Cybersecurity Guidelines Released for Healthcare

Infosecurity Magazine | January 02, 2019

Cybersecurity Guidelines Released for Healthcare
Recognizing the threat to both critical infrastructure and human health and safety in the event of a cyber-attack, the Department of Health and Human Services (HHS) recently released Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients, a publication nearly two years in the making. “This publication is the result of the collaborative work HHS and its industry partners embarked on more than a year ago – namely, the development of practical, understandable, implementable, industry-led, and consensus-based voluntary cybersecurity guidelines to cost-effectively reduce cybersecurity risks for health care organizations of varying sizes, ranging from local clinics, regional hospital systems, to large health care systems,” wrote Eric Hargan, deputy secretary of HHS. The document is the result of a collaborative partnership between industry and government, prompted by a mandate set forth by the Cybersecurity Act of 2015, Section 405(d), to develop practical cybersecurity guidelines to cost-effectively reduce cybersecurity risks for the healthcare industry, according to an HHS press release.

Spotlight

The information technology community has utilized container technology since the LXC project began in 2008 (Hildred, 2015). Containers are a form of virtualization that package application code and its dependencies together. Containers share the operating system kernel but maintain isolated processes. Until recently, it was not possible for the Windows operating system to share its kernel.

Related News

DATA SECURITY

Perfect storm of cybersecurity risks threatens the hybrid workplace

HP Wolf Security | November 01, 2021

HP Inc. today released its latest HP Wolf Security report: Out of Sight & Out of Mind, a comprehensive global study highlighting how the rise of hybrid work is changing user behavior and creating new cybersecurity challenges for IT departments. The research shows that a growing number of users are buying and connecting unsanctioned devices outside of IT’s purview. It also highlights that threat levels are rising, with attackers increasingly successful at bypassing defenses and tricking users into initiating attacks through phishing. All of this is making IT support more complex, time-consuming, and costly than ever. The report combines data from a global YouGov online survey of 8,443 office workers who shifted to Working from Home (WFH) during the pandemic, and a global survey of 1,100 IT decision makers conducted by Toluna. Key findings include: New Shadow IT buying and installing endpoints with security out of mind: ‘Shadow IT’ typically refers to non-IT departments deploying software beyond the purview of IT. This shadow is now spreading, with individuals procuring and connecting devices without being checked by IT. 45% of office workers surveyed purchased IT equipment (such as printers and PCs) to support home working in the past year. However, 68% said security wasn’t a major consideration in their purchasing decision, while 43% didn’t have their new laptop or PC checked or installed by IT, and 50% said the same of their new printer. Phishing becoming increasingly successful: 74% of IT teams have seen a rise in the number of employees opening malicious phishing links or attachments on emails in the last 12-months. 40% of office workers surveyed aged 18-to-24 have clicked on a malicious email with almost half (49%) saying they have done so more often since working from home. Of office workers that clicked or nearly clicked a link, 70% didn’t report it to IT – 24% didn’t think it was important, 20% cited the “hassle factor”, while 12% had a fear of reprisal or being punished. Increase in devices being compromised fuels growth in rebuild rates: 79% of IT teams report rebuild rates increased during the pandemic. Rebuild rates directly correlate to the number of endpoints that require wiping and reimaging because they have been compromised, which implies more attackers are successfully breaching outer defenses. The real figure could be higher still: 80% of IT teams worry that employee devices might be compromised and they don’t know about it. "People often don't know if they have clicked on something malicious, so the real numbers are likely much higher," comments Ian Pratt, Global Head of Security for Personal Systems, HP Inc. "Threat actors don't always announce themselves, as playing the 'long game' to move laterally and infiltrate higher-value infrastructure has proven to be more lucrative. For example, by using cloud backups to exfiltrate sensitive data in bulk, encrypting data on servers, then demanding a multi-million-dollar ransom.” Pratt continues: "It shouldn't be this easy for an attacker to get a foothold - clicking on an email attachment should not come with that level of risk. By isolating and containing the threat you can mitigate any harmful impact, preventing persistence and lateral movement." With threats rising, it’s becoming more difficult for IT teams to deliver security support. 77% of IT teams said the time it takes to triage a threat has increased in the past year, while an estimated 62% of alerts relating to the endpoint are false positives, leading to wasted time. With IT teams tied up dealing with alerts, it’s becoming harder for them to onboard employees and identify threats: 65% of IT teams said that patching endpoint devices is more time-consuming and difficult due to the mass shift to home working, while 64% said the same of provisioning and onboarding new starters with secure devices. As a result, IT teams estimate the cost of IT support in relation to security has risen by 52% in the last 12-months. 83% of IT teams said the pandemic has put even more strain on IT support because of home worker security problems, while 77% of IT teams say homeworking is making their job much harder and that they fear teams will burnout and consider quitting. “As IT continues to grow in complexity, security support is becoming unmanageable,” Pratt concludes. "For hybrid working to be a success, IT security teams need to be freed from spending hours provisioning and fielding user access requests so they can focus on tasks that add value. We need a new security architecture that not only protects against known and unknown threats, but that helps to reduce the burden to liberate cybersecurity teams and users alike. By applying the principles of Zero Trust, organizations can design resilient defenses to keep the business safe and recover quickly in the event of a compromise.” HP is helping organizations to secure the hybrid workplace by delivering endpoint security that provides teams with greater visibility and management tools. With HP Wolf Security1 organizations benefit from robust, built-in protection from the silicon to the cloud, and BIOS to browser. HP Wolf Security provides the ideal support for securing the hybrid workplace – for example HP Sure Click Enterprise2 reduces the attack surface by rendering malware, delivered via email, browser or downloads, harmless through threat containment and isolation. HP Wolf Security enables teams to deliver defense-in-depth and enhanced protection, privacy, and threat intelligence, gathering data at the endpoint to help protect the business at large. About HP Wolf Security From the maker of the world’s most secure PCs3 and Printers4, HP Wolf Security is a new breed of endpoint security. HP’s portfolio of hardware-enforced security and endpoint-focused security services are designed to help organizations safeguard PCs, printers, and people from circling cyber predators. HP Wolf Security provides comprehensive endpoint protection and resiliency that starts at the hardware level and extends across software and services.

