[{"innerBlocks":[],"name":"core\/freeform","postId":127320,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"

17 steps to harden defenses against nation-state cyber attacks<\/h2>
Recent world events, such as the rising international tensions with Iran, are focusing more attention on the threat of nation-state sponsored cyberattacks against the nation\u2019s information infrastructure. While U.S. government cyber defenses are believed to be strong, there\u2019s growing concern that the nation\u2019s healthcare system and individual provider organizations could fall prey to concerted attacks, according to recently published guidance from the Association for Executives in Healthcare Information Security.The publication<\/a>, prepared by the AEHIS Incident Response Committee, notes that \u201ceven a nation without great military might can possess the potential to unleash havoc\u201d on IT infrastructure. \u201cEven if not explicitly targeted, hospitals need to consider that their systems could still be impacted as collateral damage in a cyberattack scenario.\u201dThe risks are great, according to a separate assessment by Caleb Barlow, CEO of cybersecurity firm CynergisTek, who expects Iranian cyberactors will initiate destructive \u201cwiper\u201d attacks to erase and disable key systems and cripple organizations on the US mainland. He predicts hospitals and healthcare organizations will be top priority targets because of their relatively weak security and the opportunity they present to generate significant cost and impact on the public.To be prepared, hospitals must implement controls and plans to deal with state-sponsored cyberattacks, the AEHIS guidance urges, offering these 17 steps as essential in protecting healthcare organizations\u2019 data assets.<\/p>

Patching<\/h2>
If cyberattacks appear likely, ensuring that all connected systems are properly patched for known vulnerabilities is critical. \u201cParticular attention should be placed on any public-facing systems and any systems that are used to connect to the internet or open email from third parties,\u201d AEHIS notes. \u201cFor legacy systems that can no longer be patched, organizations may want to consider placing a firewall with IPS functionalities or, in the case of Web servers, a Web Application Firewall (WAF) in front of an asset as a means of providing a level of virtual patching.\u201d<\/p>

Disaster recovery and business continuity plans<\/h2>
All organizations should review and practice disaster recovery (DR) and business continuity (BC) plans to ensure that they can operate and maintain patient safety in the event of power loss, communications failures, or the loss of other critical infrastructure. \u201cBackup systems should also be tested to ensure all data is being properly backed up and that restore functionality can be successfully achieved,\u201d AEHIS suggests. \u201cIdeally, staff should be cross trained in DR and BC planning in case a loss of mass transit, power grids or other element of critical infrastructure results in lack of availability of an employee.\u201d<\/p>

Geoblocking<\/h2>
Hospitals should establish a list of regions of the world that they consider hostile and implement geoblocks in their firewalls and WAFs against network traffic stemming to and from them. Organizations also may want to consider implementing geoblocks in their spam filters. \u201cWhile an attacker can bypass such blocks using a VPN or proxy, the presence of such geoblocks does require the attacker to put in a bit more effort and typically works to reduce the number of attacks an organization sees as a resul,\u201d AEHIS notes.<\/p>

Security information and event management alerts<\/h2>
Organizations should make use of SIEM alerts as part of their log management and incident identification strategies, AEHIS\u2019 publication suggests. \u201cOrganizations may want to customize their SIEM ruleset to include any network traffic or communication going to or coming from any nations they deem hostile.\u201d External threat intelligence can also warn of IP addresses, URLs or other indicators of compromise and can be fed into a SIEM to enable faster delivery of alerts for any suspicious cyber activities.<\/p>

Threat intelligence<\/h2>
Threat intelligence is crucial\u2014it can help security executives take a more proactive stance in putting blocks or other controls in place before a threat hits an environment. \u201cWhen used in conjunction with a SIEM and\/or enterprise detection and response, (threat intelligence) can help you to better identify threats you may already be facing,\u201d the AEHIS guidance states.<\/p>

Network segmentation<\/h2>
Network segmentation can reduce the amount of damage from attacks such as ransomware. The more segmented a network is, the more difficult lateral movement is, resulting in a higher probability that the damage will be contained. \u201cIdeally, network segmentation should be done to the point of zero trust, but at a minimum, segmenting off any connected medical devices or other systems deemed critical for patient safety is a must,\u201d the AEHIS guidance notes. \u201cIdeally, organizations should isolate medical devices in a manner that minimizes connectivity and ports for optimal protection.\u201d<\/p>

Audit publicly exposed assets and services<\/h2>
Healthcare organizations often don\u2019t fully understand on what assets are public facing. Security executives should identify public facing assets and question whether there is a need to have external connectivity or any connectivity. \u201cIf the asset does not require external connectivity, such access should be restricted. For assets deemed critical to being public facing, the organization should ensure that they are fully patched and hardened and that no unnecessary services are permitted or exposed,\u201d AEHIS recommends.<\/p>

