NHS cyber attack ..

Bridgehouse · May 2017

Jalapeno said:

Axe_meister said:

I know a number of project managers/IT consultants (myself included) who got burnt on the NHS project for telling the truth and not following the Party line.

The chap running it was a totally arrogant knobber IIRC

A government IT project run by an arrogant knobber? Oh come on, get outta here, you lost all credibility with that statement etc..

Myranda · May 2017

monquixote said:

Nitefly said:

I'm reminded of the Y2K fiasco...

Surely this is the opposite?

In that no one bothered to prepare, but the cost will be huge, rather than everyone prepared the shit out of things, but cost virtually nothing (in damages)?

Fretwired said:

Labour on the offensive:

Labour's five questions for Hunt over NHS cyber-attack

Labour has called on Health Secretary Jeremy Hunt to outline the "immediate steps" the government is taking to improve NHS cyber-security.

In a letter to Mr Hunt, shadow health secretary Jonathan Ashworth says the incident "highlights the risk to data security within our modern health service and reinforces the need for cyber-security to be at the heart of government planning".

While condemning the criminals who carried out yesterday's attack that put patient well-being at risk, Mr Ashworth wants the government to respond to the following questions:
Why NHS organisations failed to act on a critical note from Microsoft two months ago?
What additional resources are being given to the NHS to bring the situation under control as soon as possible?
What arrangements are currently in place to protect the NHS against cyber-attacks?
Whether the government will launch a full, independent inquiry into the events of yesterday?
What reassurance is there that patient data has not been accessed or compromised?
Apparently the reason Hunt has remained silent is the fact that cyber attacks come under the remit of the Home Office ... you couldn't make this up.

People in glass houses... Labour spent billions failing to upgrade the NHS computer system - so much wasted money that it's the number one example of IT project failures - estimates between £12 billion and £19 billion for a database - which was scrapped... (found a reference to £12 billion, and lectures at uni place it at "up to £19 billion" I don't have access to last years lecture notes so can't check if there's a reference)

I mean, there will be people in the labour party now who were directly responsible for the worlds largest IT fuck-up so throwing rocks about this security fubar might dredge up the fact that had there not been billions thrown down the toilet there *might* have been plenty for upgrading systems so XP wasn't involved... or perhaps enough money to train staff at the NHS to not open every email attachment and click on every link... or both...

digitalscream · May 2017

@Myranda - precisely, on all points.

TheBlueWolf · May 2017

I've no doubt Labour royally fucked up too, but questions need answering right now, the first of which should be why, despite having huge wads of cash thrown at it, the NHS are still using XP.

No doubt there'll be rumblings along the lines of lessons being learnt but it's been quite the cock up.

capo4th · May 2017

Myranda said:

monquixote said:

Nitefly said:

I'm reminded of the Y2K fiasco...

Surely this is the opposite?

In that no one bothered to prepare, but the cost will be huge, rather than everyone prepared the shit out of things, but cost virtually nothing (in damages)?

Fretwired said:

Labour on the offensive:

Labour's five questions for Hunt over NHS cyber-attack

Labour has called on Health Secretary Jeremy Hunt to outline the "immediate steps" the government is taking to improve NHS cyber-security.

In a letter to Mr Hunt, shadow health secretary Jonathan Ashworth says the incident "highlights the risk to data security within our modern health service and reinforces the need for cyber-security to be at the heart of government planning".

While condemning the criminals who carried out yesterday's attack that put patient well-being at risk, Mr Ashworth wants the government to respond to the following questions:
Why NHS organisations failed to act on a critical note from Microsoft two months ago?
What additional resources are being given to the NHS to bring the situation under control as soon as possible?
What arrangements are currently in place to protect the NHS against cyber-attacks?
Whether the government will launch a full, independent inquiry into the events of yesterday?
What reassurance is there that patient data has not been accessed or compromised?
Apparently the reason Hunt has remained silent is the fact that cyber attacks come under the remit of the Home Office ... you couldn't make this up.

People in glass houses... Labour spent billions failing to upgrade the NHS computer system - so much wasted money that it's the number one example of IT project failures - estimates between £12 billion and £19 billion for a database - which was scrapped... (found a reference to £12 billion, and lectures at uni place it at "up to £19 billion" I don't have access to last years lecture notes so can't check if there's a reference)

I mean, there will be people in the labour party now who were directly responsible for the worlds largest IT fuck-up so throwing rocks about this security fubar might dredge up the fact that had there not been billions thrown down the toilet there *might* have been plenty for upgrading systems so XP wasn't involved... or perhaps enough money to train staff at the NHS to not open every email attachment and click on every link... or both...

£1billion or £19billion it is a catastrophic amount of money wasted by Labour they should all hang their heads in shame at this abysmal failure.

Then they claim they need more £Billions to waste on other areas.

