The bit of advisory on micro-segmenting storage of data in a hospitals as a safeguard against ransom-ware attacks caught my attention in this article. Having spent my career with clients who need to get better organized around data to help them serve their customers better, this is counter-intuitive at first blush but then it starts to make sense. If there is no systematic way to connect the the dots between the data about a patient, their treatments past and present then it would be impossible to target anyone specifically or completely. There is definitely protection in that. All the medical devices if working in air-gapped mode are also similarly safe from attacks.
The more you fragment the data and keep each in its own bin with no way to connect multiple bins except via spreadsheet, then you have significantly reduced the risk of a ransomware attack. On the patient end of things, the experience will be horrendous with lack of a holistic view of what is going on with them. It will be ironic if the ransomware attacks get to the point where organizations decide to degrade technology to the point they cannot be victims. Not much anyone can do if your company goes off the grid entirely and keeps their data in local computers with back-ups in physical vaults. The speed of business will be greatly reduced, operational inefficiencies will rise but patients will likely remain safe even if the quality of care suffers.
Comments