I’d imagine it would be next to impossible in a sprawling operation like the HSE. Not technically impossible but organisationally they just wouldn’t have been setup to have security operations like that. Once they are in at all the cunts know what to do to create as little noise as possible.
They spent 8 weeks skulking around and slowly moving up the food chain, and even when they raised alerts, they were ignored.
I’ve glanced through the report but they’ve redacted a lot of the nitty gritty technical details.
So even at that late stage they could have stopped it if they just did what they were supposed to? I presume the entire IT security team in the HSE have been fired? Lol
I’ve heard rumours that a comprehensive IT security system overhaul was presented to the board in the months before the attack was rejected as being too costly.
The company provided them with their Anti-virus/security system must also have been doing some monitoring for them. They noticed the HSE team hadnt been responding to threat alerts raised by its software and contacted them to tell them they needed to check it out.
The HSE response was to turn the servers off/on again, which is actually a terrible thing to do when responding to an incident.
The business I’m in myself has I’d say about 3,000 to 4000 accessing the network daily and it would be a small system with very few other external accesses to it, and there’s about 10 in the IT team. How the fuck could you securely manage the HSE with even the 30?
Was that 30 people to be assigned to dedicated Security Operations Centre (SOC) though? I’d imagine their actual IT department has 100s in it.
They have 130k staff.
Health care best practice is something like 1 ICT resources to 40 active it users and spending 3.5% of your annual income on ICT.
I’ve no idea of their IT staff numbers but they were struggling to spend 1.5% of income on ICT up until 2017 anyway. I know Simon Harris put a pressure on since then and some funding was freed up and covid and cyber will now bring it north of 2.5%
HSE outsource all the Covid related stuff now and it’s a fuckfest with repeat notifications and ‘swift queue’ not patching in with Abtran or whoever is making the phone calls and I think there’s another third party banging out additional texts and they must be on piece rate bonus.
HSE need new leadership capable of driving the required reform, like yer man in the Phoenix Park and I’m not talking about Michael D
