{"id":54231,"date":"2025-01-15T11:31:18","date_gmt":"2025-01-15T10:31:18","guid":{"rendered":"https:\/\/www.invarena.cz\/?p=54231"},"modified":"2025-01-15T11:31:19","modified_gmt":"2025-01-15T10:31:19","slug":"analyza-ceske-nemocnice-nemaji-dostatecne-zajistenou-kyberbezpecnost-ohrozen-je-jejich-provoz-i-pacienti","status":"publish","type":"post","link":"https:\/\/www.invarena.cz\/?p=54231","title":{"rendered":"Anal\u00fdza: \u010cesk\u00e9 nemocnice nemaj\u00ed dostate\u010dn\u011b zaji\u0161t\u011bnou kyberbezpe\u010dnost. Ohro\u017een je jejich provoz i pacienti"},"content":{"rendered":"\n<p><strong>PRAHA, 15. ledna 2025 \u2013 Kybernetick\u00e1 bezpe\u010dnost je v \u010desk\u00fdch nemocnic\u00edch zaji\u0161t\u011bna v&nbsp;pr\u016fm\u011bru p\u0159ibli\u017en\u011b jen ze t\u0159etiny toho, co definuje p\u0159\u00edslu\u0161n\u00fd z\u00e1kon. T\u00edm se p\u0159itom mus\u00ed \u0159\u00eddit v\u0161echny velk\u00e9 nemocnice a v&nbsp;brzk\u00e9 dob\u011b po implementaci sm\u011brnice NIS2 se povinnost roz\u0161\u00ed\u0159\u00ed prakticky na v\u0161echny. Nemocnice v\u011bt\u0161inou nemaj\u00ed spr\u00e1vn\u011b zaveden\u00e9 syst\u00e9my a procesy na zvl\u00e1d\u00e1n\u00ed kybernetick\u00fdch hrozeb, v&nbsp;n\u011bkter\u00fdch p\u0159\u00edpadech ani ne\u0159e\u0161\u00ed dostupnost, spolehlivost a integritu sv\u00fdch IT syst\u00e9m\u016f. Nejsou tak dostate\u010dn\u011b p\u0159ipraveny reagovat na kybernetick\u00e9 \u00fatoky, co\u017e m\u016f\u017ee m\u00edt negativn\u00ed dopad na jejich fungov\u00e1n\u00ed, ale i ohro\u017eovat data a zdrav\u00ed pacient\u016f. Vypl\u00fdv\u00e1 to z anal\u00fdzy \u010desk\u00e9 spole\u010dnosti ComSource, kter\u00e1 se zam\u011b\u0159uje na kyberbezpe\u010dnost, s\u00ed\u0165ovou infrastrukturu a datovou analytiku.<\/strong><\/p>\n\n\n\n<p>\u201e<em>Kdy\u017e p\u0159ed p\u011bti lety hacke\u0159i ochromili fungov\u00e1n\u00ed nemocnice v&nbsp;Bene\u0161ov\u011b a o p\u00e1r m\u011bs\u00edc\u016f pozd\u011bji zopakovali to sam\u00e9 v&nbsp;Brn\u011b, p\u0159edpokl\u00e1dali jsme, \u017ee se z&nbsp;toho v\u0161echny nemocnice pou\u010d\u00ed. O to v\u00edce n\u00e1s p\u0159ekvapuje st\u00e1vaj\u00edc\u00ed realita. Nemocnice sice investovaly pod t\u00edhou ud\u00e1lost\u00ed do sv\u00e9ho kybernetick\u00e9ho zabezpe\u010den\u00ed, ale i tak jsou st\u00e1le p\u0159\u00edpady, kdy ve\u0161ker\u00e1 bezpe\u010dnost za\u010d\u00edn\u00e1 a kon\u010d\u00ed ochrankou na vr\u00e1tnici, antivirov\u00fdm programem a heslem do po\u010d\u00edta\u010de. To opravdu nesta\u010dilo k&nbsp;zaji\u0161t\u011bn\u00ed bezpe\u010dnosti a fungov\u00e1n\u00ed nemocnice p\u0159ed p\u011bti lety, nato\u017e nyn\u00ed. Informa\u010dn\u00ed technologie jsou v&nbsp;nemocnic\u00edch p\u0159\u00edtomn\u00e9 prakticky na ka\u017ed\u00e9m m\u00edst\u011b a v&nbsp;ka\u017ed\u00e9m