Agencies release guide on selecting and integrating security into operational technology products

A guide published Jan. 13 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI, Environmental Protection Agency, Transportation Security Administration and international agencies provides considerations for organizations to select and secure operational technology products. The guide suggests owners select products from manufacturers prioritizing security elements such as configuration management, logging in the baseline product, open standards, ownership, protection of data and more.  

"Many hospitals have vast quantities of network-connected OT devices such as cameras, door access controls and HVAC systems," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Keeping these devices secure and operational is critical to the delivery of high-quality patient care. When making purchasing decisions for new technology, hospitals should demand these security standards be part of the product.

“This is also a good reminder to look at the legacy technology in your networks and apply as many of these principles as possible. If legacy equipment cannot be brought up to these standards, understand the vulnerabilities in those systems and have a plan to segment and monitor the devices.

“More importantly, hospitals and health systems should understand the clinical and business impact which may result from a loss of OT due to a loss of network connectivity during a cybersecurity event. It is strongly recommended that health care organizations maintain business and clinical continuity plans to compensate for a loss of OT for 30 days or longer." 
 
For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.