The Cybersecurity & Infrastructure Security Agency this week released recommendations to help health care and other critical infrastructure organizations protect their networks from malicious cyber actions, based on a simulated attack the agency conducted against an organization at its request. The advisory highlights the importance of collecting and monitoring logs for unusual activity, and regular testing to ensure security processes and procedures are up to date and effective. 

“This highly detailed and technical report is an excellent guide to help implement specific cybersecurity tools that will help detect a cyberattack in the early stages and significantly reduce its spread and impact,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “The ‘red team’ or penetration test used a common combination of voice and email social engineering techniques to gain trust of the end users and compromise their credentials, which reaffirms government and AHA cybersecurity guidance that relatively low-cost basics such as establishing phishing-resistant multi-factor authentication are essential to reduce cyber risk. I would strongly encourage hospitals and health systems to explore the possibility of leveraging CISA’s authority and capacity to provide free technical assistance, including red team penetration testing.” 

Also this week, the FBI and CISA released recommendations to protect organizations from the latest Royal ransomware variant.

“The reportedly Russia-linked Royal ransomware gang continues to target organizations globally, becoming one of the most prolific and aggressive ransomware variants,” Riggi said. “Royal’s customizable encryption program includes tactics such as disabling anti-virus programs, using phishing emails and leveraging unsecured remote desktop protocol. The alert recommends loading actionable indicators of compromise in network defenses and setting network monitoring tools to prevent disabling anti-virus programs, activating penetration testing tools such Cobalt Strike and exfiltrating patient data to unknown IP addresses.” 
  
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.

Related News Articles

Headline
U.S. and international cybersecurity authorities released an advisory to help health care and other critical infrastructure organizations identify and…
Headline
An interagency task force chaired by the Cybersecurity and Infrastructure Security Agency and FBI yesterday released an updated guide offering best…
Headline
During a month-long ransomware attack on four hospitals in 2021, two neighboring hospital emergency departments experienced increased patient volumes, wait…
Headline
The FBI, Cybersecurity and Infrastructure Security Agency, and Australian Cyber Security Centre issued recommendations to help critical infrastructure…
Headline
Health sector organizations should immediately patch a vulnerability in Veeam software used to back up, replicate and restore data on virtual machines, the…
Headline
The Food and Drug Administration last week alerted health care providers and laboratory personnel to a cybersecurity vulnerability affecting the Universal Copy…