The 2017 attack the largest to have ever hit the health service - PowerPoint PPT Presentation

The 2017 attack – the largest to have ever hit the health service – hit computers at hospitals and GP surgeries across 48 NHS trusts. At least 6,900 NHS appointments were cancelled, and up to 19,000 affected in total, after staff were forced to resort to using pen and paper when they were locked out of computerised systems.

That's partly because there are so many easy targets. More than 36,000 healthcare-related devices in the US alone are easily discoverable on Shodan, a sort of search engine for connected devices, according to a recent Trend Micro survey. Unlike desktop computers and servers that run anti- virus software and other "endpoint" security checks, the diversity of IoT devices and initial lack of concern about their role in network security often makes them trivial to compromise.

• Healthcare Database (48,000 Patients) from Farmington, Missouri, United States It was retrieved from a Microsoft Access database within o their internal network using readily available plaintext usernames and passwords. I have had access to his system since early 2016. • Database (210,000 Patients) from Central/Midwest United States This product is a very large database in plaintext from a o healthcare organization in the Central/Midwest United States. It was retrieved from a severely misconfigured network using readily available plaintext usernames and passwords.healthcare hack • Database (210,000 Patients) from Central/Midwest United States This product is a very large database in plaintext from a o healthcare organization in the Central/Midwest United States. It was retrieved from a severely misconfigured network using readily available plaintext usernames and passwords. • Healthcare Database (397,000 Patients) from Atlanta, Georgia, United States This product is a very large database in plaintext from a o healthcare organization in the state of Georgia. It was retrieved from an accessible internal network using readily available plaintext usernames and passwords.

Are You Ready to Hack A Company?

First Question: Where do we start?

Found a webmail server!!

OK, so we found a webmail server…what now?

What do we do with this ?

Now we are basically done! + =

BUT IT GETS WORSE!!

What About Tracking Down Employees?

Or Targeting Folks in the Nearby Coffee Shop?

#6: Have a plan and test it.

#7: Know who you are going to call.

#8: Recognize the overlap of physical and digital security.

#9: Train Your Employees

#10: Do not be embarrassed!

WE ARE NOT SECURING A NETWORK, WE ARE SECURING LIVES! MEDICAL DEVICES ELECTRONIC HEALTH / MEDICAL RECORDS PERSONAL INFORMATION EMBEDDED HEALTH TECHNOLOGY AUTOMATED DRUG CORPORATE TREATMENTS NETWORKS

b e r e d c y c y b d a r k @ s l e r e C r i V i n c @ o m e d . c k c u b d a r c e @ v i n