SMS for 2FA isn't good, but it's still better than no 2FA at all.

Depending on how many systems they have it integrated with that could end up being a huge undertaking for them and they've probably been cut to the point where another huge undertaking may not be in the cards right now. If they're like a lot of large enterprises they may also still be trying to get rid of Windows 7 and Server 2008R2.

Edit: for example, are you full on Microsoft 365 Enterprise with Azure AD? I believe that has ties in with Microsoft's Authenticator app. If you're strictly onsite traditional AD I think you'd need to look at Duo for 2fa that integrates nicely with AD, then also see what else you need to integrate it with that uses its own separate non - SSO authentication.

And while it's not huge, the question of "who's paying for the $3/6/9 monthly per user charges (contact sales if you have > 500 users)?" will come up, particularly if there are hundreds or thousands of external medical office users able to sign in through a portal system as well. (this is based on pricing from the Duo website)

Yes, I’m sure they have their reasons and their own priorities and constraints. Just like the doctors who decline to use basic authentication. See my point? Hospitals are notorious for passing the buck around.

As it happens there is a single web property for accessing a remote desktop, not multiple systems, and the hospital down the road funded by the same entity has implemented TOTP authentication.

Curious, why would a doctor decline to use basic password auth?

I have had a doctor tell me that his time was too important to waste it typing passwords. I had another one tell me, quite dramatically, "someone could die" while he was typing in a password. It's a profession where many have an "interesting" perspective on information protection. I have tons of tragicomic security stories from dealing with health care providers.

And they are right. Passwords are probably the wrong thing. Give the doctors a hardware token, a smartcard (and fit smartcard readers to everything doctors might expect to use) or use biometrics.

Might some doctors leave the smartcard in the reader for a PC they often use, then walk away? Yes, yes they might, and that is a behaviour you can start fighting with peer pressure, but doctors are right to think passwords are a waste of their time.

>And they are right. Passwords are probably the wrong thing. Give the doctors a hardware token, a smartcard (and fit smartcard readers to everything doctors might expect to use) or use biometrics.

This is spot on and in most cases this is the way most hospitals are moving, particularly by using the already-assigned ID badges as RFID tokens. But as I mentioned in a couple of other comments farther down, I have experienced situations in which even this is something that doctors refuse (in one case, because they were upset that we were asking them to keep their ID badge with them, which they apparently had a problem with doing).

It's the most frictionless solution I've seen in widespread adoption and probably the least prone to pushback, but that doesn't mean there's no pushback, which is the unfortunate point of my original comment at the top of the thread.

> And they are right. Passwords are probably the wrong thing. Give the doctors a hardware token, a smartcard (and fit smartcard readers to everything doctors might expect to use) or use biometrics.

> Might some doctors leave the smartcard in the reader for a PC they often use, then walk away? Yes, yes they might, and that is a behaviour you can start fighting with peer pressure, but doctors are right to think passwords are a waste of their time.

At least the hospitals I've been to this is implemented as an rfid tag on their id badge, so it doubles as access control both for physical and software systems (as well as functioning as a charge card of sorts against the employee's company account for things like the cafeteria).

Yes password are annoyance, friction and waste of time. Not to mention 2FA that is worse. For the Dr, his upmost concern is to treat the patient not deal with extra layer of annoyance.

As an IT or security personel your job is to support them and assure security without creating extra friction or productivity loss. Yes it is hard but that is the challenge.

This is what a often neglected by security professional and just blaming the user.

Hey, thanks for the condescension. You know what else our job as "security personel" (sic) is? Other than literacy, it's matching controls to risk. The guy who talked about "people dying" was a urologist; I can assure you the no one was going to die in his office because of passwords. So, yes, we should reduce friction where it's appropriate, but unless you understand the actual risk model, maybe you should keep your comments to yourself.

> The guy who talked about "people dying" was a urologist; I can assure you the no one was going to die in his office because of passwords.

I know of exactly one case where you would have been completely wrong. Emergency surgery straight from the urologists office is what saved the patient. Some people simply go to the hospital much too late when they have issues.

"people dying" might be exaggerated but nonetheless because of the password he is inconvenienced.

So you have to come up with different method.

For the security personal, Dr is the customer, customer is king.

The doctor is not the customer. The doctor and security personnel are coworkers in a business where the customer is the patient who is being treated and who's sensitive data is being stored.

It is indeed the shared responsibility of the security team to keep in mind that the customer requires quality medical care, and security should not interfere with that. Similarly, it is also the shared responsibility of the doctor to keep in mind that the customer also requires that their data remain secure, and their ludditism should not interfere with that, either.

Said much better than I could.

So the doctor has to ensure security in addition of treating patient? Why do we need security professional then ?

Yes, everyone has to participate in ensuring security; how completely divorced from reality do you have to be to think otherwise. And we need security professionals to remind everyone that security is important and we all have to be part of ensuring it.

