Cyber Security Roundtable Wrap Up

Lessons Learned       

Another major facet to the roundtable was an examination of the impact of a breach, where much of the damage and fallout could have been minimised had the organisation invested in Zero Trust.

Softsource vBridge’s Chris Marra was Director of Operations and Delivery at Waikato District Health Board when it was hit by a particularly vicious ransomware attack in 2021. This attack was so significant to public discourse in New Zealand and abroad that it has its own Wikipedia entry, and has since become the subject of study around the management of security and risk.

Over the course of the roundtable, Marra shared some key insights into how the attack was so successful, including:

1)      What the human impact of a breach is, and what the experience of going through a breach of this scale was like.

The very largest impact of this was to patients and clinical staff, on the IT front the first day,  IT staff not initially called out turned up on a Tuesday morning at 8:00 for work and discovered that there was nothing for them to do. They were unable to access the critical tools they needed to do their work in the supporting the Waikato hospitals.

The first response with most IT staff, then, was a feeling of hopelessness and disempowerment. This had a significant impact on team morale immediately.

However, the organisation was able to move quickly and positively, and made it a priority to get the team doing some kind of work in supporting business resilience. They were able to refocus the PC fleet so staff could attach them to Microsoft Teams, SharePoint, their email systems, which had been migrated to Office 365, and a few other applications. This enabled staff to all be involved in helping, and feel like they were contributing to the organisation and recovery.

2)      What Waikato District Health Board did to subsequently improve security?

One of the first steps in recovery was to adopt a Zero Trust approach to security. The organisation employed Microsoft to help craft a best practices approach to architecture going forward.

One interesting human factor that Marra noted was that while staff accepted Zero Trust while in emergency mode, as things returned to business as usual, some staff wanted us to relax the controls. Arguing that it was becoming difficult to do their jobs because they no longer had the ability to simply log on as the domain administrator, and that even after going through the process to get the login, there were limitations on what the assigned login could do. 

This highlights a potential challenge with Zero Trust, that it can affect the user experience and the support teams if not managed. It’s an essential approach in modern IT, but the experience of Waikato District Health Board speaks to a need for a change management program to successfully implement Zero Trust.

3)      Zero Trust would have prevented this breach having the impact that it did.

The breach happened as controls and architecture were unable to protect the environment once access was gained. This then allowed the criminals to be very lateral within the IT systems causing widespread encryption of systems and data. A Zero Trust architecture would have either prevented that from happening or made it much harder to achieve limiting the disruption to hospital operations.