za\u0159\u00edzen\u00ed. Jak\u00fdkoliv jejich v\u00fdpadek m\u016f\u017ee m\u00edt dalekos\u00e1hl\u00e9 n\u00e1sledky a ohro\u017eovat zdrav\u00ed pacient\u016f. Nejde v\u016fbec jen o dodr\u017eov\u00e1n\u00ed z\u00e1kona, zaji\u0161t\u011bn\u00ed dostate\u010dn\u00e9 kybernetick\u00e9 bezpe\u010dnosti by m\u011blo b\u00fdt v&nbsp;dne\u0161n\u00ed dob\u011b samoz\u0159ejmost\u00ed nejen pro nemocnice,\u201c<\/em> \u0159\u00edk\u00e1 Michal \u0160tus\u00e1k, expert na kybernetickou bezpe\u010dnost a spolumajitel spole\u010dnosti ComSource.<\/p>\n\n\n\n<p><a><\/a> Legislativa stanovuje dva okruhy kyberbezpe\u010dnostn\u00edch opat\u0159en\u00ed \u2013 organiza\u010dn\u00ed a pak samotn\u00e9 technick\u00e9. Podle poznatk\u016f expert\u016f ComSource pln\u00ed nemocnice v&nbsp;pr\u016fm\u011bru p\u0159ibli\u017en\u011b pouze t\u0159etinu z nich \u2013 65 % opat\u0159en\u00ed nefunguje spr\u00e1vn\u011b nebo dokonce nen\u00ed v\u016fbec zavedeno, 25 % vykazuje ur\u010dit\u00e9 nedostatky a pouh\u00fdch 10 % opat\u0159en\u00ed funguje p\u0159esn\u011b tak, jak je t\u0159eba.<\/p>\n\n\n\n<p>Nemocnic\u00edm \u010dasto chyb\u00ed syst\u00e9my \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed, nastaven\u00ed \u0159\u00edzen\u00ed rizik, nebo zaji\u0161t\u011bn\u00ed bezpe\u010dnostn\u00edch rol\u00ed, nemaj\u00ed stanoven\u00e9 po\u017eadavky na zvl\u00e1d\u00e1n\u00ed kybernetick\u00fdch incident\u016f a nastaveno fungov\u00e1n\u00ed v&nbsp;p\u0159\u00edpad\u011b \u00fatoku. St\u00e1v\u00e1 se, \u017ee nap\u0159\u00edklad vyu\u017e\u00edvan\u00e9 IT s\u00edt\u011b tak nemaj\u00ed \u017e\u00e1dn\u00fd provozn\u00ed ani bezpe\u010dnostn\u00ed monitoring, chyb\u00ed jednotn\u00e1 spr\u00e1va \u00fa\u010dt\u016f a nepou\u017e\u00edvaj\u00ed se n\u00e1stroje pro detekci kybernetick\u00fdch bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed.<\/p>\n\n\n\n<p>Naopak zpravidla v\u0161echna zdravotnick\u00e1 za\u0159\u00edzen\u00ed se v\u011bnuj\u00ed ur\u010dit\u00e9mu \u0159\u00edzen\u00ed dodavatel\u016f nebo lidsk\u00fdch zdroj\u016f i z&nbsp;pohledu kyberbezpe\u010dnosti. <em>\u201eD\u016fvodem je pravd\u011bpodobn\u011b i to, \u017ee jsou nemocnice ji\u017e dlouhodob\u011b zvykl\u00e9 vyb\u00edrat dodavatele v&nbsp;souladu se z\u00e1konem o zad\u00e1v\u00e1n\u00ed ve\u0159ejn\u00fdch zak\u00e1zek, nebo kontrolovat trestn\u00ed rejst\u0159\u00edk nov\u00fdch zam\u011bstnanc\u016f, seznamovat je s&nbsp;intern\u00edmi sm\u011brnicemi a \u0159\u00eddit jejich p\u0159\u00edstupov\u00e9 \u00fa\u010dty. \u010casto ale chyb\u00ed pravideln\u00e1 \u0161kolen\u00ed o informa\u010dn\u00ed bezpe\u010dnosti nebo z\u00e1kladn\u00edch hygienick\u00fdch pravidel online sv\u011bta,\u201c <\/em>\u0159\u00edk\u00e1 Michal \u0160tus\u00e1k z ComSource.