CS Sep-Oct 2021

health check
This has enabled individual organisations
to work to a standard on one
of two security information and event
management systems: one medical
device protection product; and one
single sign-on product to give staff
secure access to clinical and
administrative systems.
"We have worked on our strategy and
then we have moved to manage our
supplier market and our procurement
teams to buy in harmony with that," he
adds. "Gemserv has supported both the
policy and the business models."
FINDING THE GAPS
Cheshire and Merseyside HCP is better
protected against a cyber-attack than it
was five-years ago; but the mantra of
cyber-security is not to ask "if" a cyberincident
is possible but "when" one will
occur.
The scenario-based exercise was
designed to find out how ready the ICS is
to deal with an attack; and whether IT
leaders across the patch are clear about
who will lead the response and how they
should communicate with each other.
Before Covid-19 arrived, the ICS had
been looking to run a physical event,
but because of the pandemic it moved to
Microsoft Teams. Five virtual break-out
rooms were set up for organisational
teams to use, and the scenario was fed
to them.
As the event went on, the teams also
received 'injects' of information to take
the scenario in a different direction and
test their ongoing responses. They got
some 'good' news: the video didn't
feature local executives and was instead
a 'deepfake'. They also received some
'bad' news: one of the executives who
had been deep-faked had also been spear
phished. His email and that of his
contacts had been targeted. A route was
open for a ransomware attack.
NOT IF, BUT WHEN
Charnley says that on the day of the
cyber scenario event, years of hard work
in Cheshire and Merseyside paid off. IT
teams were able to mount a more
coordinated and coherent response to
the Gemserv scenario than they were to
WannaCry.
They also had better tools to use.
However, the exercise showed there were
gaps to fill. The area turned out to be
short of some specific cyber-security
expertise out of hours. There were still
questions about how decisions would be
made that were big enough to require
sign-off from Government departments
in London or the NHS's central bodies in
Leeds.
It emerged that health and local
authority incident response planners
needed a cyber playbook to put
alongside the playbooks they have for
dealing with train wrecks, chemical
spills or even nuclear incidents. Gemserv
Health is now helping to write one, and
when it is ready, Charnley wants to test
it by running the exercise again.
"Gemserv told us that the military builds
things and then attacks them," he says.
"It costs millions of pounds. We don't
have that kind of money, but we can
learn a lot this way. I want to do this
every six-months - certainly every year -
and I think every ICS should be planning
to do the same.
"I'd definitely encourage others to follow
this model and this approach. We
wanted to work with an external partner,
because it's easy to be insular or to play
to your strengths in these exercises.
Having an external view was very helpful.
It gave us a lot of things to think about."
Paul Charnley, digital lead for ICS: no
overarching response in place that was
tested and ready to use.
www.computingsecurity.co.uk @CSMagAndAwards September 2021 computing security
17