So the fact that you got paid to tell them their ICU was effectively open to the public doesn’t ring any alarm bells that that’s not supposed to be the case?
There’s quite a bit of difference between “open to the public” and “easy to penetrate”. The reason we were pentesting for them is to figure out how bad it was, and where we needed to focus for improvement. It’s not hard to get into, especially considering that most ICU’s allow guests during certain times.
security is always a balancing act between being secure and pretty much everything else. A building with no doors or windows is far more secure, but also pretty much useless. a working hospital- especially large ones- have small army of people working there; as well as veritable hordes of people visiting for dozens of different reasons on a regular basis; It’s almost impossible to verify that everyone in the building is supposed to be there; and the risk of someone being an assassination target with out that person knowing about it and discussing it with the staff is extremely rare.
All this to say, if Boeing wanted to get someone dead at a hospital, it would be trivial for them. Maybe expensive, but functionally trivial.
Killing someone is always trivial. That’s not the sticking point. The sticking point is making it look like an accident or natural death and failing that, not getting caught. That’s where the exploding number of people who need to be paid off comes into play.
And we’re back to… one or two people… Maybe a few suppliers for the virus/drugs/whatever. But that can be obtained in places that don’t ask too many questions, and Boeing has the resources to do that. They don’t even need to be black market.
