CS Sep-Oct 2021

health check
8AM AND I.T. IS IN FOR A VERY TOUGH DAY!
STARK LESSON UNFOLDS IN THE CYBER SECURITY DANGERS THAT ARE LURKING 'OUT THERE'
Cheshire and Merseyside Health and
Care Partnership wanted to find out
how well it would stand up to a
cyber-attack. So, it asked Gemserv Health
to put together a scenario-based response
exercise that started with some seriously
bad news - but uncovered a lot of useful
information.
It's 8am and it was a nice day until you
turned on the radio. The news has just
started and the lead story is that a video
has been released showing a group of
NHS leaders making worrying remarks
about a Covid-19 vaccine.
They seem to be suggesting that safety
issues are being covered up and the share
price of the vaccine maker has crashed
10% overnight. The phone starts ringing.
It's a press officer wanting to know what
IT is going to do about this leak, or fake,
or whatever it is.
CYBER-ATTACKS SPREAD, FAST
This is the scenario that greeted 22 heads
of IT in Cheshire and Merseyside in spring
2021. It was constructed by Gemserv
Health, with input from Cheshire and
Merseyside Health and Care Partnership,
to find out how the integrated care system
(ICS) would respond to a cyber security
incident.
Paul Charnley, digital lead for the ICS,
explains that the commissioners, councils,
hospitals and other providers in the area
have their own policies and procedures
in place. But the ICS didn't have an
overarching response that was tested
and ready to use.
that requires every organisation to plan
for and rehearse its response to a cyberattack,
but one of the things that we
learned from WannaCry is that a cyberincident
can impact a large geography
very quickly," he says. "We need to be able
to coordinate.
"The exercise that we ran really brought
that to life. It was very salutary and very
helpful, and it has given us a lot to think
about. We have learned a lot since
WannaCry, but we are in an arms race
with the hackers and we've still got more
to do."
LEARNING FROM WANNACRY
WannaCry was the worldwide ransomware
attack launched in May 2017. It didn't
target the NHS, but the National Audit
Office estimated that 34% of trusts in
England were impacted anyway.
One reason was that the NHS employs
a lot of people; with 1.3 million staff, it
had a lot of malicious emails to contend
with. Another was that WannaCry spread
through older, unpatched Windows
systems; and the NHS had a lot of those
in computers and medical devices.
However, a third
problem
was that there was no coordinated fightback.
The NAO reported that the
Department of Health had been working
on a plan, but it hadn't been tested at a
local level, so "it was not immediately clear
who should lead the response and there
were problems with communications."
Some trusts couldn't be reached by email
"because they had been infected by
WannaCry or had shut down their email
systems as a precaution", leaving a mix of
switchboards, mobiles and WhatsApp as
the only way through.
ONLY AS STRONG AS WEAKEST LINK
IT leads in Cheshire and Merseyside
wanted to do better. "After WannaCry, we
swore that we would work more closely
together, under the tagline: 'we are only as
strong as our weakest link'," says Charnley.
The 22 heads of IT in the area agreed to
standardise their policies and procedures,
and to pool any funds made available by
the NHS, to make the money go further.
Cheshire and Merseyside HCP is now
working with NHS Digital on a target
cyber-security architecture and on a
procurements process to deliver the
strategy.
"NHS Digital has a data protection toolkit
16
computing security September 2021 @CSMagAndAwards www.computingsecurity.co.uk