Thread by @AlyssaM_InfoSec

I know it's easy to hop on the bandwagon of shaming #infosec in Healthcare given the ransomware news over the last two days. But please before you decide to blast your theory on how healthcare is lazy, uncommitted, etc. to security, take a few moments to consider their risk 1/

models and the unprecedented level of complexity they have to deal with in terms of technology and threats. We know the challenges of ICS systems that are built once and typically can't be easily upgraded as vulnerabilities are discovered. This is 10x worse when it comes to 2/

medical devices. Now add in the complexities of EMR systems which are managing vast amounts of disparate forms of data. Far more complex than even what we see in financial services. But the complexity doesn't end there. Consider the crazy networking infrastructures needed to 3/

bring all those technologies together into a seamless, largely mobile, zero down time, environment. It's crazy.

And then of course we ask this of organizations for whom security is not a core competency. Whose focus is on saving lives. And as a result for whom the resultant 4/

threat model features far more critical assets and more dire protection needs that any other industry.

Finally we throw all of this on the shoulders of organizations that are often struggling financially to keep pace with dynamic resources, technologies and trends that are 5/

the lifeline (no pun intended) of their ability to continue doing business. As such budgets become a very delicate balancing act and the core business of saving lives remains the paramount priority.

Yes, we've been saying for more than a decade that defending healthcare IT 6/

would become a life and death matter. However, perhaps it's on us for not demonstrating the actual business value and necessity in a way the resonated with leaders. So look within, how could we have done better as a community? It's time we #DoBetterBeBetter /FIN