Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

There’s actually published evidence of exactly that!

Where Do Security Policies Come From found that the websites with the most aggressive policies were those with the least incentive to make the system easy-to-use. Big sites like Facebook and Paypal somehow manage to be safe without the strict password requirements of <random university intranet here>. Likely because they have financial incentive to make their systems easy-to-use.

https://www.microsoft.com/en-us/research/wp-content/uploads/...

(Disclaimer: I know one of the authors)

> keeping the bad guys out AND keeping the good guys in.

YES

> Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences.

Every time you push back on some ridiculous policy they'll respond with ironic smirk or shrug (are you seriously forcing password change monthly and keeping hashes of the last 10 passwords?!). Nowadays basically every corporate security policy forces employees to install some kind of crappy DUO/whatever (FUCK YOU CISCO) app on a private phone, work phone is a rare occurence nowadays ("everyone have their own smartphone anyway"). It's never a TOTP which somehow works perfectly fine on many other crucial services. One might think we're all competent tech folks, but they're vicious malicious cunts.

Only tangentially related but my wife used to work at a private institute research lab which was affiliated with a large university, and therefore used computing resources.

The University IT security staff did a great job enabling 2FA across the entire network.. big job, well done. They didn’t do the slightest bit of requirements analysis of those people using the network such as affiliated research labs. One day my wife went to use the computer _in the PC3 lab_ and couldn’t without 2FA. Even logistically getting a computer in - that computer can then never leave the lab. PC3 labs don’t allow you to bring in a phone or anything really.. you’re double gowned, double gloved, goggles etc… hilarious.

Took them about a week to explain themselves sufficiently for IT security to fix it.

"The moment they're under carrot-and-stick for not interfering with productivity, as well as preventing intrusions, you get more acceptable outcomes."

Suggestions on how to do this?

At the exec level, the Chief Information Officer (CIO) is primarily responsible for maintaining availability of the network systems and data, but the Chief Information Security Officer (CISO) is responsible for securing systems and data. Sometimes they are same-level positions and compete for authority + resources. Sometimes CISO is subordinate to CIO. CIO supports profit centers, whereas CISO is entire a cost center and is focused on preventing losses.

The problem is that the competing interests aren’t exactly comparable apples-to-apples. Should every system get OS patches ASAP? Yes if you want to minimize the security surface area. No if the upgrade creates some adverse affect on employee/system. Testing can reveal the latter, but it takes time, which is the enemy of unpatched systems.

Low level IT workers are given instructions and incentives to follow established security procedures (including overseeing patching). Their supervisors are the ones who must make the call when it comes to how much testing is sufficient before forcing those patches.

This is a failure of the business, not security per se. A proper impact analysis of changes should be conducted along with risk analysis to determine if the change is even warranted.

Security themselves aren't usually qualified to know how things will affect everyone and all processes, any more than anyone else is in the business for things outside their domain.

If you allow one bit of the business to run rampant and put their needs ahead of all others, you will get bad outcomes, whether that department is security, or development or IT infrastructure, or marketing, or whoever.

So I disagree with your carrot and stick approach. It's not about holding people who may have a good reason to want something accountable for all the other possible negative effects of it. It requires a business that is properly managing itself and balancing all the differing needs within it.

I feel like the problem with security is the same as with HR. They’re so specialized they often have no other work, so spending a bunch of time on pointless policies just makes their job more secure for them.

This is pretty cool! I’ll have to try it out

You are likely compromising your employer with this.

This is a reverse connection trojan basically and have been around since 2000+.

It's weird you haven't been caught yet.

I thought the whole promise of electronic records was to avoid transcription errors -- if the doctor enters it into the record himself, there's less chance of someone misreading or mistyping his notes later.

It’s complicated, the article mentions problems caused by this, but not problems it helps with.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6611086/ Looks to cut medication errors by 50%.

The "paper security model" leaves quite a bit to be desired and has a lot of efficiency issues itself, but parts of it carried into an EMR wouldn't be terrible.

You might have a terminal that allows anyone to use it if an employee credential/bade is within a certain proximity of the device. You might setup terminals in access controlled areas don't even need this measure of security and are always logged in and available.

Automatic logoff might only happen if an actual security alert is issued for that floor or section. Then you might have a manager who can reopen specific terminals or wait for the security situation to end and have the terminals automatically reopen.

Then all you might need is the terminal to do constant "auditing" of user actions. It could take photographs and do facial recognition of hospital staff when a patient record or action is requested, it could alert internal IT when terminals or staff on one floor access patient information outside of their purview, it could record credential information from RFID badges near the terminal, it could store all this information in a log attached to the record and available to the internal audit team.

Imagine that your embarrassingly slow software literally costs people's health (and maybe even lives in the long run). But we will still pretend like everything is fine, because "the DEveLopEr eXPeRiEncE", and "jUsT buY beTTeR hArDWaRe". And sure, hospital issued PCs aren't fast, but if they are anything from past decades, they still have processors running billions operations per second. And such managing software isn't something demanding either. The fact that it takes any thing longer then your IO bounded critical path is pathetic. It's just tragic how little we actually care today for end user experience, despite all the pretending.

I have an orthopedist friend. She shared her credentials with one of her residents so he could write down the patient charts. Apparently residents are subhuman doctors in the hospital she worked at because they didn't get accounts to log into the system. The staff was used to sharing their own credentials with them so they could get work done. It was a routine everyday thing.

Then one day a patient died after surgery. Hospital got sued. They pulled up the charts as evidence. Whose name was in there? Hers. She had to legally prove beyond all doubt that she was physically not there in that hospital at the time the event happened and had to explain to a judge that sharing of credentials was routinely done in that hospital.

(well an hour after it was posted it was only at 3 votes and looked like it was going nowhere...)

Now you’ll have a bunch of scanners with the cards permanently on top, doors with a card hanging from the handle, and somehow all your staff is fired.

Mission accomplished?

Just because I leave my card somewhere useful doesn't mean it's lost and just because Bob has my card doesn't mean it's stolen!

You forgot the most important thing: make them work without failure. When an access system must communicate with the mothership and the mothership or network is down (hello Microsoft), you're doing it wrong.

Biometrics aren't always reliable, the article mentioned this anecdote:

Another example comes from a city hospital where creating a death certificate requires a doctor's digital thumbprint. Unfortunately for that hospital, there is a single doctor that has thumbs that the digital reader manages to scan, so the doctor ends up signing all the death certificates for that hospital regardless of whose patient the deceased was.

The user may be wearing gloves and a mask.