<\/p>\n\n\n\n<p>Zat\u00edmco nyn\u00ed se legislativn\u00ed po\u017eadavky vztahuj\u00ed pouze na p\u0159ibli\u017en\u011b p\u011bt des\u00edtek nejv\u011bt\u0161\u00edch zdravotn\u00edch za\u0159\u00edzen\u00ed, do budoucna se budou t\u00fdkat prakticky v\u0161ech nemocnic. Ve schvalovac\u00edm procesu je toti\u017e nov\u00fd z\u00e1kon o kybernetick\u00e9 bezpe\u010dnosti, kter\u00fd do \u010desk\u00e9ho pr\u00e1va implementuje evropskou bezpe\u010dnostn\u00ed sm\u011brnici NIS2, a kter\u00fd roz\u0161\u00ed\u0159\u00ed povinnost dostate\u010dn\u00e9 kyberbezpe\u010dnostn\u00ed ochrany na mnohem v\u011bt\u0161\u00ed po\u010det subjekt\u016f.<\/p>\n\n\n\n<p>\u201e<em>Nemocnice by si m\u011bly prov\u00e9st audit, b\u011bhem kter\u00e9ho by zjistily skute\u010dn\u00fd stav jejich kybernetick\u00e9 ochrany. Nen\u00ed to toti\u017e jen o tom, \u017ee jim n\u011bco chyb\u00ed \u2013 setk\u00e1v\u00e1me se i s&nbsp;p\u0159\u00edpady, \u017ee maj\u00ed definovan\u00e9 postupy, ale ty jsou jen n\u011bkde ulo\u017eeny a nikdo o nich nev\u00ed, co\u017e ned\u00e1v\u00e1 smysl. Nebo pot\u0159ebn\u00e9 technick\u00e9 vybaven\u00ed maj\u00ed, ale to je \u0161patn\u011b nastaven\u00e9 a spravovan\u00e9, proto\u017ee chyb\u00ed kapacita kvalifikovan\u00fdch lid\u00ed v&nbsp;jejich IT t\u00fdmu. Pr\u00e1v\u011b dostate\u010dn\u00e1 kapacita a kvalifikace IT pracovn\u00edk\u016f je v&nbsp;nemocnic\u00edch obrovsk\u00fdm probl\u00e9mem,\u201c<\/em> dod\u00e1v\u00e1 Michal \u0160tus\u00e1k z ComSource.<\/p>\n\n\n\n<p><strong>P\u0159\u00edklady oblast\u00ed, kter\u00e9 nemocnice obvykle nemaj\u00ed dostate\u010dn\u011b vy\u0159e\u0161en\u00e9:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Syst\u00e9my \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed<\/li>\n\n\n\n<li>Organiza\u010dn\u00ed bezpe\u010dnost, zaji\u0161t\u011bn\u00ed bezpe\u010dnostn\u00edch rol\u00ed<\/li>\n\n\n\n<li>Postupy pro zvl\u00e1d\u00e1n\u00ed kybernetick\u00fdch incident\u016f a \u0159\u00edzen\u00ed kontinuity \u010dinnost\u00ed<\/li>\n\n\n\n<li>Zabezpe\u010den\u00ed komunika\u010dn\u00edch s\u00edt\u00ed<\/li>\n\n\n\n<li>Spr\u00e1va a ov\u011b\u0159ov\u00e1n\u00ed identit, \u0159\u00edzen\u00ed p\u0159\u00edstupov\u00fdch opr\u00e1vn\u011bn\u00ed<\/li>\n\n\n\n<li>Zaznamen\u00e1v\u00e1n\u00ed IT ud\u00e1lost\u00ed, detekce kyberbezpe\u010dnostn\u00edch ud\u00e1lost\u00ed<\/li>\n\n\n\n<li>Zabezpe\u010den\u00ed aplikac\u00ed, vyu\u017e\u00edv\u00e1n\u00ed kryptografick\u00fdch prost\u0159edk\u016f, zabezpe\u010den\u00ed specifick\u00fdch syst\u00e9m\u016f<\/li>\n<\/ul>\n\n\n\n<p><strong>P\u0159\u00edklady oblast\u00ed, kter\u00e9 nemocnice obvykle maj\u00ed dostate\u010dn\u011b zaji\u0161t\u011bn\u00e9:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0158\u00edzen\u00ed dodavatel\u016f a bezpe\u010dnosti lidsk\u00fdch zdroj\u016f<\/li>\n\n\n\n<li>\u0158\u00edzen\u00ed p\u0159\u00edstupu, fyzick\u00e1 