Read More

Work-From-Home Cyber Security Risks: Three Ways to Protect Your Network

prnewswire | August 26, 2020

Responding to the rapid increase in work-from-home cyber security incidents at small and midsized businesses (SMBs), DIGIGUARD is now focusing its Cyber Threat Protection Services on remote workforce IT security. "Managing and monitoring work-from-home (WFH) employees includes cybersecurity risk management. Controlling network access helps protect valuable business and customer data from cybercriminals," said DIGIGUARD's Harvey Yan. At a minimum, Yan urges SMBs do three things: Secure and update network perimeter defenses along with endpoints that access the network such as computers, laptops and mobile phones.

Read More

NCG Extends Support to DoD Vendors with Crucial Tool for Cybersecurity Maturity Model Certification

NCG | July 07, 2020

Northcross Group (NCG) announced its latest innovative tool, a questionnaire to support the Cybersecurity Maturity Model Certification (CMMC)— a new U.S. Department of Defense (DoD) process going into effect later this year. DoD will use CMMC to ensure a base level cybersecurity capability across the full Defense Industrial Base supply chain. Certification under CMMC will be required for all DoD vendors to renew or win new contracts starting later this year.NCG, a leader in cybersecurity services that support companies navigating through vast and complex business challenges while maintaining a business edge, has developed a free online questionnaire as a first step for DoD vendors to determine how they currently measure up to the CMMC model.The questionnaire helps an organization know where they stand and understand what is needed to achieve their targeted CMMC Maturity Level. "As a DoD vendor ourselves, we understand the challenges of maintaining compliance and seek to provide a way for companies to get a good starting point," said Chris Bender, President of NCG. "We have helped organizations in healthcare, transportation, and banking build cybersecurity programs to meet similar requirements, and know having a good read on their current state is important," added Mr. Bender.

Read More

Spotlight

The information technology community has utilized container technology since the LXC project began in 2008 (Hildred, 2015). Containers are a form of virtualization that package application code and its dependencies together. Containers share the operating system kernel but maintain isolated processes. Until recently, it was not possible for the Windows operating system to share its kernel.