The IT Nerd

There has been a ransomware attack at a Manitoba hospital. CBC News has the details:

Shared Health said in a statement Monday it’s responding to what it called “a ransomware incident affecting certain facility maintenance systems.”

Patient care and clinical operations are not affected, the health authority said, urging anyone who needs to attend the hospital to do so.

Clinical services continue uninterrupted, and based on the investigation conducted to date, there is no indication that patients have been affected,” the statement, provided to CBC News by spokesperson Tara Seel, says.

Shared Health said it has launched an investigation to determine the nature and scope of the attack and is reviewing the systems affected by it. No other systems appear to be affected, the statement said.

Shared Health also said it has notified the provincial government and has sought expert advice to try to resolve the problem.

Health Sciences Centre said in an internal memo to staff that it has increased the presence of security and institutional safety officers at hospital entrances while doors are still affected by the attack.

The attack has affected doors, elevators, ventilation and air conditioning.

Kevin Surace, CEO, Token (https://www.linkedin.com/in/ksurace)

“This incident is a vivid demonstration that the boundary between IT and physical infrastructure has disappeared. Doors, elevators, ventilation, access controls and other building systems are now computers with physical consequences. Whether ransomware deliberately manipulates equipment or merely disables the systems used to manage it, an identity compromise can quickly become a safety and operational continuity event.

“We do not yet know how the attackers entered this hospital. But organizations should assume that facilities employees, contractors and vendors with privileged access will be targeted through convincing AI generated phishing and spoofed login sites. Training unfortunately cannot make people resilient against AI generated attacks, and should not carry the burden of protecting critical infrastructure. For identities capable of affecting the physical environment, organizations should require dedicated, hardware bound, phishing resistant authentication with biometric user verification as MFA and even passkeys are regularly compromised. They should also eliminate weaker fallback methods, strictly limit privileges and isolate operational systems from ordinary corporate networks.

“Resilience must mean much more than restoring servers and data. Organizations need to test whether they can place a facility into a safe state, operate critical systems manually, maintain operations while networks are isolated and recover trusted configurations. Those exercises must include IT, facilities, physical security, safety teams and outside service providers. If a ransomware drill ends when the backup is restored, it has not tested the consequence that matters most: whether the physical environment remains safe.”

Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)

“Hospital building systems running on the same network fabric as clinical IT systems is a configuration that has existed for years, and the risk has been understood long before this attack made it visible. The path to disrupting doors and elevators is the same path that leads to patient records, just with a different endpoint on the other side of an unenforced segmentation boundary.

“Organizations that have actually mapped how their OT connects to their enterprise network already know exactly which physical systems are reachable from a compromised workstation, and that knowledge is what determines whether an incident like this stays contained or becomes a headline.”

John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)

“The IT and physical infrastructure have always been very much connected. Very few organizations have a true separation between those two domains. You do run into organizations that have them on separate VLANs, but having them truly segmented and truly separated is incredibly rare. And that’s often done for the purposes of making life easier for day-to-day operations. It’s very hard to operate if you have a full air gap that you have to jump across every time you need to access those physical infrastructure components.

“It always did [impact the physical environment]. And this is one of the problems that you see in a lot of organizations whenever they’re doing their compliance documentation or security assessments. They like to create exceptions.

“Whenever they’re being rated against whatever framework they’re using, whether we’re dealing with HIPAA, NERC CIP, PCI, or something else, organizations love putting up exclusions and saying, ‘The only thing that’s in scope is this specific network segment,’ which just so happens to be the network segment where they have good security. Then they can ignore a lot of the operational and physical technologies that exist elsewhere in their organizations.

“And there’s a reason why they want to ignore it. Many times, patches and standard security technologies like EDR simply aren’t available for those systems. But excluding those systems from an assessment doesn’t make the risk disappear.

“Very, very few [organizations are testing resilience beyond simply restoring systems and data]. Once again, a lot of organizations like to create exceptions and exclusions whenever they’re being tested, evaluated, or going through compliance because they know that a lot of the legacy operational technology implemented in the physical world, things like HVAC systems and door controls, is often very old. Many of these systems have a lot of vulnerabilities. More importantly, they’re very, very expensive to upgrade and replace with up-to-date technology.

This gets into a question that I’m constantly asking our customers whenever we’re doing assessments with them. They’ll say, ‘Well, we don’t worry about this because it’s legacy technology.’ Okay. Having legacy technology is acceptable. Using the fact that it’s legacy technology as a shield to prevent it from ever being tested or ever being updated is not acceptable.

“If organizations know they have legacy technology, especially technology that directly interacts with the physical world, simply deciding that they don’t want to patch or update it is not acceptable. There needs to be a roadmap for when those technologies will be replaced and how the organization is going to replace them.

“But there’s this mentality that exists in a lot of organizations. ‘It’s physical. It makes the doors work.’ Or, ‘It’s physical. It makes the HVAC work.’ Basically, if it ain’t broke, don’t fix it.

“If you’re looking at what’s happening with security right now and how attackers are targeting these systems, it is very much broken.”

I hope that they not only address the means that these threat actors got in and deployed ransomware, but they tell everyone about it so that we learn from their mistakes.