Thousands of HSE computers rely on out-of-date software – RTE.ie

The Health Service Executive's information technology system is relying on thousands of out-of-date computers because a plan to replace them has not been completed.

The out-of-date computers, which run on Windows 7, need special security support, which cost the taxpayer over 1mthis year.

Last year, the HSEsaidit had "aprogrammeto migrate"Windows 7 computers to Windows 10 by the end of 2020.

At that time 46,000 of its 58,000 computers remained on Windows 7.

The HSE hassincereplaced 9,000 of the 46,000 computers leaving 37,000 depending on the old software-12,000 of those cannotbe replaced because they are needed to run radiology and other systems that cannotrun on newer software.

In response to a parliamentary question byLabourleader Alan Kelly, the HSE saidits Windows 7 migrationprogrammewas "impacted by the Covid-19 pandemic resulting in a lower number of upgraded/replaced Windows 7 devices".

In January, Microsoft stopped protecting Windows 7 computers from viruses and malware,unlessit waspaid extra money to do it.

The HSE needed that protection and paid1.1m for it in 2020. Next year, it faces paying more to Microsoft because the pricing structure per computer doubles.

The HSE confirmed negotiations are "still ongoing" between itself and Microsoft and a "figure is yet to befinalised" on how much Windows 7 protection will cost for 2021.

Read More:Windows 7 users warned of cyber attacks as software support endsHSE spent 300k on software patches

The scaling down of Windows 7 was known widely from 2014 and the HSE started its migrationprogrammein 2017.

Speaking on RT's Morning Ireland,MrKelly saidthe failure to address the issue showed a lack of preparedness which led to a cost to the taxpayer.

"I cant believe that the HSE still hasnt dealt with this issue. It is costing the taxpayer a huge amount of money.

"One year on, they still havent been able to ensure that they brought their software and security settings up to date. It leaves them open to a serious amount of security issues and problems potentially.

"That doesnt excuse the fact that they were a year behind anyway. That doesnt excuse the fact that these costs were building up. I accept the fact that it would have been much more difficult this year. But,that isnt the full story, this could all have been prepared for in advance,"hesaid.

The HSE said in a statement it has a "layered system of security to mitigate cyber security risk".

"This includes perimeter security, software updating, real time monitoring of assets, mobile device security and endpoint encryption. We alsoutilisecybersecurity expert partners and Microsoft to provide additional support to the HSE.

"No single element on its own is sufficient to provide adequate cybersecurity. It is the combination of all elements working together that provides the best cybersecurity. Given the continued threat of cybersecurity, the HSE will continue to invest in cybersecurity tools and education of staff to helpminimisethis ever-changing threat," the HSE statement read.

Dr Simon Woodworth, director of the health information researchcentreat University College Cork, saidthe HSEs pace of Windows migration is pathetically slow and creates a single point of failure that could have massive consequences.

"I am sympathetic with the HSE because Covid-19 is going to put a12monthdelay on everything.

"It is not just a financial issue. It is an issue of increasing risk. The longer they leave this and the slower they are at remedying the situation the more they are exposing themselves to risk of a vulnerability or a cyberattack.

"The HSEs multi-layered system is actually very, very good. They areabsolutely diligent, and they try very, very hard to make sure there are several layers of security, so if there is a failure on one point it should not affect everything else.

"If you have a single point of failure, while the probability might look very low, the consequences could be quite serious because an enemy agent or a threat to the system-for whatever their motivation is-if they establish a toehold inside anybodys networks, all they need to do is compromise one machine and then the damage they do spreads outwards from that machine"

Other institutions andorganisationare also dealing with similar Windows 7 issues.

Last year, Government departments had 22,312 computers on Windows 7.Today, it has reduced that by almost half to 11,850.

View post:
Thousands of HSE computers rely on out-of-date software - RTE.ie