Fact sheet highlights ways to reduce risk working with third-party networks for managing critical functions

The FBI and the Cybersecurity and Infrastructure Security Agency have released a fact sheet for critical infrastructure organizations on ways to reduce risk and minimize vulnerabilities when working with third-party hardware and software networks designed to monitor and automate physical processes for control systems and devices, such as pumps, sensors and industrial computers for operating essential equipment. In healthcare, such applications are common throughout facilities and include climate control, building automation, access control and other systems. Such operational technology systems are essential for maintaining clinical operations. The agencies said that organizations should maintain caution when granting third-party networks high levels of access or control over such operations, allowing only the minimum access necessary to perform their assigned tasks. Granting additional access could expose owners and operators to malicious cyber actors attempting to exploit and compromise equipment and critical functions. The fact sheet includes recommendations for organizations to assess and reduce risk of attacks.

For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.