The FBI and Cybersecurity & Infrastructure Security Agency July 4 released guidance to respond to the recent supply-chain ransomware attack leveraging a vulnerability in Kaseya VSA software against multiple managed service providers and their customers. Among other actions, CISA and FBI strongly urge affected MSPs and their customers to download the Kaseya VSA detection tool, which analyzes a system and determines whether any indicators of compromise are present; enable and enforce multi-factor authentication on every single account that is under the control of the organization, and — to the maximum extent possible — enable and enforce MFA for customer-facing services; implement allowlisting to limit communication with remote monitoring and management capabilities to known IP address pairs. President Biden has directed the full resources of the government to investigate this incident.  
  
John Riggi, AHA's senior advisor for cybersecurity and risk, said, “This attack once again demonstrates that our cyber adversaries are conducting highly researched and strategic attacks targeting ubiquitous technology service providers that provide broad access to the initial targets and their customer base. It is incumbent upon all of us to implement and maintain risk-based vendor risk management programs, which identify mission critical business associates, their dependencies and any business associate, software or service that has elevated network access and privilege. Implementing the above controls is essential not only to mitigate the Kaseya risk, but also represents best practices to mitigate similar strategic third-party risk as we have seen in the recent SolarWinds, MS print spooler and Exchange compromises." 
 
For more on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.
 

Related News Articles

Headline
The FBI, Cybersecurity and Infrastructure Security Agency and international agencies July 29 released a joint advisory on recent tactics by the Scattered…
Headline
Microsoft July 22 released an update on the ongoing cyberattacks to SharePoint servers used within organizations, attributing the incidents to China-based…
Headline
The FBI, Cybersecurity and Infrastructure Security Agency, Department of Health and Human Services, and Multi-State Information Sharing and Analysis Center…
Headline
Microsoft July 19 issued an alert about active attacks from vulnerabilities targeting SharePoint servers used within organizations. The incidents have not…
Headline
In his latest AHA Cyber and Risk Intel blog, Scott Gee, AHA deputy national advisor for cybersecurity and risk, explains how hospitals can prepare for and…
AHA Cyber Intel
In today’s heightened threat environment, driven by domestic and geopolitical issues, it is more critical than ever for hospitals to prepare for and mitigate…