Continuous network recovery<\/h2>
Healthcare organizations typically have a difficult time maintaining accurate and comprehensive equipment inventories, so they should implement continuous network discovery tools to enable it to monitor for new or unauthorized devices being connected to it, and then profile those devices\u2014doing so will enable security staff to promptly identify the type of device, the operating system, firmware levels and more. These tools also can correlate vulnerability intelligence to underscore known vulnerabilities and identify how to minimize them.<\/p>

Incident response planning and testing<\/h2>
Organizations need to ensure that they have an up-to-date incident response plan and that the plan has been recently tested. Familiarity with the plans and its protocols will help maximize efficiency and efficacy of response, thus minimizing the impact of an incident. \u201cAdditionally, the IR plan should provide contingent modes of communication should there be interruptions to the services that the IR plan is dependent on,\u201d the guidance suggests. The AEHIS IR Committee makes a variety of table top exercises<\/a> available to hospitals and healthcare organizations.<\/p>

Sandboxes<\/h2>
With the number of attack approaches rapidly increasing, it\u2019s more important than ever for organizations to have a way to detect new malware. A sandbox enables security executives to execute office documents, executable files, files exchanged with external organizations and URLs to be tested for behaviors that are potentially malicious. For example, sandbox functionality can be incorporated into spam filters for execution of URLs and attachments, as well as firewalls for execution of transferred files.<\/p>

Application white-listing<\/h2>
Having this capability prevents any process or executable file that is not explicitly approved from running in an organization. \u201cApplication whitelisting should be strongly considered for any system that is public facing as well as any system whose operation is deemed critical to patient safety,\u201d AEHIS urges. It is \u201ca highly effective means of keeping a system from falling victim to a cyber-attack. Combining application whitelisting with zero trust network segmentation principles is a highly recommended security architecture.\u201d<\/p>

DNS sinkholing<\/h2>
Healthcare organizations have a variety of medical, IoT and OT devices, and it\u2019s typically not possible to run an endpoint security suite to protect them\u2014so it\u2019s not always possible to know the threats with which these devices have come into contact. DNS sinkholing provides a way to identify devices that may be trying to communicate with known malware or command and control domains. \u201cGeoblocking can potentially be incorporated into a DNS Sinkhole, and a SIEM alert can easily be set up for any device that connects to the sinkhole,\u201d the AEHIS guidance notes.<\/p>

Two-factor authentication<\/h2>
Account credentials that enable access to an organization\u2019s network are more widely available than commonly understood. In addition, persistent hackers can harvest credentials through phishing, social engineering, brute-force password gambits and other techniques, so eventually, someone in your organization will have their credentials compromised. \u201cTwo-factor authentication greatly mitigates this risk by ensuring that a compromised username and password pair does not guarantee an attacker access,\u201d AEHIS says. This security control is especially recommended for any form of administrative account or account used to remotely access systems.\u201d In addition, all external access should use a secure, virtual private network.<\/p>

LAPS<\/h2>
Local Administrator Password Solution (LAPS) is a utility created by Microsoft that enables the randomization of the password of the local administrator of each domain-joined machine. This can help prevent the lateral movement of attacks through an organization, mitigating many of the commonly used \u201cpass the hash\u201d techniques that are used by attackers to jump from a compromised machine to another system in the environment. Thus, LAPS can help mitigate the distribution of a threat in an environment.<\/p>

Deception<\/h2>
Certain technologies leave \u201cbread crumbs\u201d throughout an organization to entice attackers to go after decoy assets. They enable security executives to perform early breach detection, because these decoy assets would not be accessed in the course of doing legitimate business processes. Also, the attack methods used against decoy assets to help identify IOCs and other information that can be used to project real assets.<\/p>

Enterprise detection and response<\/h2>
This technology enables the recording and analysis of all events occurring on an endpoint computer system, helping security executives to uncover potentially suspicious activity and perform threat hunting. EDR also enables detailed incident investigation, and it thus enhances an organization\u2019s ability to detect attacks that traditional signature-based defenses would probably miss.<\/p>

Security education and awareness<\/h2>
All organizations should regularly perform phishing education and other forms of security awareness education. In addition, IT executives should perform some research and use their threat intelligence resources to identify common methods of attack used by the hostile nations that are threatening a cyberattack. Provider organizations then can offer crafted awareness campaigns that highlight these attack methodologies and what should be looked out for.<\/p>

