Computer virus shuts down Ambulance dispatch service

and recovery, for an ambulance dispatch

On a Sunday doubt if anyone working would be allowed to? Most IT have they network so crippled no one wants to use it anyhow

-- Petzl

Could you retype that last sentance in English that makes a modicum of sense, thank you.

read it again anyone with a modicum of comprehension will manage it

In any case, critical systems shouldn't be connected to the internet, and there should be an absolute ban (sacking on first offence) on loading unauthorised software.

Sylvia.

There were problems when the system was initially installed a couple of decades ago. I think there was even a 4-Corners program about how poor the system was.

There was a recent tender for upgrades as well, and this sheds some light into the operational system architecture.

From

The core operational systems and services used by the service for call taking and dispatching are VisiCAD version 1.10 for the primary ambulance dispatch system to identify incident locations, and real-time visual tracking of vehicles; a Genesys and Alcatel computer telephony integration; CDAT to receive the matching Telstra Eclipse Data associated with 000 emergency calls received through the Telstra network; the Inter-CAD Electronic Messaging System (ICEMS) to allow agency CAD systems to send and receive CAD jobs; an in-house, Web-based electronic booking system to schedule non-urgent patient transport; a the mobile data interface by which data is sent and received between the operations centre CAD system and ambulance mobile data terminals via several data radio networks.

The ICEMS protocol has been developed and tested by the NSW Fire Brigades and Ambulance Service and will be deployed between those and NSW Police with the next twelve months.

Other systems that integrate into the CAD system include: paging and SMS, priority dispatch software, a custom Windows DLL for clinical decision support, a call taking quality assurance application and the Higher Ground voice recording application.

The service operates a centralized data warehouse which is continuously updated with all VisiCAD and related data from each of the operations centres for backup, DR and reporting purposes. Live operational data is replicated in real time to a central data store at Rozelle in Sydney. Replication covers all CAD SQL data and most of the other data sources.

In addition to the CAD data warehouse, the tender requests Genesys data marts from each centre to be deposited into a central data mart.

The DR equipment is expected to be a mirror of the primary CAD data centre, including three fully-populated blade enclosures; however, if blades are not used then the equivalent would be about 50 HP rack-mounted servers. There are also six stratus fault tolerant servers. For storage an EMC SAN with between 30 to 40 disks is used.

Almost definitely.

Wouldn't fix this problem. you need to remove the "infection"

Sigh, the number of places that have "virus protection". It was installed three years ago but never updated or maintained.

If it was properly crippled, then this should not have happened.

We all know that, but they continue to do it. Which is it; their maps are google maps or where is it?

It is based on a Computer Aided DRAWING system?

The original Genesys?

A full reinstall and restore from a backup made before the infection would do it. Mind you, determining when the infection occurred might be difficult.

Perhaps just a full reinstall. It's an ambulance dispatch system - what happened yesterday is already history.

Sylvia.

a virus at about 1pm (AEDT) on Saturday,

amedics and ambulances via a manual paper-based

ffline at 1pm (AEDT) on Sunday and it was not

ack up and recovery, for an ambulance dispatch

Which will be another reason to push for internet censorship. To "protect" vital infrastructure.

Sigh, it is a network? Ever recovered a network from a virus installation? Thought not.

Isolate each computer. Do a re-install on each computer. Only reconnect computers to the network after a re-install.

Routers should be OK unless they've been set up to be remotely reprogrammable, which they shouldn't be.

Sylvia.

FULL means FULL.

My service provider backs up my FULL server

And I'm running a 2 bob shopping cart, not a life critical ambulance dispatch system.

And as far as individual PC backup is concerned, I doubt if anyone is more paranoid than I am about having enough FULL backups available. It started when my wife unplugged my 4K PC in 1978, so she could plug her iron into a double adapter. I lost about 8 hours work. :-)

Cheers Don...

==========================

Very hard to say what happened until we hear what O/S was being used, how it was infected, and how it was fixed.

Latest in:

General manager Mike Willis said the time it took to fix the problem was "regrettable". "It has been a long time coming back online," he told Fairfax Radio Network this morning. "That's regrettable. But I'll say we wouldn't allow the system to be turned back on until our technicians cleaned every workstation." The cause and source of the virus was still not known, he said

So, it has "Workstations".

Cheers Don...

===================

Sylvia Else wrote

But they may well not want to just lose that history.

They may not be legally allowed to just bin it regardless.

kreed wrote

Nope, no one will buy that line now.

No reason for it to be net connected even if it does use the google maps database.

Your "backup service is definitely nota FULL backup system.

So don't compare them. Think network.