The Cybersecurity and Infrastructure Security Agency Aug. 21 published guidance providing best practices for event logging to mitigate cyberthreats. The document was developed with the FBI, National Security Agency and multiple international cybersecurity agencies. The guide provides recommendations designed to improve organizational resilience in the current cyberthreat environment. 
 
"In the current cyberthreat environment, understanding your network and everything attached to it is critical," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Quality log data helps in building a comprehensive picture of your environment, drives detection and alerting systems to discover issues quickly, and helps incident responders understand what went wrong if you do suffer a cybersecurity incident. This document provides guidance on 'implement(ing) an event logging policy focused on capturing high-quality cyber security events to aid network defenders in correctly identifying cyber security incidents.' 
 
"Ideally, logs should be stored for a period of one year, subject to storage space constraints. In the middle of an incident is not the time to find out that you were not logging useful data, or that you were not retaining that data for long enough to thoroughly investigate the incident. Within the past year, Microsoft has added additional free log storage for several of their service tiers. The field is reminded that rural hospitals are eligible for free and heavily discounted Microsoft services.” 
 
For more information on this or other cyber and risk issues contact Gee at sgee@aha.org. For the latest threat information and other cyber and risk resources visit www.aha.org/cybersecurity.

Related News Articles

Headline
The FBI's Internet Crime Complaint Center released an alert May 7 warning of cyber actors exploiting vulnerabilities in end-of-life routers. Routers dated 2010…
Headline
The FBI’s Internet Criminal Complaint Center May 15 released an alert warning of a malicious text and voice messaging campaign involving impersonators…
Headline
In his latest AHA Cyber Intel blog, John Riggi, AHA national advisor for cybersecurity and risk, examines the state of cyber and physical threats in 2025 as…
Headline
Health care had more cyberthreats last year than any other critical infrastructure industry, according to the FBI's 2024 Internet Crime Report released April…
Headline
The National Security Agency April 23 released a report on operational technology systems that includes recommendations for security policies and technical…
Chairperson's File
Public
Cybersecurity and physical threats are unfortunately significant enterprise risks for health care, regardless of size or location. Every hospital, physician…