COI Report – Part VII
Page
395 of
425 1148. Dr Yip’s evidence is that if VB or RB
was implemented instead of ISS, this would go a very long way in helping clinicians do their work, depending on how the solution is deployed. Dr Yip noted that there were several permutations to how the solution is operationalised, for instance a) VB or RB could be deployed in either the same or different device from which clinicians access the EMR. b) The content allowed in VB or RB has to be calibrated.
48.3.2 Drawbacks 1149. IIT is arguably less secure than ISS. CSA’s view is that that while the remote browser solution does mitigate some of the risks of internet surfing, there are still risks that ISS mitigates that the RB solution does not. Whether there are any residual risks and what these risks are will depend on how the product implements the solutions.
If VB or RB is implemented, there will need to be careful consideration as to what product is chosen, and how to calibrate the particular product.
48.3.3 Mitigating controls to address the residual risks 1150. As explained above, ISS prevents an attacker from gaining direct access into the CII systems that are providing essential services – it provides a high degree of security.
At the same time, the evidence of MOH representative Dr Yip highlights the potential drawbacks – increased time and costs, lost productivity and new risks. If ultimately, the considered decision taken is to implement VB or RB instead of ISS, the healthcare sector must ensure that the residual risks of not implementing ISS are adequately addressed by strong mitigating controls. One mitigating control that was put in place before the Cyber Attack was internet-whitelisting.
Another mitigating control, the ATP solution, was in the process of being deployed before the Cyber Attack. The containment measures implemented by IHiS after the Cyber Attack may also go someway to address the residual risks. These should be augmented with the other recommendations listed in this Part which the healthcare sector should carefully study.
