The Cybersecurity & Infrastructure Security Agency (CISA) recently released its insights from the Healthcare and Public Health Sector risk and vulnerability assessment.
At the beginning of the year, the CISA was asked to conduct a Risk and Vulnerability Assessment (RVA) by the Healthcare and Public Health (HPH) sector organization. The assessment is designed to identify vulnerabilities and areas for security improvement. It involves a two-week test; the first is spent on external testing, and the second on assessing the internal work.
The CISA assessed a large organization deploying on-premises software installed onto the company’s hardware infrastructure rather than operating remotely. According to the CISA’s report, the assessment was not able to exploit the company’s external systems but was able to exploit internal systems.
During the external phase, the team attempted to exploit public-facing systems through phishing, web application testing, and penetration.
In this phase, the team was unable to exploit the company via penetration or web applications. In the phishing test, the CISA team successfully received 12 responses through a malicious form, but was unable to access external-facing resources and multi-factor authentication prevented further breaching.
During the internal phase, the team attempted to breach the environment as an actor with internal access. They completed database, web application, and wireless testing. They were unable to identify exploitable conditions from the database or wireless testing.
They were, however, able to complete internal penetration with a connection to the organization’s network but no valid domain account. The team attempted to acquire initial access to an organization and ultimately escalate privileges until they could compromise vital assets. While four attack attempts were unsuccessful, the fifth attempt was.
The team determined that one of the company’s most vulnerable components was the company’s password requirements, which were too easy to infiltrate.
The CISA attempts to infiltrate the company helped showcase how various organizations are breached and where vulnerabilities lie in the HPH sector at large.
Following the test, the CISA provided a variety of strategies HPH companies could take to reduce vulnerability. Mitigation strategies included:
Through assessments like this, companies can better understand the variety of breaches possible and evaluate their current security systems. While the assessed company likely has differences from others in the HPH sector, every HPH organization should consider what steps or strategies it can implement to better protect data.
Related: HIPAA Compliant Email: The Definitive Guide