A guide published Jan. 13 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI, Environmental Protection Agency, Transportation Security Administration and international agencies provides considerations for organizations to select and secure operational technology products. The guide suggests owners select products from manufacturers prioritizing security elements such as configuration management, logging in the baseline product, open standards, ownership, protection of data and more.  

"Many hospitals have vast quantities of network-connected OT devices such as cameras, door access controls and HVAC systems," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Keeping these devices secure and operational is critical to the delivery of high-quality patient care. When making purchasing decisions for new technology, hospitals should demand these security standards be part of the product.

“This is also a good reminder to look at the legacy technology in your networks and apply as many of these principles as possible. If legacy equipment cannot be brought up to these standards, understand the vulnerabilities in those systems and have a plan to segment and monitor the devices.

“More importantly, hospitals and health systems should understand the clinical and business impact which may result from a loss of OT due to a loss of network connectivity during a cybersecurity event. It is strongly recommended that health care organizations maintain business and clinical continuity plans to compensate for a loss of OT for 30 days or longer." 
 
For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity

Related News Articles

Headline
Microsoft July 22 released an update on the ongoing cyberattacks to SharePoint servers used within organizations, attributing the incidents to China-based…
Headline
The FBI, Cybersecurity and Infrastructure Security Agency, Department of Health and Human Services, and Multi-State Information Sharing and Analysis Center…
Headline
The AHA July 24 announced it is collaborating with health care technology leader Epic to help hospitals adopt tools that support the early detection and…
Headline
The White House July 23 released an action plan with a series of more than 90 policy recommendations to expand the use of artificial intelligence. The plan…
Headline
Microsoft July 19 issued an alert about active attacks from vulnerabilities targeting SharePoint servers used within organizations. The incidents have not…
Headline
In his latest AHA Cyber and Risk Intel blog, Scott Gee, AHA deputy national advisor for cybersecurity and risk, explains how hospitals can prepare for and…