The Cybersecurity and Infrastructure Security Agency has issued new guidance for high-risk nonprofits and other under-resourced community organizations to improve understanding and Efforts to mitigate cyber threats.
But the upcoming 2024 election could have a huge impact on CISA’s broader efforts, including the recently completed national cyber operations on data protection, to address these gaps. security gaps in several key areas, Director Jen Easterly reported to the Senate last week.
WHY IS IT IMPORTANT?
Because civil society organizations, including some health care organizations, are “unprepared and vulnerable to” social engineering efforts and widespread cyber threats Another, CISA co-authored “Mitigating Cyber Threats with Limited Resources: A Guide for Civil Society,” published on May 14.
With the compilation of best practices, CISA and its co-authors from national and international law enforcement and security agencies hope to help civil society organizations that tend to rely on The communication channel is insecure and has low defense capacity.
“These organizations lack essential internal IT support and cyber hygiene to prevent the possibility of malicious activity (e.g., lifecycle management, patch management, multi-factor authentication, etc.),” they said. password manager).
These recommended actions and mitigations for vulnerable organizations link to CISA courses and other resources, such as Access Now’s Digital Security Helpline, which provides support. 24/7 support for civic organizations in nine languages. It will respond in two hours, according to the organization’s website “from grassroots to global”.
However, to further protect vulnerable and high-risk communities from cyberattacks, the agencies also recommend that vendors publicly commit to Security by Design practices.
“This commitment requires adherence to the principles of Security by Design, including (1) assuming accountability for customer security outcomes, (2) promoting radical transparency and accountability. solid accountability and (3) lead from the top and implement top-down leadership to drive transformational changes that prioritize security at every stage of software development and deployment “, CISA and its co-authors said in the new guidance.
They recommend that software vendors make efforts to eliminate product vulnerabilities, enable multi-factor authentication by default, report suspicious network behavior to their customers, and set up alerts about malicious configurations. image is not safe.
In addition to supporting low-resourced vulnerable organizations, CISA has been busy focusing on better-resourced organizations in critical sectors.
Last month, the agency held national cyber preparedness exercises for Cyber Storm IX, giving more than 2,200 participants an opportunity to test their response to cyber attacks on cloud resources. cloud. The national capstone cyber exercise periodically brings together the public and private sectors to simulate and report on the response to a cyber crisis affecting the nation’s critical infrastructure.
Participants in previous exercises in 2020 and 2022 included providers such as Cleveland Clinic, HCA Healthcare and the University of Kansas Health System, HealthIT vendors such as Nuance, Siemens and Cisco, other security companies like CrowdStrike and coordinating entities like HHS and the Center for Health Information Sharing and Analysis.
This year’s exercise “focuses on adversarial exploitation of common misconfigurations of cloud environments to cause various impacts to data confidentiality, integrity, and availability,” it said. Easterly said in a summary of the May 16 event.
Although the healthcare sector is currently under siege by various ransomware groups looking to profit from major system outages, such as the ALPHV cyberattack that weakened corporate claims parent UnitedHealth Group must rebuild Change Healthcare systems with cloud-based security, and the alleged Black Basta ransomware attack on non-profit organizations Ascension, 2024 presents a security barrier additional networks that the agency must address.
Easterly told the Senate Intelligence Committee on May 15 foreign threats to the upcoming election that, while the U.S. election network environment is more secure than ever, first, “Today’s threat environment is more complex than ever.”
“We cannot be complacent,” she said in her opening statement, noting that “CISA is providing more services in more jurisdictions than ever before.”
BIGGER TREND
Years of massive breaches have caused sustained disruptions and diversions of care that have put patients at risk, forcing the government to take action.
After releasing its National Cybersecurity Strategy last year, the U.S. Department of Health and Human Services outlined its healthcare cybersecurity strategy, with some feedback from the Hospital Association United States and other groups.
In addition to the new voluntary cybersecurity performance goals, HHS said it will work with Congress to create incentives to improve cybersecurity performance for the nation’s hospitals and will require accountability as well as greater coordination with the healthcare industry.
In a letter to HHS Secretary Xavier Becerra on Thursday, the Electronic Data Exchange Working Group called on the federal government to establish an Office of National Cybersecurity Policy headed by a “Cyber Policy Czar.” new leadership and offers several other recommendations to help coordinate and lead the national cyber response
WEDI asks HHS and other federal agencies to do more to help health systems maintain operations and mitigate the consequences of successful cyberattacks by ensuring information exchange capabilities.
In addition to the efforts of CISA and HHS, Anne Neuberger, deputy national security adviser for cyber and emerging technology, has focused on healthcare cybersecurity across multiple federal agencies.
Earlier this month, the Healthcare Leadership Council met with the deputy national security adviser to informally discuss cybersecurity.
“We appreciate Ms. Neuberger’s candor and willingness to collaborate with health care leaders on this important priority and look forward to working with government to strengthen the resilience of the healthcare sector and promote patient safety.”
ON PROFILE
“This guide along with [HHS] “Cybersecurity Performance Goals can help resource-strapped hospitals prioritize security practices,” John Riggi, AHA national advisor on cybersecurity and risk, said in a statement. network and develop an implementation roadmap”.
Andrea Fox is a senior editor at Healthcare IT News.
Email: [email protected]
Healthcare IT News is a publication of HIMSS Media.
