Is SMB 1.0 more vulnerable at the client level or server level
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Pete-S said in Is SMB 1.0 more vulnerable at the client level or server level:
I have dealt with these kind of system many times - systems that can't be upgraded or can't be made to support newer protocols.
I didn't read the entire thread but best practice for the above is to isolate them from the network as much as possible and whitelist IP's that are allowed access.
So I suggest sticking the camera and XP behind a hardware firewall and set up rules for what ports are allowed to be accessed from what IP addresses. I'm sure you can close it down a lot.That works for general security, but HIPAA doesn't allow for it even when done "well".
Ah, that's too bad.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@Pete-S said in Is SMB 1.0 more vulnerable at the client level or server level:
I have dealt with these kind of system many times - systems that can't be upgraded or can't be made to support newer protocols.
Best practice is to isolate them from the network as much as possible and whitelist IP's that are allowed access.
So I suggest sticking the camera and XP behind a hardware firewall and set up rules for what ports are allowed to be accessed from what IP addresses. I'm sure you can close it down a lot.Does not solve the need for SMB1
Just thinking about it, what if FTP were an option?
Still would be a HIPAA violation. As that would be an relatively uncontrolled means of egress for the files.
So really the answer is that XP on any network no matter how segregated is not doable.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Why in God's green earth would you deploy XP today? Or would you continue to operate Windows XP?
The system it runs has an $80,000 camera on it
Also this seems insane that the customer has an $80,000 camera, but can't or won't purchase an updated system to run it.
Medical equipment. That was the price of the current camera. The newer ones are even more ridiculous.
They paid that much and didn't work out a support agreement? How do people do their purchasing so poorly?
Dude - where have you been? This happens constantly - and damned near continuously!
We were in the market to buy a new CT machine last year. ALL but one vendor was using Windows 7, and a few even claimed they had no, zero, zip, zich, nadda plans on going to Windows 10. It's crazy - huge companies too, like Toshiba.
The reality of these systems is that the vendors rarely if ever actually update them beyond initial deployment - they should be on a disconnected network whenever possible.
-
If you could use SFTP / FTPS, and then use a Linux box as the connector, this would improve actual security. You could even use a Raspberry Pi velcrod right onto the XP box to make this physically convenient. But bottom line, the XP box is a problem if you attach it to anything and no trickery, firewall, port isolation, protocol, encryption, or otherwise is going to make it not a violation.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@Pete-S said in Is SMB 1.0 more vulnerable at the client level or server level:
I have dealt with these kind of system many times - systems that can't be upgraded or can't be made to support newer protocols.
Best practice is to isolate them from the network as much as possible and whitelist IP's that are allowed access.
So I suggest sticking the camera and XP behind a hardware firewall and set up rules for what ports are allowed to be accessed from what IP addresses. I'm sure you can close it down a lot.Does not solve the need for SMB1
Just thinking about it, what if FTP were an option?
Still would be a HIPAA violation. As that would be an relatively uncontrolled means of egress for the files.
So really the answer is that XP on any network no matter how segregated is not doable.
Correct. Only by having XP off network completely does it become acceptable to HIPAA.
-
Summary of the HIPAA Security Rule
Just so it's posted.
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
We were in the market to buy a new CT machine last year. ALL but one vendor was using Windows 7, and a few even claimed they had no, zero, zip, zich, nadda plans on going to Windows 10. It's crazy - huge companies too, like Toshiba.
Things like this seem insane. Are you saying that no hospital in the country can have their CT scanners supported? That's not plausible. I have a feeling that something about your vendor selection process involved ruling out real world working solutions and only seriously considering the dregs.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
If you could use SFTP / FTPS, and then use a Linux box as the connector, this would improve actual security. You could even use a Raspberry Pi velcrod right onto the XP box to make this physically convenient. But bottom line, the XP box is a problem if you attach it to anything and no trickery, firewall, port isolation, protocol, encryption, or otherwise is going to make it not a violation.
I was kind of thinking that too. If there was another machine supporting SMB1 - SMB3 between the XP and 10 machine then the 10 machine would not need to run SMB1. Again I think it's a lost cause.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
If you could use SFTP / FTPS, and then use a Linux box as the connector, this would improve actual security. You could even use a Raspberry Pi velcrod right onto the XP box to make this physically convenient. But bottom line, the XP box is a problem if you attach it to anything and no trickery, firewall, port isolation, protocol, encryption, or otherwise is going to make it not a violation.
I was kind of thinking that too. If there was another machine supporting SMB1 - SMB3 between the XP and 10 machine then the 10 machine would not need to run SMB1. Again I think it's a lost cause.
Yeah, if purely "better security" was the goal, your thinking is good. But because of HIPAA, certain things are just black and white. No one is saying that HIPAA is sensible, it just is what it is.