They couldn't organise a kids birthday party let alone run the country fookin arse holes.

Myranda · May 2017

TheBlueWolf said:

I've no doubt Labour royally fucked up too, but questions need answering right now, the first of which should be why, despite having huge wads of cash thrown at it, the NHS are still using XP.

No doubt there'll be rumblings along the lines of lessons being learnt but it's been quite the cock up.

Presumably something to do with the cost - given how tight the budgets are someone would have to have the balls to say "We sacked 5,000 nurses to pay for new computers"

According to The Register there are a million+ NHS running XP**. Between hardware, software, installation and training etc it's probably fair to assume at least £1000 per computer... so about £1billion...

Now, the database that labour were responsible for was supposed to cost £6.5 billion it's fair to assume that in part the old system (still in place because the system that was 2-3 times more expensive than it was meant to be) is a reason for keeping XP.

So a cost to upgrade will be somewhere between £1billion-£7.5billion

Which translates to sacking 42,883 - 321,626 nurses at the average nurses wage... unless someone stumps up the extra budget. Budgets were not going up, so as sacking a quarter million nurses would be unpopular there simply wouldn't be the money for it

**https://www.theregister.co.uk/2014/02/12/nhs_microsoft_win_xp_extended_support/
You might look at that and think "But if we're paying for extended support why did this happen?" well this would likely have been a zero day exploit - hence a globally distributed patch *now* being available as soon as it was discovered that the vulnerability exists.

An awful lot of organisations want IT to cost £0 but produce all the results before anyone knew they were needed. I absolutely guarantee that the NHS IT department wanted to upgrade and will have pitched for the budget, but someone will have said something along the lines of "too expensive, make do with what you have - we don't think your doom and gloom projections reflect the real risk"

bingefeller · May 2017

Thank god Northern Ireland hasn't been hit...yet.

As as far as XP goes, I think , we mostly run Windows 7 at least. There is one computer in the office where I work that runs XP and It's only used when staff want to access a specific programme that would cost thousands to upgrade and, because the programme is so specialised, it won't be updated for a long long time. The XP machines, that I know of, can't access the Internet and are only used for certain softwares - everything else on them is disabled.

Vaiai · May 2017

Skim read this but who to blame is not the issue - whoever was in power the issue is still the huge cost to upgrade systems - there are no XP machines in the NHS - a mate of mine was right in the thick of the issues last night and we were discussing how the Govt in 2014 paid 5.5 million to MS for one extra year of support as they still had XP in a lot places.
They are on 7 now but that's still not great altho still under support at least.

The vulnerability was patched in March (iirc) in one of MS security updates but it takes time to roll out these updates as they go through a testing and approval process in most organisations - a lot of places wait until they see info on the patches and their success before deploying

We work with a lot of public sector and the argument for going to VDI (altho many colleges etc are already) is strong in cases like this. Ransomware is useless with a virtual desktop - you can just deploy a new one with the user data ready to go.
We actually sell a product that can restore an encrypted machine from a point 5 seconds before it happened.

Too many companies don't know the difference between backup and DR (Disaster Recovery) solutions - it's getting more scary out there for smaller companies - IT is so important but people don't think that when they look at their budget for the year - linkedIn is already full of people jumping on this opportunity to use the fear but in this case it's justified.

If you lose all your data - what does that mean for your company - it's now more likely for that to happen in a cyber attack than if the building burns down!

My day tomorrow will be advising our customers that their environments are safe - and pointing out to those on older OS and Server versions that we need to talk!

Myranda · May 2017

While it might seem pretty mercenary to say it...

This one event will be the very best thing to happen to millions of IT techs - companies/organisations will shit bricks trying to modernise and prevent something like this happening again.

Also, anyone currently studying for some form of security based qualification *cough* will find themselves in a world with substantially higher demand for security experts (till bosses forget again that security is an ongoing thing)

Fretwired · May 2017

capo4th said:

£1billion or £19billion it is a catastrophic amount of money wasted by Labour they should all hang their heads in shame at this abysmal failure.

The problem is the contract - the main contractors continue to be paid years after the contract was terminated. Same thing with the aircraft carriers - it was too expensive to cancel them .. we have idiots negotiating contracts.

On a positive note my local hospital is up and running .. not as bad as the press reported.

darthed1981 · May 2017

Fretwired said:

The problem is the contract - the main contractors continue to be paid years after the contract was terminated. Same thing with the aircraft carriers - it was too expensive to cancel them .. we have idiots negotiating contracts.