For more information<\/h2>
The AEHIS guidance can be found here<\/a>. <\/p>

","saveContent":"
17 steps to harden defenses against nation-state cyber attacks<\/h2>
Recent world events, such as the rising international tensions with Iran, are focusing more attention on the threat of nation-state sponsored cyberattacks against the nation\u2019s information infrastructure. While U.S. government cyber defenses are believed to be strong, there\u2019s growing concern that the nation\u2019s healthcare system and individual provider organizations could fall prey to concerted attacks, according to recently published guidance from the Association for Executives in Healthcare Information Security.The publication<\/a>, prepared by the AEHIS Incident Response Committee, notes that \u201ceven a nation without great military might can possess the potential to unleash havoc\u201d on IT infrastructure. \u201cEven if not explicitly targeted, hospitals need to consider that their systems could still be impacted as collateral damage in a cyberattack scenario.\u201dThe risks are great, according to a separate assessment by Caleb Barlow, CEO of cybersecurity firm CynergisTek, who expects Iranian cyberactors will initiate destructive \u201cwiper\u201d attacks to erase and disable key systems and cripple organizations on the US mainland. He predicts hospitals and healthcare organizations will be top priority targets because of their relatively weak security and the opportunity they present to generate significant cost and impact on the public.To be prepared, hospitals must implement controls and plans to deal with state-sponsored cyberattacks, the AEHIS guidance urges, offering these 17 steps as essential in protecting healthcare organizations\u2019 data assets.<\/p>

Patching<\/h2>
If cyberattacks appear likely, ensuring that all connected systems are properly patched for known vulnerabilities is critical. \u201cParticular attention should be placed on any public-facing systems and any systems that are used to connect to the internet or open email from third parties,\u201d AEHIS notes. \u201cFor legacy systems that can no longer be patched, organizations may want to consider placing a firewall with IPS functionalities or, in the case of Web servers, a Web Application Firewall (WAF) in front of an asset as a means of providing a level of virtual patching.\u201d<\/p>

Disaster recovery and business continuity plans<\/h2>
All organizations should review and practice disaster recovery (DR) and business continuity (BC) plans to ensure that they can operate and maintain patient safety in the event of power loss, communications failures, or the loss of other critical infrastructure. \u201cBackup systems should also be tested to ensure all data is being properly backed up and that restore functionality can be successfully achieved,\u201d AEHIS suggests. \u201cIdeally, staff should be cross trained in DR and BC planning in case a loss of mass transit, power grids or other element of critical infrastructure results in lack of availability of an employee.\u201d<\/p>

Geoblocking<\/h2>
Hospitals should establish a list of regions of the world that they consider hostile and implement geoblocks in their firewalls and WAFs against network traffic stemming to and from them. Organizations also may want to consider implementing geoblocks in their spam filters. \u201cWhile an attacker can bypass such blocks using a VPN or proxy, the presence of such geoblocks does require the attacker to put in a bit more effort and typically works to reduce the number of attacks an organization sees as a resul,\u201d AEHIS notes.<\/p>

Security information and event management alerts<\/h2>
Organizations should make use of SIEM alerts as part of their log management and incident identification strategies, AEHIS\u2019 publication suggests. \u201cOrganizations may want to customize their SIEM ruleset to include any network traffic or communication going to or coming from any nations they deem hostile.\u201d External threat intelligence can also warn of IP addresses, URLs or other indicators of compromise and can be fed into a SIEM to enable faster delivery of alerts for any suspicious cyber activities.<\/p>

Threat intelligence<\/h2>
Threat intelligence is crucial\u2014it can help security executives take a more proactive stance in putting blocks or other controls in place before a threat hits an environment. \u201cWhen used in conjunction with a SIEM and\/or enterprise detection and response, (threat intelligence) can help you to better identify threats you may already be facing,\u201d the AEHIS guidance states.<\/p>

Network segmentation<\/h2>
Network segmentation can reduce the amount of damage from attacks such as ransomware. The more segmented a network is, the more difficult lateral movement is, resulting in a higher probability that the damage will be contained. \u201cIdeally, network segmentation should be done to the point of zero trust, but at a minimum, segmenting off any connected medical devices or other systems deemed critical for patient safety is a must,\u201d the AEHIS guidance notes. \u201cIdeally, organizations should isolate medical devices in a manner that minimizes connectivity and ports for optimal protection.\u201d<\/p>

Audit publicly exposed assets and services<\/h2>
Healthcare organizations often don\u2019t fully understand on what assets are public facing. Security executives should identify public facing assets and question whether there is a need to have external connectivity or any connectivity. \u201cIf the asset does not require external connectivity, such access should be restricted. For assets deemed critical to being public facing, the organization should ensure that they are fully patched and hardened and that no unnecessary services are permitted or exposed,\u201d AEHIS recommends.<\/p>

