Is SMB 1.0 more vulnerable at the client level or server level
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
The vulnerability comes from maintaining a 12 year old OS on your network in any way shape and form. If it's hosting a share (so another system can grab the files from it) there is added risk.
Understood. If there is an option that allows the client to keep using their working equipment I would like to present it to them. I know the easy answer is to tell someone cough up another $80,000 for something. If it was as simple as buy a new $1,000 computer I would recommend it. The price tag for some equipment is just gouging though. I know it is a reality of running a business.
That they need to cough up for a supported, working machine that is legally applicable to a medical practice is something that they decided when they worked out the support deal on the current one. The XP era had HIPAA and keeping the OS maintained and patched was something that they knew at the time. Don't take on personal liability by recommending something like this. If they demand that you do it against your recommendations, get that in writing that you didn't get a choice. But certainly don't offer it.
@scottalanmiller - I appreciate the feedback. If it can't be done then it can't be done. I can accept that and the client has to as well. Again my goal was to try and come up with a solution that would remove unnecessary steps and make things more streamlined.
That's just it - it clearly can be done, and you found mitigation for it. I'm not suggesting that you do it, but in my mind you would be following the law, just like you are currently following the law by having the machine be completely isolated. You mitigated risks to a 'reasonable' degree. The problem - as Scott and Dustin will so quickly point out is, who decides what reasonable is? The answer is the auditor who gets the claim against you/the clinic when someone complains.
So... you could hire a HIPAA attorney who will sign off on your work-a-round and then be there to defend you if/when that time comes. It's likely this attorney would cost loads less than $80K for a new camera system.
-
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
-
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
The client needs to take images that are on the camera (XP machine) and upload to their EMR.
Current process is the images are printed, scanned, uploaded to EMR.That process uses a lot of human time and degrades the images quite a lot. Seems like they weren't so concerned about the cost when they bought it and chose to do that. This seems crazy financially.
Bottom line, though, there isn't a good answer for this. But it's not your fault or your problem. And no doctor acting this way thinks that $80K is enough money to worry about.
How many doctors offices - not hospitals - doctors offices have you been brought into, said that to them, and didn't get tossed on your ear - and instead they actually said something like " oh geez damn Scott - you're right - we were totally stupid when we bought this and not think about the future ramifications of OS support, etc. Now that our eyes are open, here, here's a damned near blank check - please fix our systems?"
And this a serious question - because I want their names so I can call them and use them as a reference to sell that idea to my guys, or at least my boss.
You treat it like a blank check to fix systems. That's why they don't listen to you. You present it as "this is expensive, but we can do it right". That makes no sense to them... how can expensive be right?
I show how good decisions cost less and talk money, not tech or "doing it right". You are thinking that this is an IT problem, but it's a business problem. Treat it as such and it's really, really hard for even doctors to claim that they hate making money when those are the words that they have to use.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
I'd assume that the drivers for this camera are just built for a 32-bit system. I'd not be surprised if the camera didn't actually work with Windows 10.
Most hardware is usually compatible and in the worst case you'd use the compatibility layer to trick it.
Still raises so many red flags, but not my hat.
With that in mind - specifically install Windows 10 32 bit then try it.
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
He's mitigated the actual security issue, not the false one. But not the violation. There are three issues being kicked around...
- Using SMB 1 is a red herring issue, not the real concern here.
- Using XP is a security concern as it is not patched. This is the real concern (that is mitigated.)
- The HIPAA violation of an unpatched, unsupported OS on the network.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
He's mitigated the actual security issue, not the false one. But not the violation. There are three issues being kicked around...
- Using SMB 1 is a red herring issue, not the real concern here.
- Using XP is a security concern as it is not patched. This is the real concern (that is mitigated.)
- The HIPAA violation of an unpatched, unsupported OS on the network.
Which all 3 can be fixed like this
- Don't use SMB 1
- Don't connect XP to the network
- See point 2
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
What about firewall rules to specific IP addresses?
-
Using an encrypted medium to transfer the files may work, but it would mean that the Tech (or Doctor or whoever) would have to remember a password to decrypt the data/drive.
Which they may not want to do, but likely falls into the HIPAA compliant category.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
What about firewall rules to specific IP addresses?
It's still on the network, what happens if a device lost power? An attacker could just assign that IP address to themselves and get to the system.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
We were in the market to buy a new CT machine last year. ALL but one vendor was using Windows 7, and a few even claimed they had no, zero, zip, zich, nadda plans on going to Windows 10. It's crazy - huge companies too, like Toshiba.
Things like this seem insane. Are you saying that no hospital in the country can have their CT scanners supported? That's not plausible. I have a feeling that something about your vendor selection process involved ruling out real world working solutions and only seriously considering the dregs.
that's definitely possible - I'm not on that team. that said - cost is also a HUGE limiting factor.. i.e. our max is like $500K, a hospital can easily spend 10x that.
