Is SMB 1.0 more vulnerable at the client level or server level
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
So @syko24 the goal is to allow the customer to remotely access a file share from an XP machine over the network (presumably because it's easier than having a KVM attached to this XP machine).
Correct?
using a KVM would be only a tiny fraction of the functionality. how will they store and back up these images, for example?
KVM was shorthand for me having to type out a keyboard, mouse and monitor.
I assume that the USB ports on this XP system are superglue'd close and that just using a thumb drive to move the files between these systems isn't an option (because of HIPAA I know)
What does HIPAA have to do with thumbdrives?
Data transfer methods are what hipaa cares about, not the medium.
And? The only mention I recall reading - feel free to post a specific law saying otherwise - is that PHI must be encrypted when going over a non trusted network.
Workstation and Device Security. A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.22 A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).23
Nothing about a network, CD/DVD or any other sort of media.
Meaning that pretty much anything goes, so long as there is a policy and proceedure (and from the main description) "The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form."
Meaning that they don't actually offer any solutions, so long as the process is sound and secures PII.
Thank you for making my point - no where does it say that your USB drives MUST be encrypted, no where does it say your local LAN has to be encrypted (yeah, I know no one has even hinted at this), etc.. You have to have mitigations in place.
If Windows 10 is able to be setup as securely as Scott said earlier - than yeah.. the solution he presented should be viable.
FYI - no reason a licensed Windows 10 machine would be needed here. A raspberry pie with SMB v1 and some other transfer protocol should be able to do this license free.
A script could run on the XP or R-Pie to look for files, then copy them to the Pie, the pie could have a script to copy them somewhere else. The whole setup could be behind a firewall that only allows outbound traffic, no inbound access what so ever (well, not counting the traffic that flows back as verification of the sending of the files from the Pie to where ever it's pushing them.
-
@Dashrender I don't think it makes the point as much as you think it does, because the data needs to be secured (which I'm sure somewhere in the specifics of the documentation) says "the data needs to be encrypted".
Which SSL is encrypted, but the files aren't encrypted when printed, likely they aren't encrypted when on the XP or Windows 10 system either.
There are certainly a means to doing this, but I think adding the network, just adds complexity.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@JaredBusch said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
What I would like to do is Windows 10 machine (1 nic connected to network, 1 nic connected via crossover cable) to the XP machine, moves the files off the XP and onto the server share where the files can then be uploaded to the EMR.
That's certainly a "better than nothing" setup. But if it were me, I'd not put myself at risk to protect the decision makers who took on this risk. That makes no sense. Why would you assume that risk for them? They clearly don't care, why do you?
Actually, no, it provides no security, because you enable SMB1 globally for Windows 10, not per NIC. This would cause that machine to then attempt other client connections with SMB1, as well as accept SMB for the admin shares or anything else it has.
AWWW - if that's true - I take back everything I said.. I did completely mean to mention this - can you disable SMB v1 for a given NIC in Windows 10... if you can't then you haven't mitigated the issue, and you can't do it.
What about firewall rules to specific IP addresses?
Like everything else... good for security, but doesn't address the core issue.
-
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender I don't think it makes the point as much as you think it does, because the data needs to be secured (which I'm sure somewhere in the specifics of the documentation) says "the data needs to be encrypted".
Which SSL is encrypted, but the files aren't encrypted when printed, likely they aren't encrypted when on the XP or Windows 10 system either.
There are certainly a means to doing this, but I think adding the network, just adds complexity.
No, it does not say it must/needs to be/etc encrypted. It says you are responsible for it, but how you handle that responsibility is up to you... with the bespoken difference for PHI traveling over untrusted (think internet) networks, in which case it does specifically say it must be encrypted.
The big thing a lot of scare companies love to throw around is the 'requirement' to encrypt all laptops. There is no such requirement - what there is, is a pass to anyone who looses a laptop where all PHI is encrypted.
These are the kinds of differences Scott loves to point out all the time.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
Iron mountain is pretty damn cheap and it takes the liability off of the practitioner.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
Iron mountain is pretty damn cheap and it takes the liability off of the practitioner.
Not really, but it does allow the practitioner to assign those resources that were shredding before to hopefully do something of greater value.
-
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
Iron mountain is pretty damn cheap and it takes the liability off of the practitioner.
They do use IronMountain. I don't know the cost off the top of my head but it's not that much.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
Iron mountain is pretty damn cheap and it takes the liability off of the practitioner.
They do use IronMountain. I don't know the cost off the top of my head but it's not that much.
Two lucky guesses in a single topic, I'm on a roll!
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Why in God's green earth would you deploy XP today? Or would you continue to operate Windows XP?
The system it runs has an $80,000 camera on it
Also this seems insane that the customer has an $80,000 camera, but can't or won't purchase an updated system to run it.
Medical equipment. That was the price of the current camera. The newer ones are even more ridiculous.
Windows XP and PHI.... What could go wrong?
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
So do people who use most of those services. What the services do is not necessarily offsite shredding, although that does exist for sure, but offsite disposal so that people can't dumpster dive you to reassemble your shredded documents.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
So do people who use most of those services. What the services do is not necessarily offsite shredding, although that does exist for sure, but offsite disposal so that people can't dumpster dive you to reassemble your shredded documents.
Yeah, I suppose if you need to be that secure - that's the way to go.
-
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Dashrender said in Is SMB 1.0 more vulnerable at the client level or server level:
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
@DustinB3403 said in Is SMB 1.0 more vulnerable at the client level or server level:
Which I'm positive that this doctors office is paying for secure document destruction right? Peoples pictures/scans getting printed off and then rescanned and saved to a EMR. . .
If you are asking me then yes they have a service that destroys the images/documents.
huh - must be a pretty big office then... hardly seems worth a service to pickup your shredding. Our staff shreds their bins worth of PHI themselves.
So do people who use most of those services. What the services do is not necessarily offsite shredding, although that does exist for sure, but offsite disposal so that people can't dumpster dive you to reassemble your shredded documents.
Yeah, I suppose if you need to be that secure - that's the way to go.
Right, just shredding is for HIPAA. Offsite combination with millions of other shredded documents is for security.
-
If you use one of these, you don't need to lock your car door anymore!
Maybe not even need doors!
-
@Obsolesce said in Is SMB 1.0 more vulnerable at the client level or server level:
If you use one of these, you don't need to lock your car door anymore!
Until someone just steals your wallet sitting on the seat.
-
@scottalanmiller said in Is SMB 1.0 more vulnerable at the client level or server level:
@Obsolesce said in Is SMB 1.0 more vulnerable at the client level or server level:
If you use one of these, you don't need to lock your car door anymore!
Until someone just steals your wallet sitting on the seat.
Lol exactly.
-
@syko24 said in Is SMB 1.0 more vulnerable at the client level or server level:
On Windows 10 you can enable SMB1.0 Server or Client. Does enabling just the client side make the Windows 10 system vulnerable? What I am trying to figure out is if I have a special machine running XP and need to pull data from a share on it, can I enable SMB 1.0 client on a Windows 10 machine, connect a crossover cable and have the 10 machine pull data from the XP share safely? The 10 machine would then move the copied data onto the primary server running Windows Server 2016.
If this is a horrible idea are there any suggestions to make this a secure setup other than replacing the XP machine.
Thanks
Both. We've seen Emotet gobble up an entire network where nothing has been done to patch for EternalBlue which is the exploit in SMBv1.
We remove it _everywhere we manage a network on all endpoints. Period. Full Stop.
