop, maybe do some measurements on etc ..... are they standard desktops with special software or are they custom machines provided by the supplier, I.e. Here's you x ray machine and here's a custom pc with a special interface card and hardware with special drivers and apps loaded in? Are they maintained by the trust or the supplier.

Generally it's bad practice to store data on PC's hard disks (for one thing they're eminently nickable) so then you have data compromised. Do users store things locally at any NHS sites - almost definitely (possibly inconsequential data though). I can only really talk for our sites and not the whole NHS but storing things locally is a no no on a grand scale and locked off wherever possible.

As for the cropping images etc, it's more likely that client software connects to the server and images are never really stored on the PC at all, the client software would allow full access to the right areas of the server as long as the credentials are correct - again that software will be from the external provider, and normally on MS OS's.

There will be some specialised interfaces - Pathology equipment springs to mind as they'll have a lot of custom machines for carrying out test, but these interface machines will feed back to a central server - well generally you'd hope they'd do that, in practice we're in the hands of the supplier of those machines. It may be the best machine for accurately testing for X but the software might not be the best in the world. I don't deal with either Pathology or Radiology though so I can't really expand much on that.

Ultimately all this filters through an Interface Engine, this gets sent information from each system as the systems are updated and then processes information and forwards relevant information to all other servers. A Dr may not have access to the full PACS server (X-Ray - Picture Archiving and Communication System) but if the patient administration system has been told the location of the image then it can link directly to the correct image so the doctor can view it from within that PAS.

Generally PC's are cheap(ish) not very specific, general use machines that should access the data on servers (that are behind locked doors). Just from a data protection point of view that's how it should work. Lock off all systems so only relevant staff have access but allow sharing of information where required.

Of course you'll always end up with exceptions, I'd be surprised if there isn't a VR suite for either performing surgery or at least practicing it. That machine would likely need a graphics card worth more than the rest of the computer.

 

[beelbeebub]

Generally it's bad practice to store data on PC's hard disks (for one thing they're eminently nickable) so then you have data compromised. Do users store things locally at any NHS sites - almost definitely (possibly inconsequential data though). I can only really talk for our sites and not the whole NHS but storing things locally is a no no on a grand scale and locked off wherever possible.

As for the cropping images etc, it's more likely that client software connects to the server and images are never really stored on the PC at all, the client software would allow full access to the right areas of the server as long as the credentials are correct - again that software will be from the external provider, and normally on MS OS's.

There will be some specialised interfaces - Pathology equipment springs to mind as they'll have a lot of custom machines for carrying out test, but these interface machines will feed back to a central server - well generally you'd hope they'd do that, in practice we're in the hands of the supplier of those machines. It may be the best machine for accurately testing for X but the software might not be the best in the world. I don't deal with either Pathology or Radiology though so I can't really expand much on that.

Ultimately all this filters through an Interface Engine, this gets sent information from each system as the systems are updated and then processes information and forwards relevant information to all other servers. A Dr may not have access to the full PACS server (X-Ray - Picture Archiving and Communication System) but if the patient administration system has been told the location of the image then it can link directly to the correct image so the doctor can view it from within that PAS.

Generally PC's are cheap(ish) not very specific, general use machines that should access the data on servers (that are behind locked doors). Just from a data protection point of view that's how it should work. Lock off all systems so only relevant staff have access but allow sharing of information where required.

Of course you'll always end up with exceptions, I'd be surprised if there isn't a VR suite for either performing surgery or at least practicing it. That machine would likely need a graphics card worth more than the rest of the computer.

Thanks, that's sort of what I thought.

So apart from a few specialist output machines (the vr suite you mentioned) almost all the computers are basically thin clients, network.connection and some local i/o?

Would that not be the place that NHSOS would live? Basically a super secure basic Linux os running a very custom "browser" to interact with the servers.

I'm thinking a £40 RPi3, £5 case, £5 psu and £10 sd card (keyboard, mouse an monitor the same as other options) so £60 for a palm sized thin client (less for bulk orders).

The os and "browser" can then be kept very stable, with minimal changes and all the heavy lifting done at the server input side.

So if MRI inc bring out a new scanner using w10 and a specialised new file system, the work is done to convert that into the NHS standards for pictures, videos etc on input to the server and then served up to the same ancient thin client?

At least the NHS won't then be beholden to a third party for the client side. You won't get the smearing of XP, vista, w7,w8,w10.

As all the RPi3's are the same there won't be any "we can't upgrade thus machine because hardware" and there won't be any licence costs as the NHS owns the OS. So it will cost the same to deploy the feature across the entire NHS as for one machine (labour costs aside,but even then if it's just swapping an imaged card out....)

Have I over simplified things too much? I guess the devil is always in the detail, but that we the general thrust