The Cybersecurity & Infrastructure Security Agency this week released recommendations to help health care and other critical infrastructure organizations protect their networks from malicious cyber actions, based on a simulated attack the agency conducted against an organization at its request. The advisory highlights the importance of collecting and monitoring logs for unusual activity, and regular testing to ensure security processes and procedures are up to date and effective. 

“This highly detailed and technical report is an excellent guide to help implement specific cybersecurity tools that will help detect a cyberattack in the early stages and significantly reduce its spread and impact,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “The ‘red team’ or penetration test used a common combination of voice and email social engineering techniques to gain trust of the end users and compromise their credentials, which reaffirms government and AHA cybersecurity guidance that relatively low-cost basics such as establishing phishing-resistant multi-factor authentication are essential to reduce cyber risk. I would strongly encourage hospitals and health systems to explore the possibility of leveraging CISA’s authority and capacity to provide free technical assistance, including red team penetration testing.” 

Also this week, the FBI and CISA released recommendations to protect organizations from the latest Royal ransomware variant.

“The reportedly Russia-linked Royal ransomware gang continues to target organizations globally, becoming one of the most prolific and aggressive ransomware variants,” Riggi said. “Royal’s customizable encryption program includes tactics such as disabling anti-virus programs, using phishing emails and leveraging unsecured remote desktop protocol. The alert recommends loading actionable indicators of compromise in network defenses and setting network monitoring tools to prevent disabling anti-virus programs, activating penetration testing tools such Cobalt Strike and exfiltrating patient data to unknown IP addresses.” 
  
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.

Related News Articles

Perspective
This week’s cyberattack on Change Healthcare, one of the nation’s largest health care technology companies, is yet another unwelcome reminder of the…
Headline
A cyberattack Feb. 21 began disrupting systems and services at Change Healthcare, one of the largest health care technology companies in the United States,…
Headline
The U.S. Department of Justice, United Kingdom and other global partners have seized control of servers used by the LockBit ransomware-as-a-service group,…
Headline
Bryan Smith, recently retired chief of the FBI’s Cyber Criminal Operations Section, discusses the challenge of protecting the nation's caregivers and patients…
Headline
The National Institute of Standards and Technology this week released updated guidance to help HIPAA-covered entities and business associates assess and manage…
Headline
The FBI Feb. 15 released an alert to help organizations detect and reduce the risk of network compromise from the Warzone Remote Access Trojan, a malware…