The Tech people at my work suck (longish)

[MergedLoki]

So this happened in the summer.

Someone at my work (a co-worker I dont know which one we have tons that are barely computer literate) downloaded spyware/malware/virus that was one of those 'YOU HAVE A VIRUS CLICK HERE TO DOWNLOAD SOFTWARE TO FIX IT' that.. to ANYONE who has used a computer before is sooo obviously a virus you close the damn window and find a different site.

Well... one of my co-workers who loved playing lil internet games (flash/java games etc.) downloaded this at some point. to the point that the paticular computer it was on was a wreck. Browser windows popped up constantly, couldn't LOAD any programs up etc. was a piece of crap. And seeing as we only really have 3 computers to do our work on (entering in patient xray orders/taking them out of the tracking list to let other staff know 'mr smith' got his xray etc.) we really kind of needed this computer working.

Anyways this went on for a few days (a weekend, our comp. tech people don't work weekends :S dunno why. were a hospital open 24/7 but techs work 9 - 5 mon - fri). called help desk they sent 2 guys up.

Now I'm fairly knowledgeable with computers. not a total computer geek or anything lol (not knocking anyone who is, you're a godsend lol) but I can generally get rid of spyware, fix minor issues etc.
so i possibly COULD have cleared the computer of the offending program BUT the hospital pays me for xrays NOT tech support so i'm not doing it for free.

Anyways these 2 tech guys messed around on teh computer for a good 2 hours or so. told me 'ok yea it's working now it should be fine' (this is at about 4:55 keep in mind they get done at 5.. can anyone see where this is going?)

I say ok thanks guys, they leave, i attempt to open up a browser window and.... BAM about 50 various 'you have a virus' spamware malware crap ads get vomited onto my screen. long story short they fixed NOTHING.

so i called help desk and told whoever answered that i was told issue was fixed and nothing had changed. And they said they'd relay the message but no one could come up till tomorrow.

so.. yea here's where i'm pissed. The 2 guys clearly didn't want to stay and work OT to fix the issue (yea staying late sucks but i'm sure MOST of us have had to do it at one job or another at some point.) but instead of saying 'hey it's still messed we'll take another crack at it tomorrow morning' they lie tell me it's fine when NOT ONE issue we had was fixed.

and final fun fact because were on a LAN and you know computers here gotta communicate with each other this fun lil virus spread to EVERY department in the hospital fucking up countless peoples computers (thankfully it seems nobodies personal info or anything of that nature was messed around or tampered with).

ok im ending my rant here. i've vented and i feel calmer lol

[Nohbody]

Hmm. Canada doesn't have anything like HIPAA in the US?

I suspect that if they were to try that here, the feds would start crawling all over their ass, and not in a pleasant way regardless of whatever may be their sexual preferences.

[Sientara]

So this happened in the summer.

Anyways this went on for a few days (a weekend, our comp. tech people don't work weekends :S dunno why. were a hospital open 24/7 but techs work 9 - 5 mon - fri). called help desk they sent 2 guys up.

Hospital tech here, our hospital (~100 beds) has techs on site between 7am and 5pm Monday through Friday and an on call tech during the other ours. The reason for that is simply the cost, they do not want to hire the amount of people to cover the other hours.

Addressing the other issue: What a bunch of idiots. Our standard procedure is to take the computer until it is fixed so we can work on it at our convenience. That and block their offending users internet access.

[otakuneko]

Sheesh. Any computer with access to sensitive information should, preferably, not have internet access. Failing that it should be locked down, run with least privilege, have executable whitelisting software installed, and be imaged. Issue coulda been fixed in minutes with decent disk-imaging software and a good image. Could've been prevented in the first place if IT had even the first clue about infosec.

[draggar]

To play devil's advocate - I am not allowed to do any "off hours" work and considering IT is normally the first (or second) department to be scrutinized and cut back with any financial decisions, I'm sure many other companies have a similar police (no OT / no off-hours work).

With that aside - I'm assuming the popups popped up right away? Hopefully you also just turn on the computer - no logging on with different profiles. If you have profiles - then they might not have seen it.

Honestly, though, most of the time, especially with those pseudo viruses a.k.a. scareware, it's easier to just format the drive and reinstall the OS and any applications. Those little buggers love to hide and even the best instructions can leave something out - and if you forget one little thing it can pop right back up.

The good news is that they rarely affect personal data so you should be able to back up that information.

[MergedLoki]

To play devil's advocate - I am not allowed to do any "off hours" work and considering IT is normally the first (or second) department to be scrutinized and cut back with any financial decisions, I'm sure many other companies have a similar police (no OT / no off-hours work).

With that aside - I'm assuming the popups popped up right away? Hopefully you also just turn on the computer - no logging on with different profiles. If you have profiles - then they might not have seen it.

