HHS: Apply critical OpenSSL security patch as soon as deployed Nov. 1

Oct 31, 2022 - 04:03 PM
cybersecurity-hand-lock-graphic_900x400

The Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center highly recommends all health sector organizations immediately test and deploy a critical OpenSSL patch when it becomes available Nov. 1, because many of the most common operating systems and applications use the OpenSSL software library for secure communications.

“Once again we have ubiquitous, embedded third-party technology that is often out of view of the end users and cybersecurity teams creating cyber risk exposure for our hospitals and health systems,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “This also highlights the ongoing need for a software bill of materials for medical devices and other pieces of mission-critical medical technology. Identifying instances of OpenSSL in your infrastructure will certainly help expedite deployment of the patch — remember the cyber ‘bad guys’ have the same notice of this vulnerability and now it’s a race to patch, before they exploit it.”

Related News Articles

Perspective
Staying Cyber Alert and Cyber Ready
Public
As the world has learned in recent years, today’s conflicts are fought with many weapons, and cyber warfare is an integral part of the arsenal.As of this…
Headline
FBI reminds of potentially malicious activity by Iranian cyber actors
The FBI is reminding critical infrastructure organizations to implement mitigations from a June 2025 fact sheet on potential actions by Iranian-affiliated…
Headline
CISA report updates findings on RESURGE malware attacks
The Cybersecurity and Infrastructure Security Agency Feb. 26 released a report that updates findings from last year on RESURGE malware used to gain covert…
Headline
Agencies issue guidance on exploitation of Cisco systems by cyber actors 
U.S. and international agencies Feb. 25 released guidance on protecting Cisco Software-defined Wide-area Networking systems from exploitation by malicious…
Headline
NSA issues guidelines on zero trust architecture
The National Security Agency has released two phases of its Zero Trust Implementation Guidelines for organizations to improve their zero trust architecture.…
Headline
CISA announces town halls to gather public input on proposed cyber incident reporting requirements
The Cybersecurity and Infrastructure Security Agency announced Feb. 13 that it will host a series of virtual town hall meetings to gather public input on…