<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: Operational security failure</title>
	<atom:link href="http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/</link>
	<description>Security Research, Computer Laboratory, University of Cambridge</description>
	<pubDate>Fri, 05 Dec 2008 08:12:39 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.3</generator>
		<item>
		<title>By: Pete Austin</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29417</link>
		<dc:creator>Pete Austin</dc:creator>
		<pubDate>Fri, 27 Jun 2008 18:04:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29417</guid>
		<description>The original report was on the BMJ's website, part of which is members only, so I thought I'd investigate its security. 

To register "You will need your BMA membership number or GMC number plus the postcode from your membership record (ie that to which your paper BMJ is sent)."
http://resources.bmj.com/bmj/bma-members/access-the-bmj

Sound difficult? You can get full names and GMC numbers by entering any surname into the following URL, and I expect many doctors receive the BMJ at their surgeries
http://www.gmc-uk.org/register/search/index.asp

But personally I'm doing medical research, of a type, so I'd register as a guest.
https://registration.bma.org.uk/registerguest</description>
		<content:encoded><![CDATA[<p>The original report was on the BMJ&#8217;s website, part of which is members only, so I thought I&#8217;d investigate its security. </p>
<p>To register &#8220;You will need your BMA membership number or GMC number plus the postcode from your membership record (ie that to which your paper BMJ is sent).&#8221;<br />
<a href="http://resources.bmj.com/bmj/bma-members/access-the-bmj" rel="nofollow">http://resources.bmj.com/bmj/bma-members/access-the-bmj</a></p>
<p>Sound difficult? You can get full names and GMC numbers by entering any surname into the following URL, and I expect many doctors receive the BMJ at their surgeries<br />
<a href="http://www.gmc-uk.org/register/search/index.asp" rel="nofollow">http://www.gmc-uk.org/register/search/index.asp</a></p>
<p>But personally I&#8217;m doing medical research, of a type, so I&#8217;d register as a guest.<br />
<a href="https://registration.bma.org.uk/registerguest" rel="nofollow">https://registration.bma.org.uk/registerguest</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Pete Austin</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29416</link>
		<dc:creator>Pete Austin</dc:creator>
		<pubDate>Fri, 27 Jun 2008 16:51:40 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29416</guid>
		<description>Re: "We greatly appreciate the ease with which GP receptionists assisted us, however it would seem that such help is potentially open to abuse by anyone with a convincing medical story “calling from the hospital”. Such a story easily overcomes natural safeguards; hacking into a Healthspace account would be considerably more difficult."

This conclusion in the original BMJ article is sadly misguided. My day job includes technical support and I know how easy it is to get users to tell me their passwords (some even volunteer unprompted) or leave me with a logged-on session. No hacker skills are needed.

One possible attack is by an insider, collecting information for the more unscrupulous breed of door-to-door salesmen, who are quite willing to bully the elderly. I'm sure these would pay big bucks for (say) a list of 100 local people with newly diagnosed Alzheimers. And getting this report from a computerised system would be very much easier than making 100 phone calls to receptionists.</description>
		<content:encoded><![CDATA[<p>Re: &#8220;We greatly appreciate the ease with which GP receptionists assisted us, however it would seem that such help is potentially open to abuse by anyone with a convincing medical story “calling from the hospital”. Such a story easily overcomes natural safeguards; hacking into a Healthspace account would be considerably more difficult.&#8221;</p>
<p>This conclusion in the original BMJ article is sadly misguided. My day job includes technical support and I know how easy it is to get users to tell me their passwords (some even volunteer unprompted) or leave me with a logged-on session. No hacker skills are needed.</p>
<p>One possible attack is by an insider, collecting information for the more unscrupulous breed of door-to-door salesmen, who are quite willing to bully the elderly. I&#8217;m sure these would pay big bucks for (say) a list of 100 local people with newly diagnosed Alzheimers. And getting this report from a computerised system would be very much easier than making 100 phone calls to receptionists.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Yokel</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29399</link>
		<dc:creator>Yokel</dc:creator>
		<pubDate>Wed, 25 Jun 2008 10:04:01 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29399</guid>
		<description>To misquote the chap from Sun, "Privacy is dead, get over it".

