Cyberattacks Disrupt Hospital Services; US Legislators Propose Healthcare Cybersecurity Bill

It has been obvious since the Morris Worm that the rogues simply cannot know enough about the environment to predict the consequences of their activity. However, when they target healthcare it should be obvious that those consequences will threaten life and limb.

William Hugh Murray

While UMC isn't releasing a full-service restoration date, they are now diverting only a few patients. They are reaching out to patients with scheduled appointments to advise them on the modified procedures and what to expect. As if the stakes aren't already high enough, UMC Children's Hospital is a Pediatric Level 2 Trauma Center with the region's only verified burn center for children.

Lee Neely

The actions taken by Kuwait are consistent with recovery from a ransomware attack as well as catching up on delinquent patching. At this point, the majority of systems are back on-line. One hopes they also took steps to prevent recurrence, which include more proactive application of security updates.

Lee Neely

Hospitals have been a primary target for ransomware. These attacks have endangered lives, and affected the quality of care. Let's hope this effort will succeed where HIPAA did not.

Johannes Ullrich

With the ongoing plethora of healthcare ransomware attacks, the industry needs help raising the bar. One hopes the proposed funding to accompany this legislation will help seed those efforts. The bill applies to healthcare providers, health plans, clearinghouses and business associates. It adds stress tests and annual audits for accountability, as well as removing caps on fines HHS can dole out. If passed, the legislation will go into effect two years after enactment. Supporting regulations will be in place at most 18 months after enactment with supporting standards from NIST.

Lee Neely

While establishing a mandatory minimum baseline for cybersecurity is a good thing, extra baggage comes with this Senate bill. For starters there exist viable alternatives to the Healthcare Cyber Performance Goals (HPH CPGs). States have already enacted laws that reference NIST CSF, ISO 27001, CIS Critical Security Controls, and other regulatory frameworks as part of incentivizing implementation of a cybersecurity program; why not allow those to be included in the minimum baseline? Many in the healthcare sector have already implemented one of those frameworks and are actively measuring compliance. The bill also creates another 'cottage industry' to conduct the annual audit, an unnecessary cost to the organization. Why not include self assessment as part of the annual audit, like the revamped CMMC does? The 'C-suite' would be just as accountable with a self assessment should there be a cyber breach. Finally, what happens once the funding associated with this bill is exhausted?

Curtis Dukes

The changes Microsoft made look solid and address most of the complaints people had with respect to the original implementation. Even better, the feature will be "opt-in" and uninstallable.

Johannes Ullrich

A responsible action by Microsoft given their recent security gaffes. Opt-in should always be the default: let the user decide what information is to be shared.

Curtis Dukes

Microsoft is attempting to recover and regroup with Recall, adding security, opt-in, and regular re-validation of opt-in status. Recall is now encrypting sensitive information using the system's TPM chip which is tied to the user's Windows Hello Enhanced Sign-In Identity and can only be accessed in a secure VBS Enclave which should prevent other users from accessing this information. Even so, read the Windows Blog on Recall security before enabling it.

Lee Neely

Developing capabilities to identify flaws related to AI aligns with the directive of the 2023 Executive Order, and NIST is the right place to own the task. The tasking must come with adequate funding or we're going to wind up with another gap, much like what happened when they suspended enriching vulnerability information in February.

Lee Neely

Is it likely that AI products are going to be of higher quality or more vulnerability-free than other less complicated and more transparent IT products?

William Hugh Murray

FB failed its cybersecurity 101 test - storing passwords in plaintext. What's surprising is the lack of cybersecurity culture where none of the thousands of software engineers thought it a problem storing passwords in plaintext. While I usually hate that companies are fined by government as it usually gets passed along to the consumer, in this case it's appropriate.

Curtis Dukes

If you're storing passwords, make sure that they are not in plain text. Ideally use a strong salted hash (Bcrypt, SHA512, PBKDF2, etc.), don't create your own. While Meta took action to notify users and correct passwords stored in the clear, if you've not changed your Meta (Facebook) password since before 2019, you should look into that, as well as enabling 2FA on that account.

Lee Neely

All three vulnerabilities have a CVSS score of 9.8. Make sure that you're running a supported/patched version of AOS-10 or Instant AOS-8. Then for AOS-10 restrict access to UDP port 8211 and enable cluster-security if you're on Instant AOS-8

Lee Neely

The attack is attributed to the Kimsuky APT, aka APT43, Velvet Chollima, Emerald Street, TA406 and Black Banshee which focuses on intelligence gathering, including support for the North Korean Government's nuclear and strategic efforts. Spear phishing attacks with a jacked-up PDF, as was used here, are tricky to protect against. On top of that, the attackers leveraged a legitimate login server to capture credentials. The good news is we can do more than advising not to click. Make sure that you've got in-line attachment checking, MFA to help mitigate credential harvesting, and if possible protective DNS.

Lee Neely

Seriously, if you're a publicly traded company, this is a great example of why you want to implement strong MFA and possibly DLP types of measures to prevent misuse of proprietary information. The businesses appeared to get lucky in that he didn't leverage information obtained with their competitors or for extortion.

Lee Neely

A modern day take on the classic movie, 'Wall Street.' In the movie, Bud Fox and his mentor Gordon Gekko use illegally obtained insider information to manipulate the stock market and corporate world. As in the movie, greed eventually takes over and you trip up and get caught.

Curtis Dukes

The city, which has 120,000 residents, is working to rapidly restore services first, and secondly working to determine what data were exfiltrated. Richardson continues to post status updates as well as providing a 24-hour response center backup number as the primary number was suffering intermittent outages. They have also engaged the FBI and notified DHS. They are progressing rapidly, and it may be worth taking a look to see if you can emulate their success.

Lee Neely