-
The encrypted USB drive may be the most appropriate method to do this. Is this XP system in a locked cabinet and only accessible via a lock and key? I ask because if just anyone could plug a USB into this system, then you have other issues to content with.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
Data transfer methods are what hipaa cares about, not the medium.
And? The only mention I recall reading - feel free to post a specific law saying otherwise - is that PHI must be encrypted when going over a non trusted network.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
HIPAA auditors have (in my experience hearing of them) cranky over thumb drives.
Sure - now that I will agree with, but those same auditors are just making shit up.. because they totally forgo things like CD-Roms/DVDs, Google Drive, OneDrive, SMB shares, etc
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
The client needs to take images that are on the camera (XP machine) and upload to their EMR.
Current process is the images are printed, scanned, uploaded to EMR.That process uses a lot of human time and degrades the images quite a lot. Seems like they weren't so concerned about the cost when they bought it and chose to do that. This seems crazy financially.
Bottom line, though, there isn't a good answer for this. But it's not your fault or your problem. And no doctor acting this way thinks that $80K is enough money to worry about.
How many doctors offices - not hospitals - doctors offices have you been brought into, said that to them, and didn't get tossed on your ear - and instead they actually said something like " oh geez damn Scott - you're right - we were totally stupid when we bought this and not think about the future ramifications of OS support, etc. Now that our eyes are open, here, here's a damned near blank check - please fix our systems?"
And this a serious question - because I want their names so I can call them and use them as a reference to sell that idea to my guys, or at least my boss.
You treat it like a blank check to fix systems. That's why they don't listen to you. You present it as "this is expensive, but we can do it right". That makes no sense to them... how can expensive be right?
I show how good decisions cost less and talk money, not tech or "doing it right". You are thinking that this is an IT problem, but it's a business problem. Treat it as such and it's really, really hard for even doctors to claim that they hate making money when those are the words that they have to use.
making money - i.e. not getting sued when something bad happens? I don't get how they make more money by being compliant.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
He's mitigated the actual security issue, not the false one. But not the violation. There are three issues being kicked around...
- Using SMB 1 is a red herring issue, not the real concern here.
- Using XP is a security concern as it is not patched. This is the real concern (that is mitigated.)
- The HIPAA violation of an unpatched, unsupported OS on the network.
Is number 3 an actual violation? I don't think it is... I think if you have mitigation, then 3 isn't a real thing. Unless you have a specific code in the law to point to saying otherwise.
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
Data transfer methods are what hipaa cares about, not the medium.
And? The only mention I recall reading - feel free to post a specific law saying otherwise - is that PHI must be encrypted when going over a non trusted network.
Workstation and Device Security. A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.22 A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).23
Nothing about a network, CD/DVD or any other sort of media.
Meaning that pretty much anything goes, so long as there is a policy and proceedure (and from the main description) "The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form."
Meaning that they don't actually offer any solutions, so long as the process is sound and secures PII.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
Data transfer methods are what hipaa cares about, not the medium.
And? The only mention I recall reading - feel free to post a specific law saying otherwise - is that PHI must be encrypted when going over a non trusted network.
Workstation and Device Security. A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.22 A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).23
Nothing about a network, CD/DVD or any other sort of media.
Meaning that pretty much anything goes, so long as there is a policy and proceedure (and from the main description) "The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form."
Meaning that they don't actually offer any solutions, so long as the process is sound and secures PII.
Thank you for making my point - no where does it say that your USB drives MUST be encrypted, no where does it say your local LAN has to be encrypted (yeah, I know no one has even hinted at this), etc.. You have to have mitigations in place.
If Windows 10 is able to be setup as securely as Scott said earlier - than yeah.. the solution he presented should be viable.
FYI - no reason a licensed Windows 10 machine would be needed here. A raspberry pie with SMB v1 and some other transfer protocol should be able to do this license free.
A script could run on the XP or R-Pie to look for files, then copy them to the Pie, the pie could have a script to copy them somewhere else. The whole setup could be behind a firewall that only allows outbound traffic, no inbound access what so ever (well, not counting the traffic that flows back as verification of the sending of the files from the Pie to where ever it's pushing them.
-
@Dashrender I don't think it makes the point as much as you think it does, because the data needs to be secured (which I'm sure somewhere in the specifics of the documentation) says "the data needs to be encrypted".
Which SSL is encrypted, but the files aren't encrypted when printed, likely they aren't encrypted when on the XP or Windows 10 system either.
There are certainly a means to doing this, but I think adding the network, just adds complexity.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
What about firewall rules to specific IP addresses?
Like everything else... good for security, but doesn't address the core issue.