Continuous network recovery<\/h2>
Healthcare organizations typically have a difficult time maintaining accurate and comprehensive equipment inventories, so they should implement continuous network discovery tools to enable it to monitor for new or unauthorized devices being connected to it, and then profile those devices\u2014doing so will enable security staff to promptly identify the type of device, the operating system, firmware levels and more. These tools also can correlate vulnerability intelligence to underscore known vulnerabilities and identify how to minimize them.<\/p>

Incident response planning and testing<\/h2>
Organizations need to ensure that they have an up-to-date incident response plan and that the plan has been recently tested. Familiarity with the plans and its protocols will help maximize efficiency and efficacy of response, thus minimizing the impact of an incident. \u201cAdditionally, the IR plan should provide contingent modes of communication should there be interruptions to the services that the IR plan is dependent on,\u201d the guidance suggests. The AEHIS IR Committee makes a variety of table top exercises<\/a> available to hospitals and healthcare organizations.<\/p>

Sandboxes<\/h2>
With the number of attack approaches rapidly increasing, it\u2019s more important than ever for organizations to have a way to detect new malware. A sandbox enables security executives to execute office documents, executable files, files exchanged with external organizations and URLs to be tested for behaviors that are potentially malicious. For example, sandbox functionality can be incorporated into spam filters for execution of URLs and attachments, as well as firewalls for execution of transferred files.<\/p>

Application white-listing<\/h2>
Having this capability prevents any process or executable file that is not explicitly approved from running in an organization. \u201cApplication whitelisting should be strongly considered for any system that is public facing as well as any system whose operation is deemed critical to patient safety,\u201d AEHIS urges. It is \u201ca highly effective means of keeping a system from falling victim to a cyber-attack. Combining application whitelisting with zero trust network segmentation principles is a highly recommended security architecture.\u201d<\/p>

DNS sinkholing<\/h2>
Healthcare organizations have a variety of medical, IoT and OT devices, and it\u2019s typically not possible to run an endpoint security suite to protect them\u2014so it\u2019s not always possible to know the threats with which these devices have come into contact. DNS sinkholing provides a way to identify devices that may be trying to communicate with known malware or command and control domains. \u201cGeoblocking can potentially be incorporated into a DNS Sinkhole, and a SIEM alert can easily be set up for any device that connects to the sinkhole,\u201d the AEHIS guidance notes.<\/p>

Two-factor authentication<\/h2>
Account credentials that enable access to an organization\u2019s network are more widely available than commonly understood. In addition, persistent hackers can harvest credentials through phishing, social engineering, brute-force password gambits and other techniques, so eventually, someone in your organization will have their credentials compromised. \u201cTwo-factor authentication greatly mitigates this risk by ensuring that a compromised username and password pair does not guarantee an attacker access,\u201d AEHIS says. This security control is especially recommended for any form of administrative account or account used to remotely access systems.\u201d In addition, all external access should use a secure, virtual private network.<\/p>

LAPS<\/h2>
Local Administrator Password Solution (LAPS) is a utility created by Microsoft that enables the randomization of the password of the local administrator of each domain-joined machine. This can help prevent the lateral movement of attacks through an organization, mitigating many of the commonly used \u201cpass the hash\u201d techniques that are used by attackers to jump from a compromised machine to another system in the environment. Thus, LAPS can help mitigate the distribution of a threat in an environment.<\/p>

Deception<\/h2>
Certain technologies leave \u201cbread crumbs\u201d throughout an organization to entice attackers to go after decoy assets. They enable security executives to perform early breach detection, because these decoy assets would not be accessed in the course of doing legitimate business processes. Also, the attack methods used against decoy assets to help identify IOCs and other information that can be used to project real assets.<\/p>

Enterprise detection and response<\/h2>
This technology enables the recording and analysis of all events occurring on an endpoint computer system, helping security executives to uncover potentially suspicious activity and perform threat hunting. EDR also enables detailed incident investigation, and it thus enhances an organization\u2019s ability to detect attacks that traditional signature-based defenses would probably miss.<\/p>

Security education and awareness<\/h2>
All organizations should regularly perform phishing education and other forms of security awareness education. In addition, IT executives should perform some research and use their threat intelligence resources to identify common methods of attack used by the hostile nations that are threatening a cyberattack. Provider organizations then can offer crafted awareness campaigns that highlight these attack methodologies and what should be looked out for.<\/p>

For more information<\/h2>
The AEHIS guidance can be found here<\/a>. <\/p>

","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

17 steps to harden defenses against nation-state cyber attacks

More for you