bezpe\u010dnost<\/li>\n\n\n\n<li>Antivirov\u00e1 ochrana koncov\u00fdch stanic<\/li>\n<\/ul>\n\n\n\n<p><strong>O spole\u010dnosti ComSource<\/strong><\/p>\n\n\n\n<p>Spole\u010dnost ComSource se v&nbsp;oblasti kybernetick\u00e9 bezpe\u010dnosti a s\u00ed\u0165ov\u00e9 infrastruktury pohybuje od roku 2010, od roku 2023 se soust\u0159ed\u00ed i na oblast datov\u00e9 analytiky. Poskytuje vysoce profesion\u00e1ln\u00ed slu\u017eby a dod\u00e1v\u00e1 ta nejlep\u0161\u00ed infrastrukturn\u00ed a bezpe\u010dnostn\u00ed \u0159e\u0161en\u00ed on-premise, v cloudu nebo v hybridn\u00edch prost\u0159ed\u00edch. D\u00edky vlastn\u00ed laborato\u0159i ComSource vyvinul a d\u00e1le rozv\u00edj\u00ed i vlastn\u00ed \u0159e\u0161en\u00ed a slu\u017eby. Nejv\u00fdrazn\u011bj\u0161\u00ed z&nbsp;nich je syst\u00e9m FlowGuard chr\u00e1n\u00edc\u00ed p\u0159ed DDoS \u00fatoky. ComSource m\u00e1 CSIRT t\u00fdm, je aktivn\u00edm \u010dlenem AFCEA a projektu FENIX. Spole\u010dnost m\u00e1 sv\u00e9 pobo\u010dky v&nbsp;Praze, Brn\u011b, P\u00edsku a v Bratislav\u011b.<\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>PRAHA, 15. ledna 2025 \u2013 Kybernetick\u00e1 bezpe\u010dnost je v \u010desk\u00fdch nemocnic\u00edch zaji\u0161t\u011bna v&nbsp;pr\u016fm\u011bru p\u0159ibli\u017en\u011b jen ze t\u0159etiny toho, co definuje p\u0159\u00edslu\u0161n\u00fd z\u00e1kon. T\u00edm se p\u0159itom <a class=\"mh-excerpt-more\" href=\"https:\/\/www.invarena.cz\/?p=54231\" title=\"Anal\u00fdza: \u010cesk\u00e9 nemocnice nemaj\u00ed dostate\u010dn\u011b zaji\u0161t\u011bnou kyberbezpe\u010dnost. Ohro\u017een je jejich provoz i pacienti\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":17232,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-54231","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zpravy"],"_links":{"self":[{"href":"https:\/\/www.invarena.cz\/index.php?rest_route=\/wp\/v2\/posts\/54231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.invarena.cz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.invarena.cz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.invarena.cz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.invarena.cz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=54231"}],"version-history":[{"count":0,"href":"https:\/\/www.invarena.cz\/index.php?rest_route=\/wp\/v2\/posts\/54231\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.invarena.cz\/index.php?rest_route=\/wp\/v2\/media\/17232"}],"wp:attachment":[{"href":"https:\/\/www.invarena.cz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=54231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.invarena.cz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=54231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.invarena.cz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=54231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}