Lessons Learned from Conversations with the FBI: Healthcare Cyberthreats and Best-practice Defense

Earlier this year, the FBI launched a two-month national campaign, Operation Winter SHIELD (Securing Homeland Infrastructure by Enhancing Layered Defense), highlighting the top 10 actions private sector organizations — including healthcare — can take to protect against cyberattacks. These best practices, informed by lessons learned from the most significant nation-state and criminal cyber investigations, recognize the private sector’s crucial role in defending the nation’s critical infrastructure against the very real and serious cyberthreats our country faces.

While the campaign is over, these defensive measures remain the most effective steps healthcare organizations can take to reduce cyber risk and increase resilience and recovery. These measures were developed through a multi-agency effort that analyzed thousands of cyberattacks to identify how hackers penetrated victim networks and understand what defensive measures work best at thwarting the “bad guys” in the future.

Below are takeaways from two conversations with the FBI's Brett Leatherman, assistant director, Cyber Division, and Gretchen Burrier, assistant director, Office of Private Sector. They focus on the surge of cyberattacks on the U.S. healthcare field — including how nation-state actors are leveraging cybercriminals and artificial intelligence (AI) to disrupt healthcare — and what hospitals and health systems can do to defend themselves.

The Top Bad Actors and Their Targets

The current environment of increased geopolitical tension translates into increased cyber risk. Adversary nation-states such as China, Russia, Iran and North Korea, which all possess highly sophisticated cyber capabilities, pose the greatest danger.

U.S. critical infrastructure — including energy, water and telecommunications — continues to be a high-value target for these nation-states, which “pre-position” destructive malware for later activation. The financial and healthcare sectors are top targets because of the highly valuable, sensitive data they hold. And healthcare third-party mission-critical technology, service and supply chain providers continue to be key targets of ransomware attacks because these attacks cause maximum disruption across the entire healthcare sector, shutting down critical systems and impacting patient care and safety. These are not just data-theft crimes, they are “threat-to-life” crimes.

The Threat Is Blended

Cybercrime and national security threats are now intertwined. Nation-states are directing criminal ransomware groups, placing remote IT workers inside U.S. companies, using proxy hackers to disguise attribution for the attack, and even using legitimate companies within their own countries to facilitate access to U.S. networks.

Following the Path of Least Resistance

While these nation-states possess advanced cyber capabilities, they rarely need to use them. Instead, they take advantage of security gaps and “softer” targets such as end-of-life devices, poorly secured remote access, weak credentials (such as those lacking multi-factor authentication), unpatched systems and stolen credentials (obtained, for instance, by social engineering their way into a helpdesk).

Defense, Defense, Defense

According to the FBI, roughly 95% of breaches exploit at least one of the weaknesses addressed by Operation Winter SHIELD’s top 10 cybersecurity controls. These defensive best practices include implementing:

• Phishing-resistant multi-factor authentication.
• A risk-based vulnerability management program.
• Tracking and retiring end-of-life hardware and software on a defined schedule.
• Third-party risk management.
• Offline, immutable backups.

Beyond Prevention, Early Detection Is Key

No organization can stop 100% of cyberattacks, making early detection just as critical as preventive efforts. In healthcare environments, adversaries can dwell undetected for an average of 270 days. Identifying these threats as quickly as possible will limit their potential for disruption. Steps your healthcare organization can take include:

• Monitoring cybersecurity advisories from the FBI and its partners to stay informed on emerging cyberthreats. These advisories provide information to help organizations detect and block adversaries. Visit this AHA webpage for cybersecurity news and advisories as they occur.
• Leveraging AI. With many adversaries using AI themselves to automate reconnaissance and other portions of the attack life cycle, hospitals can use AI for purposes such as behavior-based detection. That means using AI to analyze logs collected from key user accounts, network devices and data stores for anomalies in behavior.

Support for Your Security Efforts from the AHA’s Cybersecurity and Risk Experts

Our team offers a wide variety of strategic cybersecurity and risk advisory services to assist AHA members, many of which are included with your AHA membership.

We are also available anytime, including after hours, at no cost, should your AHA member organization need urgent assistance, guidance or introduction to trusted government contacts as a result of a cyber or risk incident.

• John Riggi, National Advisor for Cybersecurity and Risk: jriggi@aha.org
• Scott Gee, Deputy National Advisor for Cybersecurity and Risk: sgee@aha.org