In the Age of Cyber, Don’t Forget Physical

We are getting bombarded every day with news about cyber attacks, data theft, ransomware and more. But that does not mean we should ignore physical attacks.

Over the last month or two we have been hearing about attacks on water systems across the country. While these attacks were facilitated by computers, ultimately, these attacks boil down to knobs and dials. Open a valve too far, you put too much chemicals in. Close a valve and you have no more water.

But what about good old turning those knobs by hand? Simple attack. If it is effective it could cause panic.

That kind of attack happened last month here in Colorado. The good news is that the attacker didn’t really know what he was doing, so the effect was minor.

On September 3rd someone got into the oxygen storage area at Colorado’s largest hospital, UC Health.

The good news is that while the hospital may not have planned for a nut-job to turn off the oxygen supply (more on that in a minute), they did have a backup plan.

DO YOU HAVE A BACKUP PLAN FOR YOUR CRITICAL SYSTEMS?

As the oxygen pressure went away, the hospital was able to move to a backup oxygen system. If the attacker knew what they were doing they would have disabled the backup supply first. That might have gone unnoticed. Then disabled the primary supply. But, as I said before, they did not know what they were doing or maybe they just thought it was a harmless prank. *IF* they catch this person they will ask.

But the hospital has a backup plan to the backup plan. They have portable oxygen supplies distributed around the hospital in case the first backup plan did not work.

So, other than causing a lot of excitement, it luckily did not affect patients and the hospital had a disaster plan. That plan worked.

But more about that “more on that in a minute” part.

While the hospital is being smart and not explaining to other would be hackers what they did and did not have, there are certainly some questions.

Apparently there was a fence around the oxygen storage system. Why did the breach of that fence (the video shows someone jumping the fence) not immediately generate a response from CU and the City of Aurora police. After all, this is an 800+ bed hospital. What if the hacker planned to make the oxygen tank go BOOM! That would be both a bigger problem and a harder one to fix quickly. Maybe they had a backup to the backup plan. I don’t know and I sure hope they don’t tell.

They had security cameras. This happened at 1:00 in the afternoon, not the dark of night. Reports are that the video quality was so bad that they could not even tell the gender of the attacker. Are decent security cameras too expensive for the largest hospital system in the state?

CU police said that they got a call from their contracted security firm, PalAmerican Security, at about 3:30PM. That was two hours after someone cut off the supply. The security firm said that the hospital had just notified them of the oxygen problem. We don’t know why the hospital had to call security and why that took two hours and if was there anyone watching watching the video and why all that took two hours.

The hospital says they are making improvements to their security. That is a good plan, folks.

This is an unusual attack, but that is why it worked. You have to plan for the unexpected. At least in this case the damage was not catastrophic, which is a good thing. But what about next time?

Credit: The Denver Post and Colorado Public Radio

by