> as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess?

Sort of. Unless the cost and frequency of ransomware incidents are absurdly low, it makes sense to borrow to upgrade. Putting aside the moral hazard of being a compliant mark, there is the risk that the next attack won't be as cheap.

Their vendor ought to figure out the hospital's mean annual ransom payment, and come up with financing for an upgraded system that comes out to that amount. Now the cost is locked in, while the variance is sharply reduced. (No risk ever goes to zero.)

Excellent comment, and indeed this seems like a much saner approach. I guess one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner.

> one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner

Bundle the financing with cybersecurity insurance.

Normalizing cyber crime like this seems incredibly bad.

Just think when stealing patient and financial information becomes more profitable than what regular ransom ware demands net.

Even more, perhaps targeted assassination based on screwing up data? Demanding silence and cooperation for whatever the cyber-criminal do?

Redesigning your environment is hard and expensive so it's easy to see why hospitals and similar industries are so behind and vulnerable.

BUT, given that important data needs to be backed up anyway, most commodity backup software and commodity storage platforms are sufficient to restore encrypted data. Even Windows shadow copying feature (which lots of storage platforms will expose snapshots/revisions as) is pretty sufficient to prevent significant data loss.

So unless the ransom cost is cheaper than an IT tech reimaging/rebuilding the machine + compliance costs, it doesn't really make sense.

It's not really fair to bring Cerner into this. The security vulnerabilities that enable these malware attacks are unlikely to be in Cerner applications. Instead it's usually an OS or email problem.

Seconded this.

My wife is a resident. Nearly every EMR she's used, has been either Citrix or Remote Desktop based.

Perhaps a dumb question... How does ransomware propagate from end-user PCs to the servers that host critical applications and data? Surely, they don't allow end-users to run email or access the web from "secure" servers?

IIRC the modus operandi for at least a few of these large ransomware attacks was that the initial attackers who succeed in phishing or whatever would install a remote backdoor there and sell the access for something like $2-10k to professional teams who have the infrastructure and capacity to handle it "properly" - use that foothold to spread across all the workstations, gain user credentials to access servers and destroy backups, and then trigger ransomware everywhere at once perhaps a week after the initial infection, transforming it from a driveby nuisance to a targeted attack that's hard to recover from and that can justify a big payout. Some of the victims had reasonable backups, but they were intended for disaster recovery, not malicious action; so they were accessible from the compromised machines and thus could be disabled or destroyed.

An automated attack that manages to hit a random workstation can extract a ransom of a couple hundred dollars; but if they invest a couple day's hacker labor to move deeper, then there are many public cases of $50 000 - $500 000 ransoms paid, and multiple cases such as Baltimore city and Atlanta city which suffered losses in excess of $10m as a result of not paying the ransoms.

Unfortunately many of the applications in this space basically operate by placing the "database" on a file share that people have access to. This also involves heavy use of OpLocks, causing you to be required to neglect security advise to disable SMBv1. Even without without malware gaining RCE on the server, the end result is encrypted server data.

I'm not sure how the terminals are organized in terms of how locked down they are, but it's specifically occurring on the terminals they use for accessing patient data; they all freeze up simultaneously. It stops the entire hospital from operating each time until IT pays the bill.

That makes me wonder whether the usual malware came from phishing or vulnerabilities.

If it's phishing, typical staff clicking suspicious emails and opening URLs and attachments, there isn't a lot the hospital can do to stop it. A bit of blocking around external emails and shady attachments will help, but people will still fall for it quite often.

If it's remote vulnerabilities, probably some unpatched systems, it's risky because that could parallelize the whole hospital anytime, but as long as the vulnerability is patched by the ransomware it's still cheaper than doing the maintenance.

The impact of staff clicking suspicious emails can be almost entirely eliminated by severely restricting user permissions. Only a special set of administrator accounts should be allowed to execute untrusted binaries. Regular users can only run trusted whitelisted applications.