Honestly, though, most of the time, especially with those pseudo viruses a.k.a. scareware, it's easier to just format the drive and reinstall the OS and any applications. Those little buggers love to hide and even the best instructions can leave something out - and if you forget one little thing it can pop right back up.

The good news is that they rarely affect personal data so you should be able to back up that information.

Yea, like the minute a browswer window opened (which we have to do to check work email as all our bullitens/notices/etc. are sent through there are no longer posted in a physical paper copy). you'd get flooded with pop ups that would keep coming so that it locked up the computer and you had to restart.

As for having 'net access. we HAVE to have it, as we're on a PACS (picture archiving communication system) which is digital xrays/ultrasound/catscans/mris etc. and we're linked to about 4 or 5 other hospitals in the area so that we can all share info/tests/results etc.

so yea there's no luck in not having 'net access because then. Dr. A. and site # 2. can't see the xrays I did at site # 1. and so on.

anyways far as i know there haven't been any virus's since that summer so it looks good for now (also game happy employee was fired, not for the virus thing just for being a totally incompotent imaging tech.)

[Samaliel]

Your sys/net admin should implement a strong websurfing restrictions policy.

Where I'm working, I can't access anything related to or considered to be:
- Adult/Sexually Explicit
- Dating / Personals
- Games
- Streaming Media
- Alcohol
- Weapons
- Religions
- Tasteless

This list is probably not exhaustive.

Given how it's based on an adaptive blacklisting system (some sites are banned based on domain names, others based on keywords), you can have some funny result: I was sometimes unable to reach the main site of a game community (eg: www.example.com), but still had access to their forum (eg: forums.example.com) or had access to the whole site (eg: www.community.com) but couldn't see anyone's avatar on the boards (hosted on a.community.com). And of course, some would still get through the net, because they are for a fairly marginal community that use a rather specific jargon that's mostly unknown to outsiders...

[lordlundar]

Hmm. Canada doesn't have anything like HIPAA in the US?

Standard Breach of medical privacy act. The rules were expanded to include electronic means some time ago. Doesn't sound like much, but if a company cannot guarantee the information can be secured, they get shut down completely, then are prone to a Government launched class action lawsuit, effectively destroying any private insurer.

[EvilEmpryss]

Doesn't sound like much, but if a company cannot guarantee the information can be secured, they get shut down completely, then are prone to a Government launched class action lawsuit, effectively destroying any private insurer.

Then Canada is once more way ahead of the States on Health Care. The office that handles HIPAA violations was overloaded with complaints from day one, and the number of actually fines they've handed out for violations is a joke. It's totally without teeth. Case in point: A hospital where I live secretly gathered personal information on patients who had mammograms. Someone hacked their system and downloaded the records of 160,000+ patients. No one is even talking about how the hospital researchers first violated HIPAA by accessing patient records and then by storing them in an unsafe computer. I'm not betting on any serious government sanction against this place.

[MergedLoki]

Your sys/net admin should implement a strong websurfing restrictions policy.

Where I'm working, I can't access anything related to or considered to be:
- Adult/Sexually Explicit
- Dating / Personals
- Games
- Streaming Media
- Alcohol
- Weapons
- Religions
- Tasteless

This list is probably not exhaustive.

Given how it's based on an adaptive blacklisting system (some sites are banned based on domain names, others based on keywords), you can have some funny result: I was sometimes unable to reach the main site of a game community (eg: www.example.com), but still had access to their forum (eg: forums.example.com) or had access to the whole site (eg: www.community.com) but couldn't see anyone's avatar on the boards (hosted on a.community.com). And of course, some would still get through the net, because they are for a fairly marginal community that use a rather specific jargon that's mostly unknown to outsiders...

Yea we have a web site blocking program in place now.

Basically (from what i've been able to figure out based on 'blocked' sites) it appears anything with video, flash, or games is blocked.

[Seshat]

As for having 'net access. we HAVE to have it, as we're on a PACS (picture archiving communication system) which is digital xrays/ultrasound/catscans/mris etc. and we're linked to about 4 or 5 other hospitals in the area so that we can all share info/tests/results etc.

Virtual Private Network.

Basically, lock the computers so the ONLY computers any of them can access is each other, and encrypt that with strong encryption.


.... but that's just how I'd do it.

[MergedLoki]

Virtual Private Network.

Basically, lock the computers so the ONLY computers any of them can access is each other, and encrypt that with strong encryption.


.... but that's just how I'd do it.

We're a hospital, in canada, therefore gov't run.

how well does ANY gov't run anything?

aint happening lol. (as in they would say 'not in the budget')

plus. not my problem so i don't care. thye pay me to take xrays so i take the damn xrays.