New Volunteer Cybersecurity Performance Goals and Online Resources
The U.S. Department of Health and Human Services (HHS), through the Administration for Strategic Preparedness and Response (ASPR), released voluntary health care specific cybersecurity performance goals (CPGs) and a new gateway website to help Health Care and Public Health (HPH) sector organizations implement these high-impact cybersecurity practices and ease access to the plethora of cybersecurity resources HHS and other federal partners offer. As outlined in the recent HHS Health Care Sector Cybersecurity concept paper, HHS is publishing the CPGs to help health care organizations, and health care delivery organizations in particular, prioritize implementation of high-impact cybersecurity practices. The HPH CPGs are designed to better protect the healthcare sector from cyberattacks, improve response when events occur, and minimize residual risk. HPH CPGs include both essential goals to outline minimum foundational practices for cybersecurity performance and enhanced goals to encourage adoption of more advanced practices. It is encouraged to amplify this announcement. More information on these CPGs and HHS cybersecurity work can be found here. Healthcare and Public Health Sector Cybersecurity Special Bulletin January 26, 2024 HHS Releases New Voluntary Performance Goals to Enhance Cybersecurity Across the Health Sector and Gateway for Cybersecurity Resources On Wednesday January 24th, the U.S. Department of Health and Human Services (HHS), through the Administration for Strategic Preparedness and Response (ASPR), released voluntary health care specific cybersecurity performance goals (CPGs) and a new gateway website to help Health Care and Public Health (HPH) sector organizations implement these high-impact cybersecurity practices and ease access to the plethora of cybersecurity resources HHS and other federal partners offer. “We have a responsibility to help our health care system weather cyber threats, adapt to the evolving threat landscape, and build a more resilient sector,” said HHS Deputy Secretary Andrea Palm. “The release of these cybersecurity performance goals is a step forward for the sector as we look to propose new enforceable cybersecurity standards across HHS policies and programs that are informed by these CPGs.” As outlined in the recent HHS Health Care Sector Cybersecurity concept paper, HHS is publishing the CPGs to help health care organizations, and health care delivery organizations in particular, prioritize implementation of high-impact cybersecurity practices. The HPH CPGs are designed to better protect the healthcare sector from cyberattacks, improve response when events occur, and minimize residual risk. HPH CPGs include both essential goals to outline minimum foundational practices for cybersecurity performance and enhanced goals to encourage adoption of more advanced practices. “ASPR is leading this sector-wide effort to protect our nation’s health infrastructure against ever-increasing and complex cyber-attacks,” said Assistant Secretary for Preparedness and Response Dawn O’Connell. “The actions announced today make it easier for health care organizations to protect patients by prioritizing those key cybersecurity practices upon which they should focus their efforts.” The HPH CPGs provide layered protection at different points of weakness in an organization’s technology environment, which is crucial to increase cyber resilience and ultimately protect patient safety. Layered defense provides redundancy so if one line of defense is compromised, additional layers exist as a backup to ensure that threats are stopped along the way. Both the essential and enhanced goals were informed by common industry cybersecurity frameworks, best practices, and strategies (e.g., Health Industry Cybersecurity Practices, NIST Cybersecurity Framework, and the National Cybersecurity Strategy and Implementation Plan), and are designed to directly address common attack vectors against U.S. domestic hospitals as identified in the 2023 Hospital Cyber Resiliency Landscape Analysis . As an example, according to the Landscape Analysis, 80% of cyber-attacks are identity-based (e.g., social engineering), compromising legitimate credentials to move laterally within organizations. Several essential CPGs including implementing basic cybersecurity training, implementing email security measures, and revoking credentials for departing workforce members are relatively lower cost, high yield actions to protect organizations from identity-based attacks. The more intensive enhanced goals like network segmentation prevent threat actors from moving laterally within organizations when they are compromised.
0 Comments
The Critical Connection: Public Health Infrastructure and Cybersecurity
January 10, 2024 On Wednesday, January 10, 2024 from 1:00-2:00 p.m. a webinar will be held with speakers highlighting forward-thinking strategies designed to empower participants to prepare for and navigate future cybersecurity challenges. Connection Information Cyber Alert! ALPHV BlackCat Ransomware Advisory
On Tuesday December 19, the US Justice Department announced that it has seized websites of the second most prolific ransomware-as-a-service (RaaS) operation, BlackCat, also called ALPHV or Noberus. Today, ALPHV/BlackCat announced that its ransomware as a service (RaaS) criminal syndicate affiliates could now target critical infrastructures such as nuclear power plants, hospitals in US in response. The Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) have released a Joint CSA to disseminate known indicators of compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) associated with the ALPHV Blackcat RaaS identified through FBI investigations as recently as December 6, 2023. This advisory provides updates to the FBI FLASH BlackCat/ALPHV Ransomware IOC released April 19, 2022. Since previous reporting, ALPHV Blackcat actors released a new version of the malware, and the FBI identified over 1000 victims worldwide targeted via ransomware and/or data extortion. FBI and CISA encourage critical infrastructure organizations to implement the recommendations in the Mitigations section of the CSA to reduce the likelihood and impact of ALPHV Blackcat ransomware and data extortion incidents. |
Archives
July 2024
Categories |