My book Philosophy of Cybersecurity tackles a broad domain from systems cybersecurity, user's aspects, healthcare, critical infrastructure security, to policy and politics matters, international law, and cyberwarfare.
@LukaszOlejnik Except the part of the security triad that says "Availability." You can "prioritize" all you like, but if the AED don't work, or if the surgeons can't log in, the centrality of "security" to the primary mission of "provision of health services" is the fuzzy end of that particular lollipop.
@LukaszOlejnik I would push gently back on that. Consider this reporting from May by Farah Yousry of Side Effects Public Media about utter chaos at a hospital that refused to pay ransomware criminals (link below):
"Leaders decided to disconnect after the attack, assess, and then rebuild, which meant taking several critical systems offline. That upended normal operations in various departments.
"The emergency department had to divert ambulances with sick patients to other hospitals because the staff couldn't access patient medical records.
"In the obstetrics unit, newborns usually wear security bracelets around their tiny legs to prevent unauthorized adults from moving the infant or leaving the unit with them. When that tracking system went dark, staff members had to physically guard the unit doors."
I think that the centrality of information technology to contemporary healthcare is such that while pencils can fill in a gap of minutes, when it gets to hours, days, or months, loss of IT services (a breach of availability) kills. It also costs one hell of a lot of money more than was previously "saved" by deferring investment into reasonable security.
Mostly reasonable for most operations that could at least minimally work, even with some hightech medical devices operating without connectivity always on...
...nevertheless without planning for such eventualities, then the final resort still remains on retired employees – familiar with the old paper system – volunteering ;)
I’m quite happy with the scenarios-case studies in Philosophy of Cybersecurity. With conceptual details, of course. And obviously only for education purposes.
@LukaszOlejnik
To not look far, since I'm attached to one, AndroidAPS / OpenAPS are examples of personal systems that when attacked and subverted can result in death.
Add comment