In the aftermath I wonder if we'll ever find out how the attack was enabled. As in, who opened the attachment. My hunch? An Executive high enough in Leadership who won't get fired. Will be interesting to see.
In a publically funded healthcare system, most employees are unionized, therefore no one will get fired for opening the attachment. And why should they? Unless it was a penis pill email, which I doubt, the employee probably wasn't intentionally trying to bring down the IT systems.
Then again (https://news.ycombinator.com/item?id=14312239) if you didn't patch your system immediately someone could email you an attachment that you never even looked at and have it compromise your system.
That was the nastyness of the earlier announced zero day. All the attacker needed was to have the file on your system when Microsoft's malware scanner ran.
It would be a bit silly to fire people for opening attachments, regardless of their position in the organisation. Sure, people need to be vigilant and follow their organisations' security practices, but if people like me (with lots of technical experience) can almost get tricked then it seems rather disproportionate.
It really should be the case that IT infrastructure is resistant to these problems.
In that tree (which is about harm to patients) the path to "consider suspension" is "were the actions as intended?" and "were adverse consequences intended?" (Did you harm the patient, did you mean to harm the patient?)
You get referral to the regulatory body (which may lead to suspension or dismissal) if someone took an unacceptable risk and there are no mitigating circumstances.
The point of NHS.Net email is that it is secure. A staff member should be able to open email without causing havoc.
Cyber security is everyone's responsibility. In the US at least, hospitals and their staff are held responsible for the proper care and handling of patient health data. In my opinion a hospital administrator should definitely be held accountable for poor computer practices that led to patient data being compromised.
The rational response in such a system if you mess up is to not tell anybody, wait, and hope the problem gets bad enough that it's not obvious where it started.
Opening an attachment can't do anything more than you could do intentionally. If some low-level nobody really has the ability to bring down the NHS systems (no matter if it's done by accident or with malicious intent), then I can point to a long list of managers and security officers in NHS that definitely need to be fired for allowing a system where this is possible.
An organization's security shouldn't be solely focused on breach prevention and placing the blame on someone for clicking on an email. Given enough time, a motivated, sophisticated adversary _will_ get in. Rather, the focus should move to detection and response: knowing where you've been pwned and knowing what to do about it
