“There’s no need to waste your time with the computers on the receptionist’s desk or in the admin area,” Marbury had advised Spence. “They’re on an entirely separate virtual local area network. The system used to manage each patient’s medical records, including current meds and prescribed dosages, is completely locked down and also secured in a locked and alarmed server room. The servers are virtualized on clustered blades with daily, weekly, and monthly backups before being transferred onto encrypted tapes for offsite storage. User access to the system is only via thin clients or iPads, so there’s no way to introduce malware, whilst the admins run a three-month patch cycle, but only after running all changes through their test rig.
“As you’ll find, the workstations, as well as the tablets the nurses use, are secured in areas that can be accessed only if you have the code for the electronic lock, which is changed weekly. The tablets themselves are stored in a locked high-security safe that serves as their charging station while all the workstations can only be accessed with the CAC unique to it.”
Though she couldn’t imagine Andy would send her off on a snipe hunt, based on what Marbury had told her, Spence could not discount the possibility her efforts would be a monumental waste of time. Still, she reminded herself as she looked about, she had her marching orders. Besides, even Hannah Marbury confessed in a high-profile case like this one it was best if a second pair of eyes went over what she’d done. “I may be good, but I’m not perfect,” Hannah had confessed as they were finishing their tea. “Not yet, anyway,” she added with a wink and a grin.
Spence was still going over the way in which Marbury had described her approach to the problem and what she would do differently when Liam Stapleton, the hospital’s full-time IT specialist, appeared and introduced himself. “I am at your disposal, Ms. Spencer,” Stapleton informed her with a casualness that struck her as being out of place given the reason she was there. “But before you get started, Mr. Lewis would like to speak to you, if that’s all right with you.”
Never having had the opportunity to handle a case on her own from start to finish, Spence was a little nervous at the prospect of conducting the initial interview with a client. Wishing to make a good impression, as she and Stapleton were waiting outside Kyle Lewis’s office, Spence took a moment to glance at her reflection in the glass of a photo that hung on the wall over the multifunction printer she’d spotted while she’d been waiting. She was in the process of tucking her long hair behind her ear when a very enraged Richard Graham came storming out of the office. He all but pushed Spence out of his way as he barged through the door, stopping only to snarl back through the open doorway into the room he had just left without ever once turning to Spence and apologizing.
“You’ll be hearing from my solicitor, Mr. Lewis!” Graham snapped.
Equally thrown off his game by Graham’s behavior, Stapleton wasted no time in hustling Spence into Lewis’s office once Graham was gone. The only thing that was merciful about the stilted exchange of greetings and introductions that followed was it was brief, leaving Spence free to get on with doing what she did best: delving into the inner workings of a computer network.
For the next two days, with Stapleton hovering nervously over her shoulder, Spence waded through reams of policy and design documents, piles of risk and asset registers. This was followed by a review of patch states and change logs, vulnerability scans, and a check of the entire system using aggressive malware detection utilities. Apart from some minor recommendations she shared with Stapleton, when she was finished, Spence had come up with precisely nothing.
More disappointed than frustrated, when she had done all she could think of, Spence slumped down in the seat of the train carriage on the way back to the office, going over in her head everything she had done just to be sure that when she reported the results of her efforts she could do so with a clear conscience. Only the antics of a businessman who was busily tapping out an e-mail on his iPad and a scruffy youth who was equally busily hammering away at his laptop distracted her. Had the boy not kept glancing over at the businessman out of the corner of his eye every now and then before carefully readjusting what appeared to be a tube of Pringles crisps, Spence never would have suspected a thing. As it was, as the train began to pull into her station, she slowly made her way down the carriage past the young man and stole a glimpse at his laptop screen. Yep, she concluded. She was right; he was running a wireless packet sniffer. Satisfied, she continued on until she was alongside the businessman who was still engrossed in his e-mail.
“You’re being hacked,” she muttered softly after tapping his shoe with the toe of her sneaker.
Startled, the businessman looked up at her.
“The boy with the red backpack and laptop halfway down the carriage is monitoring your e-mail,” she said.
Whether the businessman believed her and stopped typing didn’t matter to her. As she had at the hospital, she’d done her best, which was all she could do.
“I’m sorry, Andy; it really looks as if she did it,” Spence lamented. She’d been dreading this moment all afternoon. It didn’t help that Tommy, who was hunched over his desk in the corner as he disassembled yet another perfectly innocent Android device, was doing a piss-poor job of pretending he wasn’t listening in. “Between what Hannah Marbury found and my review of the system’s security, I can’t see any other explanation.”
“You’re absolutely sure?” Andy asked, equally dreading the thought of reporting their results to Kyle Lewis. Notwithstanding a pathological hatred of failing, good customers were hard to come by, and a long-term contract with a private hospital would have been very welcome indeed in the current financial environment. Andy toyed with his pen for a few long moments, putting Spence in mind of her old school principal deciding whether or not her latest escapade required a call to her father. “Tommy? Have you got any ideas?”
Tommy continued to prod at the innards of the hapless device before him even as he spoke. “If Spence said she went through the software and documentation with a microscope, then she did. In theory, it’s locked down tighter than a gnat’s arse.” When he finally did look up, he grinned. “Trouble is, like you, I don’t put much stock in theory. As good as Tinker Bell is, she hasn’t been out in the real world long enough to be as paranoid, twisted, and devious as old buggers like you and me.”
Pausing, Tommy shot a quick glance over at Spence to see how she was reacting to his comments, particularly his use of a nickname he knew she despised. Only when he was sure she wasn’t about to bound up over her desk, rush across the room, and wring his neck did he look back at Andy. “I was thinking it might not be a bad idea if me and her take another look see, provided of course you think it’s worth the effort, boss.”
As much as he hated to undercut Spence, Andy knew Tommy had a point. As a young officer straight out of the commissioning course at Sandhurst, he’d found himself having to swallow his pride more than once when one of his NCOs came up behind him and whispered in his ear that he’d missed something that was obvious to anyone who’d been in the army more than a day.