Cyber attack takes out London hospital group.

[psydii]

Guys and St Thomas', Royal Brompton and the Evelina Children's hospitals have declared a major incident

 

https://www.bbc.co.uk/news/articles/c288n8rkpvno

[ITGuyNW]

Just read this. It feels like its an unstoppable war of attacks.

 

Has anyone shut down all remote access for fear of this?

[robintech]

Synnovis went live with a Laboratory Information Management System in October 2023 which consolidated multiple systems at Guy’s and St Thomas’ NHS FT, and King’s College Hospital NHS FT, into one.

https://www.digitalhealth.net/2024/06/critical-incident-at-synnovis-disrupts-pathology-services-across-se-london/

 

Article made me think it was the hospital computer systems being hit through a connection to Synnovs , but its Synnovs who are down and then operations, blood transfusions etc can't take place.

[3s-gtech]

I’ve hugely hardened our remote access using AAP. Edited June 4, 2024 by 3s-gtech

[Olliedawg]

Oh dear..

[psydii]

Just read this. It feels like its an unstoppable war of attacks.

 

Has anyone shut down all remote access for fear of this?

 

Yes, two weeks ago. We've got enough of SIMS out on cloud platforms that there is no reason to maintain a publicly accessible RD solution.

 

Thing is, bad things still sneak in via email and social engineering.

[DrCheese]

We have remote access, but it's HTML5 RDP client from Microsoft slapped right behind an azure app proxy so requires multifactor to access it

[StephenPink]

We have remote access, but it's HTML5 RDP client from Microsoft slapped right behind an azure app proxy so requires multifactor to access it

 

Hijacking slightly - question on this. How have you disabled the "old" WebClient access, and ability to download the RDP file itself? I couldn't find a way to do that whilst still keeping the HTML5 client functional. (In the end I hosted the RDP file on a separate server/web site, behind AAP and disabled the RD web components completely)

 

Thanks

[TechMonkey]

If I understand your question correctly, and I remember rightly, you turn off the public access to the RDP servers and all access and negotiation is through Azure App Proxy.

[gszech]

Just read this. It feels like its an unstoppable war of attacks.

 

Has anyone shut down all remote access for fear of this?

 

We did. No more VPN for over a year. We never offered RDP.

[free780]

Hijacking slightly - question on this. How have you disabled the "old" WebClient access, and ability to download the RDP file itself? I couldn't find a way to do that whilst still keeping the HTML5 client functional. (In the end I hosted the RDP file on a separate server/web site, behind AAP and disabled the RD web components completely)

 

Thanks

 

You can disable the RDP file download via Powershell for the html5 client. Remove access on your firewall. Provide all access via the html5 client page. You can still use mstsc on site or via VPN.

[free780]

We have remote access, but it's HTML5 RDP client from Microsoft slapped right behind an azure app proxy so requires multifactor to access it

 

AITM Phishing is a big risk which can steal the users token and password.

Moving to Windows Hello/FIDO2/Passkeys/Cert auth can mitigate the risk.