A guide published Jan. 13 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI, Environmental Protection Agency, Transportation Security Administration and international agencies provides considerations for organizations to select and secure operational technology products. The guide suggests owners select products from manufacturers prioritizing security elements such as configuration management, logging in the baseline product, open standards, ownership, protection of data and more.  

"Many hospitals have vast quantities of network-connected OT devices such as cameras, door access controls and HVAC systems," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Keeping these devices secure and operational is critical to the delivery of high-quality patient care. When making purchasing decisions for new technology, hospitals should demand these security standards be part of the product.

“This is also a good reminder to look at the legacy technology in your networks and apply as many of these principles as possible. If legacy equipment cannot be brought up to these standards, understand the vulnerabilities in those systems and have a plan to segment and monitor the devices.

“More importantly, hospitals and health systems should understand the clinical and business impact which may result from a loss of OT due to a loss of network connectivity during a cybersecurity event. It is strongly recommended that health care organizations maintain business and clinical continuity plans to compensate for a loss of OT for 30 days or longer." 
 
For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity

Related News Articles

Headline
The Centers for Medicare & Medicaid Services June 27 announced the rollout of a 6-year technology-enabled prior authorization program pilot. Through…
Headline
The Centers for Medicare & Medicaid Services today announced it has identified a fraud scheme targeting Medicare providers and suppliers. CMS said scammers…
Headline
The FBI, Cybersecurity and Infrastructure Security Agency and Australian Cyber Security Centre June 4 released an advisory on updated actions and tactics used…
Headline
The National Security Agency, Cybersecurity and Infrastructure Security Agency and international partners May 22 released guidance on securing data used for…
Headline
The FBI, along with the National Security Agency and other international cybersecurity agencies, this week released a joint agency advisory on cyber operations…
Headline
The FBI's Internet Crime Complaint Center released an alert May 7 warning of cyber actors exploiting vulnerabilities in end-of-life routers. Routers dated 2010…