What is the purpose of the NHS's NPfIT? To make information about patients more freely available. Built into the system from the start was the freedom for any Dept of Health civil servant to examine private data, so several years later why should the inevitable function creep not have granted those permissions to anyone with the guts to ask? Surely in a few more years it will be criminal NOT to have lost a few CDs in the post!</description>
		<content:encoded><![CDATA[<p>To misquote the chap from Sun, &#8220;Privacy is dead, get over it&#8221;.</p>
<p>What is the purpose of the NHS&#8217;s NPfIT? To make information about patients more freely available. Built into the system from the start was the freedom for any Dept of Health civil servant to examine private data, so several years later why should the inevitable function creep not have granted those permissions to anyone with the guts to ask? Surely in a few more years it will be criminal NOT to have lost a few CDs in the post!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Clive Robinson</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29341</link>
		<dc:creator>Clive Robinson</dc:creator>
		<pubDate>Fri, 20 Jun 2008 20:32:00 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29341</guid>
		<description>@ Dave Berry,

"on the other, parents feel they can no longer trust the medical professionals."

I'm quite sure it's not just parents who no longer trust the "carring proffesions" it's the children as well.

Age Concern has tried to bring the subject of "elder abuse" up on many occasions in the past few years, seamingly without being heard by those in authority.

The government just cut the number of inspectors down and implement self inspection scheams, on private care homes etc.

Oh and complaints against inspectors reports appear to be almost invariably upheld in the favour of the private organisations...</description>
		<content:encoded><![CDATA[<p>@ Dave Berry,</p>
<p>&#8220;on the other, parents feel they can no longer trust the medical professionals.&#8221;</p>
<p>I&#8217;m quite sure it&#8217;s not just parents who no longer trust the &#8220;carring proffesions&#8221; it&#8217;s the children as well.</p>
<p>Age Concern has tried to bring the subject of &#8220;elder abuse&#8221; up on many occasions in the past few years, seamingly without being heard by those in authority.</p>
<p>The government just cut the number of inspectors down and implement self inspection scheams, on private care homes etc.</p>
<p>Oh and complaints against inspectors reports appear to be almost invariably upheld in the favour of the private organisations&#8230;</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dave Berry</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29340</link>
		<dc:creator>Dave Berry</dc:creator>
		<pubDate>Fri, 20 Jun 2008 08:42:48 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29340</guid>
		<description>The BMJ letter is worrying, if sadly predictable.  But the AIMS letter you link to is truly shocking.  Perhaps I found it more surprising than the BMJ letter because I know a little more about computer security than I do about social work and patient care.  

There seems a common thread; how much do people trust those who collect information about them?  On the one hand, we see medical receptionists are perhaps too trusting (or perhaps the system is genuinely trustworthy); on the other, parents feel they can no longer trust the medical professionals.</description>
		<content:encoded><![CDATA[<p>The BMJ letter is worrying, if sadly predictable.  But the AIMS letter you link to is truly shocking.  Perhaps I found it more surprising than the BMJ letter because I know a little more about computer security than I do about social work and patient care.  </p>
<p>There seems a common thread; how much do people trust those who collect information about them?  On the one hand, we see medical receptionists are perhaps too trusting (or perhaps the system is genuinely trustworthy); on the other, parents feel they can no longer trust the medical professionals.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: MikeP</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29334</link>
		<dc:creator>MikeP</dc:creator>
		<pubDate>Thu, 19 Jun 2008 02:07:24 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29334</guid>
		<description>How many clinics are there?  If disclosing personal information of patients on 98% of 30+ calls a week isn't a calamity, I don't know what is.  Maybe if one of those patients was somebody important, things might change.</description>
		<content:encoded><![CDATA[<p>How many clinics are there?  If disclosing personal information of patients on 98% of 30+ calls a week isn&#8217;t a calamity, I don&#8217;t know what is.  Maybe if one of those patients was somebody important, things might change.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: David</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29327</link>
		<dc:creator>David</dc:creator>
		<pubDate>Wed, 18 Jun 2008 13:06:56 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29327</guid>
		<description>Well, I believe it takes either a calamity or a different approach to get people to take security seriously.  You see, approaching the DoH to tell them how you found something that was quite wrong, just gets them on them defensive.   You're trying to tell Mr Nicholson that under his stewardship, there's a degree of negligence when it comes to privacy, I'm not surprised you struggled to get any co-operation.</description>
		<content:encoded><![CDATA[<p>Well, I believe it takes either a calamity or a different approach to get people to take security seriously.  You see, approaching the DoH to tell them how you found something that was quite wrong, just gets them on them defensive.   You&#8217;re trying to tell Mr Nicholson that under his stewardship, there&#8217;s a degree of negligence when it comes to privacy, I&#8217;m not surprised you struggled to get any co-operation.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Westfalia</title>
		<link>http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/#comment-29326</link>
		<dc:creator>Westfalia</dc:creator>
		<pubDate>Wed, 18 Jun 2008 11:25:48 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=337#comment-29326</guid>
		<description>thats hard facts - i hope something will change quickly.</description>
		<content:encoded><![CDATA[<p>thats hard facts - i hope something will change quickly.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
