Jay Abbott16 May 2017 12:29
Jay Abbott
Executive Director Falanx Group
Don’t attack the NHS!
May 16, 2017 •
More than anything over the last few days I have seen some of the so called industry professionals I have to consider my peers, wax lyrical about how the NHS should have done better. I want to take a minute to explore that statement and offer my own experience and opinion. For the record, if parts of this article offend you, tough.
Over the last 10 years I have had the pleasure of working with a large number of different NHS trusts in the context of a supplier and partner. During this time, I have made a number of observations that make me proud and sad in equal measure.
Firstly, during my entire time, I have not met a single IT or Security Professional in the NHS that does not put patient care or clinical excellence first. They truly understand the impact of a bad decision far more than the average equivalent in the private sector. This is a good thing, but can lead to a higher than normal level of risk aversion. This risk aversion however, has led to some of the most advanced, and amazing network architectures I have ever seen. I have personally worked in network architecture for many years and worked on some very interesting networks with very specific needs so I know what “good” looks like. I actually remember walking into my first NHS trust to do an independent security architecture review and genuinely being blown away by the equipment they had deployed, the overall architecture and way it was managed. Unlike some people have been saying, your typical trust has better connectivity than your average enterprise.
Now, I am not saying every trust is like this as they are all run independently and some invest more than others, but in my personal experience it’s the norm to be on the latest and greatest kit.
Where the infrastructure tends to fall down is on the endpoints. Why? Simple. Because when you spend a million pounds on an MRI scanner and it comes with a windows XP machine, then XP stops being supported and the equipment manufacturer wants an astronomical amount of money for an upgrade, what do you do? Who is really at fault? The NHS or the huge multi-global equipment manufacturer?
So, a good trust does what it does and proceeds to put in numerous countermeasures to isolate and ring-fence that machine as best it can while still allowing patient care and clinical excellence to be its priority.
So let’s look at those countermeasure options:
Patch it – Nope, can’t, doesn’t exit
Isolate it in a dedicated LAN – Sure, but I have 30 doctors in 6 clinical departments on 14 campuses that need to access its data and none of them understand technology enough to deal with any form of air gap, so yeah, if by isolate you mean limit, I’m all in!
Firewall it, see 2.
Prevent malware execution – (a) The manufacture said if we install anything on the box it will crash. (b) we tr