The Cybersecurity and Infrastructure Security Agency recently released a mitigation guide for organizations in the healthcare and public health sectors (HPH).
What happened
The document released by CISA offers recommendations and best practices to combat cyber threats specific to the healthcare sector. By employing their recommendations, CISA hopes organizations can defend against attacks before they occur.
They outline the top vulnerabilities that can lead to intrusion, including web application vulnerability, encryption weakness, unsupported software, unsupported Windows operating systems, known exploited vulnerabilities, and vulnerable services.
Read more: Executive summary: Q3 healthcare cybersecurity trends.
Going deeper
The document is divided into three mitigation strategies with one or more focus areas.
The first strategy, Asset Management and Security, outlines strategies to protect data, hardware, software, and other assets. According to CISA, because health information is often critical to operating status, “threat actors continuously look for new ways to exploit vulnerabilities within the HPH sector.”
This strategy contains two focus areas: asset inventory and asset security. First, CISA recommends that professionals “identify and understand all relationships or interdependencies” among assets. These assets should be actively tracked to ensure any changes are accounted for. After this process, CISA recommends segmenting and isolating networks to ensure security.
The second strategy, Identity Management and Device Security, involves protecting emails and other data. The focus areas include:
1. Email protection.
2. Phishing-resistant securities.
3. Safe password policies.
4. Proper storage and encryption of sensitive information.
5. Endpoint detection and response solutions can determine where a threat has moved in a network.
The final strategy, Vulnerability, Patch, and Configuration Management, focuses on identifying, managing, and remediating vulnerabilities in software. CISA suggests continually scanning devices and acting on any vulnerabilities.
Related: HIPAA Compliant Email: The Definitive Guide.
Why it matters
CISA emphasizes the importance of maintaining critical health systems and functions for patient care. The organization notes that many technology manufacturers and vendors have historically tried to fix vulnerabilities by patching or quick resolution. CISA hopes to change the tide by designing systems to be protected from the get-go.
By preparing far in advance for attacks or breaches, organizations in the healthcare sector can prevent intrusions that are costly and time-consuming.
CISA recommends beginning the security process as soon as possible, especially as cyber threat actors continue to evolve.
Read more: FBI releases document outlining recent ransomware trends.
The big picture
Guidances like the Mitigation Guide are designed to be used with other recommendations and toolkits. Organizations have many risks, including transitioning to cloud environments, using third-party vendors, and more.
Organizations in the healthcare sector should closely monitor new guidances and technology to keep critical data secure and running.
With continued diligence, an organization’s security can increase patient trust and reliability instead of becoming a risk factor.
Related:
Abby Grifno