If this was just a case of needing "reasonable security better than what any normal medical practice has" then you'd be golden. But sadly it's not.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
The client needs to take images that are on the camera (XP machine) and upload to their EMR.
Current process is the images are printed, scanned, uploaded to EMR.That process uses a lot of human time and degrades the images quite a lot. Seems like they weren't so concerned about the cost when they bought it and chose to do that. This seems crazy financially.
Bottom line, though, there isn't a good answer for this. But it's not your fault or your problem. And no doctor acting this way thinks that $80K is enough money to worry about.
How many doctors offices - not hospitals - doctors offices have you been brought into, said that to them, and didn't get tossed on your ear - and instead they actually said something like " oh geez damn Scott - you're right - we were totally stupid when we bought this and not think about the future ramifications of OS support, etc. Now that our eyes are open, here, here's a damned near blank check - please fix our systems?"
And this a serious question - because I want their names so I can call them and use them as a reference to sell that idea to my guys, or at least my boss.
-
The issue isn't just XP, it's everything related to the transfer of the images. Networked, USB device, Floppy drive (lol) or any other means requires that the data be secured*.
I used an * on purpose - because even HIPAA is completely in the dark on how to do that.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
Data transfer methods are what hipaa cares about, not the medium.
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
HIPAA auditors have (in my experience hearing of them) cranky over thumb drives.
-
Would installing a solution like Veracrypt on both workstations and creating an encrypted volume on a Thumb drive pass a HIPAA audit if it used AES-256?
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
If there was another machine supporting SMB1 - SMB3 between the XP and 10 machine then the 10 machine would not need to run SMB1.
That's not really the security concern that it sounds like. Everyone has this panic about SMB 1 being enabled, but it's actually not a threat to you in this scenario unless you were also doing something else bad along with it. On its own, enabling SMB 1 doesn't cause any risk because there is no non-compromised scenario where it could be used. Since you'd already be compromised for it to get used, being compromised over SMB 1 isn't a problem.
SMB 1 is bad, but in this case is simply a red herring. Don't enable it if you don't need it. But don't panic about it either, you have actual security concerns to deal with that affect you in ways that this does not. SMB 1 being enabled, AFAIK, has no HIPAA concern nor reasonable security concern so you are safe from audit and a negligence issue. You'd simply document why it is enabled, and how you ensure it isn't activated and you are covered. And if you think disabling SMB 1 does something big, remember that disabling is nothing compared to not using at all. And a compromised system can turn SMB 1 back on, anyway.
TUrning SMB 1 off is really just about preventing accidents in a case like this.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Would installing a solution like Veracrypt on both workstations and creating an encrypted volume on a Thumb drive pass a HIPAA audit if it used AES-256?
You mean and not putting it on th enetwork? Probably.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
HIPAA auditors have (in my experience hearing of them) cranky over thumb drives.
Keep in mind that HIPAA audits and HIPAA compliance are unrelated. Failing a HIPAA audit means nothing, it's only failing to be compliant that puts you at risk.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Would installing a solution like Veracrypt on both workstations and creating an encrypted volume on a Thumb drive pass a HIPAA audit if it used AES-256?
You mean and not putting it on th enetwork? Probably.
Yeah, completely leave the XP system off of the network, but install Veracrypt on the XP system (and Windows 10 system) then create an encrypted volume on a USB drive that whenever the images get transferred the files are encrypted at rest.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
The vulnerability comes from maintaining a 12 year old OS on your network in any way shape and form. If it's hosting a share (so another system can grab the files from it) there is added risk.
Understood. If there is an option that allows the client to keep using their working equipment I would like to present it to them. I know the easy answer is to tell someone cough up another $80,000 for something. If it was as simple as buy a new $1,000 computer I would recommend it. The price tag for some equipment is just gouging though. I know it is a reality of running a business.
That they need to cough up for a supported, working machine that is legally applicable to a medical practice is something that they decided when they worked out the support deal on the current one. The XP era had HIPAA and keeping the OS maintained and patched was something that they knew at the time. Don't take on personal liability by recommending something like this. If they demand that you do it against your recommendations, get that in writing that you didn't get a choice. But certainly don't offer it.
@scottalanmiller - I appreciate the feedback. If it can't be done then it can't be done. I can accept that and the client has to as well. Again my goal was to try and come up with a solution that would remove unnecessary steps and make things more streamlined.
That's just it - it clearly can be done, and you found mitigation for it. I'm not suggesting that you do it, but in my mind you would be following the law, just like you are currently following the law by having the machine be completely isolated. You mitigated risks to a 'reasonable' degree. The problem - as Scott and Dustin will so quickly point out is, who decides what reasonable is? The answer is the auditor who gets the claim against you/the clinic when someone complains.
So... you could hire a HIPAA attorney who will sign off on your work-a-round and then be there to defend you if/when that time comes. It's likely this attorney would cost loads less than $80K for a new camera system.