The carrier thing might have been on purpose. When the TSR2 aircraft was cancelled the government didn't just cancel it but ordered the destruction of as much tooling, drawings etc. as they could to stop a future government restarting the program. Doing the opposite, i.e. making the contract impossible to cancel, might make sense to whoever ordered them.

quarky · May 2017

Myranda said:

Also, anyone currently studying for some form of security based qualification *cough* will find themselves in a world with substantially higher demand for security experts (till bosses forget again that security is an ongoing thing)

Very true. I am kind of glad I am running a Windows 10 rollout project at the moment too

Fretwired · May 2017

darthed1981 said:

Fretwired said:

The problem is the contract - the main contractors continue to be paid years after the contract was terminated. Same thing with the aircraft carriers - it was too expensive to cancel them .. we have idiots negotiating contracts.

The carrier thing might have been on purpose. When the TSR2 aircraft was cancelled the government didn't just cancel it but ordered the destruction of as much tooling, drawings etc. as they could to stop a future government restarting the program. Doing the opposite, i.e. making the contract impossible to cancel, might make sense to whoever ordered them.

No - if I was being cruel I'd have said it was Brown as much of the work was carried out in his constituency. In reality its BAE - they have a hold over government (high quality British jobs) so the contracts usually have compensation clauses in the event of cancellation to ensure the workers aren't sacked etc.

stickyfiddle · May 2017

Fretwired said:

capo4th said:

£1billion or £19billion it is a catastrophic amount of money wasted by Labour they should all hang their heads in shame at this abysmal failure.

The problem is the contract - the main contractors continue to be paid years after the contract was terminated. Same thing with the aircraft carriers - it was too expensive to cancel them .. we have idiots negotiating contracts.

On a positive note my local hospital is up and running .. not as bad as the press reported.

Yep. This. In SPADES. All the good lawyers work for corporate law firms who work for the private sector.

But outside the usual Labour vs Conservative nonsense, I'd like to know how much the whole thing is actually the fault of the civil servants who are supposed to be managing everything - I'd bet the majority who actually oversaw the multi-billion-pound fuckup are all still in their jobs. How do you actually get as far as spending 15 billion without producing something that works, *on some level*??

digitalscream · May 2017

Myranda said:

Which translates to sacking 42,883 - 321,626 nurses at the average nurses wage... unless someone stumps up the extra budget. Budgets were not going up, so as sacking a quarter million nurses would be unpopular there simply wouldn't be the money for it

...except no nurses would need to be sacked. Why? Because the IT budget for hospitals is supposed to include hardware/software refreshes. They've simply chosen not to so they can spend that money on other things.

digitalscream · May 2017

stickyfiddle said:

But outside the usual Labour vs Conservative nonsense, I'd like to know how much the whole thing is actually the fault of the civil servants who are supposed to be managing everything - I'd bet the majority who actually oversaw the multi-billion-pound fuckup are all still in their jobs. How do you actually get as far as spending 15 billion without producing something that works, *on some level*??

Bingo. I've always considered the problem with government not to be the people who get elected every four or five years, but the people who are never elected in the first place.

fields5069 · May 2017

Hmmm. It was May who didn't renew the £5.5 million security contract with Microsoft, as I understand it. Her competence knows no beginning.

stickyfiddle · May 2017

fields5069 said:

Hmmm. It was May who didn't renew the £5.5 million security contract with Microsoft, as I understand it. Her competence knows no beginning.

Sure, but she's know for taking advice from those around her. Who told her it was a good idea?

siremoon · May 2017

fields5069 said:

Hmmm. It was May who didn't renew the £5.5 million security contract with Microsoft, as I understand it. Her competence knows no beginning.

Yeah right and as we know May is world famous as a leading authority on IT.

If what you say is true then she did it because someone advised her to. That someone being the Civil Service.

I also have some experience of dealing with Government departments on IT systems and the Civil Service is a huge reason why they often go tits up. Amongst their many qualities Civil Servants usually can't tell you what they want, on the rare occasions they can they change their mind about 2 days later, they won't listen to people who know what they're talking about and they make it as difficult as it is possible to be to roll out fixes and patches even when the integrity of the system is at risk.

digitalscream · May 2017

siremoon said:

fields5069 said:

Hmmm. It was May who didn't renew the £5.5 million security contract with Microsoft, as I understand it. Her competence knows no beginning.

Yeah right and as we know May is world famous as a leading authority on IT.

If what you say is true then she did it because someone advised her to. That someone being the Civil Service.

I also have some experience of dealing with Government departments on IT systems and the Civil Service is a huge reason why they often go tits up. Amongst their many qualities Civil Servants usually can't tell you what they want, on the rare occasions they can they change their mind about 2 days later, they won't listen to people who know what they're talking about and they make it as difficult as it is possible to be to roll out fixes and patches even when the integrity of the system is at risk.

That's because, above all, civil servants (en masse, not necessarily individually) don't want anything to change in my experience of dealing with them. It's the biggest organisation in the country, and none of us are as stupid as all of us.

Howdy, Stranger!

Categories

In this Discussion

Become a Subscriber!

NHS cyber attack ..

Comments