Sure but if it become annoying then most people, including me will choose convinience over security every time.

That's where I critize security professional. They often disregard this end user pain.

You have to find frictionless solution and shouldn't impact their productivity.

It is your responsibility to participate in the security of your customer's information. It is your fault if you "choose convenience over security". It is not anyone else's fault.

Ask yourself how you would feel if your bank just let someone access your account and steal your money. Would you forgive them if the bank said "well it would have been really annoying to have to check the person's identity before letting them take the money, so we chose convenience over security"? Of course not.

Security professionals are there to guide you and make security tools easier and less intrusive for you to use (and believe me, they want to make it easier for you, if only for the entirely self-serving reason of reducing the amounts of complaints they get), but even if the security tools are hard to use, it is your responsibility to still use them. You are not doing your job if you disregard them, and "it's annoying" is absolutely, 1000% not an excuse for potentially exposing the sensitive information of every one of your customers.

Trying to shift security to end user wouldn't improve security. Most people value convenience over security.

Then the bank is not doing a good job. Its the bank responsibility to secure my account. How they do it is up to them . I don't really care what method they use as long as from my perspective its frictionless and not annoying.

If you make security tools that is hard to use, then you are not doing a good job, be prepare for push back and consequently less secure environment.

As recently as maybe 20 years ago we learned a lot patient infection in hospital was caused by patient-to-doctor-to-patient transfer. Things like disposable gloves and hand cleaning stations at every bed were resisted by doctors initially as being over the top. Now they are ubiquitous once the benefits were proven. Maybe the same approach for IT as for germ security can be demonstrated, and that everyone needs to participate.

Or maybe make it easier, less annoying to use.

If people are supposed to look after their own health, why do they need doctors?

> Curious, why would a doctor decline to use basic password auth?

I'm not a (medical) doctor and I decline to use password authentication as well. Give me public key access or fuck off.

What happens if they forget their password?

From experience, users who come to IT and simply demand we do something because 'reasons' usually aren't prioritized for follow up.

Managers who come to IT and demand we do something and show us how it affects their work/department and perhaps the rest of the business and offer to be part of the solution making process often get first class attention.

Could it be IT is blowing you off because of how you're delivering your complaint about SMS 2FA without regard for their existing workload?

They likely have more than enough on their plates as it is to simply do something because someone from a department said something about it, and IT doesn't exactly pivot on lithium battery, especially in hospitals. That doesn't mean they don't care about your issue or request, but like every other department they have objectives and goals that were likely set well before your 2FA conversation even began.

You realise what you just did there right, without a hint of irony?

I hear you and I’m sure it’s frustrating, but I’d be curious to know if the security team has any reasons for sticking with SMS 2FA. I’d be willing to bet money that the reason they blow you off is because it’s a sore spot for them. They probably have tried to implement other MFA methods but were reprimanded by the medical staff because anything other than SMS is too complicated (I’m harping on doctors a lot, but I legitimately do cringe at the thought of even asking a typical MD to download an MFA app or carry around a physical token).

No, this is not the case. Anyway, it would be good just to have the option to not use SMS, they don’t need to migrate everyone off SMS at once.

> I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot.

Well... yeah. Nobody is sim swapping hospital staff.

It’s not great, but this isn’t a real threat they’re facing.

There are clearly targeted phishing attempts, I wouldn’t rule it out.

Edit: I should add, I was very surprised when I got a phishing email sent by the obviously compromised email account of a colleague, and when I emailed them to say their email was hacked, the person who hacked them replied telling me everything was OK, and to open the attachment.

You'd be surprised how much money flows through the medical system.

And how much of that flows through automated systems.

And how little of the total is actually audited on a detailed level.

>You'd be surprised how much money flows through the medical system

I wouldn’t, I just know that the crowd targeting hospitals for wire fraud is very different from the sim swappers.

It’s possible that this may change at some point, but that hasn’t happened yet and probably isn’t going to. Phishing is so easy and successful that SIM swapping just doesn’t make sense for these targets.

Porn fiends? Doctors don't have the time. But you must admit that the profession brings out some very arrogant traits. They usually express the pointof view that they learned everything they needed to at med school and any new outside information is suspect and not important including IT security.

I'm not sure how to reply to your comment. I know a lot of doctors personally, and less than 1% are what I would describe as very arrogant. Some specialties probably enrich for arrogant people, particularly cardiothoracics, cardiology or neurosurgery at large prestigious institutions, and some countries have a system which tends to permit arrogance (eg the USA).

“But you must admit that the profession brings out some very arrogant traits.”

Which one? You know we’re also talking about programmers, right?

In my experience, you are way off base. Doctors can be very arrogant but I've never met someone from another profession who could point me to research articles regarding their proposed plan of action. Doctors at major hospitals are often either a) residents who are in their nth year of leaning post med school, or b) expected to publish at least case study papers regularly or communicate with those that do.