Cyber Attacks Flashcards
First Line of Defense
1) Role-based Cybersecurity Training: Provide robust, customized security training for all employees based on their job function to ensure continuity of security expectations.
2) Phishing Simulation Training: Prepare employees to identify and proactively respond to phishing attacks in the workplace environment.
3) Asset Management Programs: Ensure that all data, devices, and systems are categorized and inventoried according to their importance to the organization’s objectives.
4) Cybersecurity Policies: Create and communicate your organization’s security policies to all employees to level set expectations for protecting patient data.
5) Insider Threat Training: Incorporate insider threat training into your on-boarding policies for new employees.
6) Physical Security: Put physical controls into the office environment to prevent access to or the use of company computers by unauthorized individuals.
Behind the scenes defenses are equally important to prevent cyberattacks from occurring or spreading through your organization. Every size organization should instill a few of the following practices to protect your organization:
- Email System Configurations: Enact controls to enhance the security posture of your e-mail system, such as configuring your email system to tag messages as “EXTERNAL” that are sent from outside of your organization.
- Multi-Factor Authentication: Use at least two of the following to verify a user’s identity: something you know, something you have, and something you are.
- Data Protection Policies: Establish a data classification policy that categorizes data as, for example, Sensitive, Internal Use, or Public Use.
- Network segmentation: Partition networks into security zones which can be based on sensitivity of assets within the network or standard perimeter segmentations.
- Intrusion Prevention: Utilize an intrusion prevention system for reading network traffic to detect and prevent potential attacks against your network perimeter, data center, and partner connections.
- Vulnerability Management: Proactively discover vulnerabilities that will enable the organization to classify, evaluate, prioritize, remediate, and mitigate the technical vulnerability footprint from the perspective of an attacker.
- Incident Response Plans: Maintain cyber threat detection and response capabilities by establishing an Incident Response program and a Security Operations Center to manage the plan.
Why is healthcare targeted?
- Protected Health Information (PHI) and Personal Identifiable Information (PII) is worth a lot of money for attackers.
- Ransomware attackers take advantage of the time sensitive nature of healthcare and rely on health organizations paying ransoms to continue delivering patient care.
- The healthcare industry also encompasses outdated technology that is vulnerable to attackers.
- Healthcare staff include a wide range of professions and not everyone is educated on cyber hygiene and safety.
- Healthcare has a broad attack surface because of many connected devices that reside inside a small, medium, or large health organization.
Prepare - Before the attack
GENERAL USERS AND MEDICAL PRACTITIONERS
1) Practice pen and paper operations to maintain hard copies of patient data
2) Understand your organization’s incident response plan
3) Identify your IT/Security point of contact in case of a cyberattack
React- During the Attack
GENERAL USERS AND MEDICAL PRACTITIONERS
1) Implement your organization’s protocol for incident handling
2) Consider removing the ability to print and copy/paste from Electronic Medical Records (EMR) applications or web mail accessed from home
Recover - After the attack
GENERAL USERS AND MEDICAL PRACTITIONERS
1) Take care not to reinfect clean systems during recovery
2) Document lessons learned and adjust policies and response plans accordingly
Prepare - Before the Attack
CYBER/IT PROFESSIONALS
• Maintain offline, encrypted backups of data with 3-2-1 backup strategy
• Create, maintain, and exercise a cyber incident response plan to include a communication strategy during incidents
• Conduct regular vulnerability scanning
• Regularly patch and ensure devices are securely configured.
• Apply the principle of least privilege to all systems and devices • Implement security protocols and filters at the email
gateway to prevent successful phishing attempts
• Authenticate in-bound email to prevent email spoofing
React- During the Attack
CYBER/IT PROFESSIONALS
1) Implement steps learned in your cybersecurity awareness and training program
2) Request assistance from CISA, HHS, MS-ISAC, and local, state, or federal law enforcement partners
3) Take a system image and memory capture of a sample of affected devices and collect relevant logs for evidence
4) Consult federal law enforcement about possible decrypts available and follow trusted guidance for the particular ransomware variant
Recover - After the Attack
CYBER/IT PROFESSIONALS
- Restore data from offline, encrypted backups based on prioritization of critical services
- Issue password resets for all affected systems and users
- Follow additional technical guidance from CISA and MS-ISAC
- Monitor network traffic and run antivirus scans to identify any remaining infection
- Address any associated vulnerability and gaps in security or visibility
- Clean, rebuild, and re-connect systems based on prioritization of critical services
Prepare- Before the Attack
EMERGENCY MANAGERS
- Perform risk management for third party vendors and managed service providers (verify)
- Implement a cybersecurity user awareness and training program
- Make sure you understand which personnel will support the leader during each phase of the investigation
React- During the Attack
EMERGENCY MANAGERS
- Determine which devices were affected and immediately isolate them
- Power down affected systems for investigation and recovery
- Triage affected systems for investigation and recovery
- Contain any associated systems that may be useful for further or continued unauthorized access
Recover - After the Attack
EMERGENCY MANAGERS
• Confer with team and stakeholders to document what happened
on initial analysis
• Consider sharing lessons learned and indicators of compromise with CISA or your sector ISAC/ISAO for further sharing and to benefit others within the community
Medical Device Attack Mitigation Practices to Consider
Establish and maintain communication with medical device manufacturer’s product security teams (9.L.A)
Patch devices after patches have been validated, distributed by the medical device manufacturer, and properly tested (7.S.A, 9.M.B )
Assess current security controls on networked medical devices (9.M.B, 9.M.E, 9.S.A)
Assess inventory traits such as IT components that may include the Media Access Control (MAC) address, Internet Protocol (IP) address, network segments, operating systems ,applications, and other elements relevant to managing information security risks (9.M.D)
Implement pre-procurement security requirements for vendors (9.L.C)
Engage information security as a stakeholder in clinical procurements (9.L.C) Use a template for contract language with medical device manufacturers and others (9.L.C)
Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access
Staying Resilient to Medical Device Attacks
Know your organization’s protocols in case of a potential shutdown or attack against medical devices. Help patients and staff by understanding the processes and procedures which can help mitigate the impacts. That means asking:
- Who is responsible for working with manufacturers to confirm security settings and software updates are maintained properly on each device?
- What additional security controls and monitors be put in place to protect each device?
- How will our staff and patients be notified if medical devices are compromised?
- What is our plan if medical devices are compromised and how will patients notify us if they suspect a compromise?
Insider, Accidental or Intentional Data Loss Mitigation Practices to Consider
1) Train staff and IT users on data access and financial control procedures to mitigate social engineering or procedural errors (1.S.B, 1.M.D)
2) Implement and use workforce access auditing of health record systems and sensitive data (3.M.B)
3) Implement and user privileges access management tools to report access to critical technology infrastructure and systems (3.M.C)
4) Implement and use data loss prevention tools to detect and block leakage of PHI and PII via e-mail and web uploads (4.M.E, 4.L.A)
