Agencies recommend action to protect networks from compromise

The Cybersecurity & Infrastructure Security Agency this week released recommendations to help health care and other critical infrastructure organizations protect their networks from malicious cyber actions, based on a simulated attack the agency conducted against an organization at its request. The advisory highlights the importance of collecting and monitoring logs for unusual activity, and regular testing to ensure security processes and procedures are up to date and effective. 

“This highly detailed and technical report is an excellent guide to help implement specific cybersecurity tools that will help detect a cyberattack in the early stages and significantly reduce its spread and impact,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “The ‘red team’ or penetration test used a common combination of voice and email social engineering techniques to gain trust of the end users and compromise their credentials, which reaffirms government and AHA cybersecurity guidance that relatively low-cost basics such as establishing phishing-resistant multi-factor authentication are essential to reduce cyber risk. I would strongly encourage hospitals and health systems to explore the possibility of leveraging CISA’s authority and capacity to provide free technical assistance, including red team penetration testing.” 

Also this week, the FBI and CISA released recommendations to protect organizations from the latest Royal ransomware variant.

“The reportedly Russia-linked Royal ransomware gang continues to target organizations globally, becoming one of the most prolific and aggressive ransomware variants,” Riggi said. “Royal’s customizable encryption program includes tactics such as disabling anti-virus programs, using phishing emails and leveraging unsecured remote desktop protocol. The alert recommends loading actionable indicators of compromise in network defenses and setting network monitoring tools to prevent disabling anti-virus programs, activating penetration testing tools such Cobalt Strike and exfiltrating patient data to unknown IP addresses.” 
  
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.