HHS Says to Strengthen Cyber Posture at Healthcare Organizations
The U.S. Department of Health and Human Services’ (HHS) published a threat briefing entitled “Strengthening Cyber Posture in the Health Sector” on June 16. The briefing focuses on cybersecurity posture, including steps organizations can take to strengthen their cyber posture, benefits to strengthening cyber posture, and cyber posture best practices.
The briefing states that “Cybersecurity posture refers to the overall strength of an organization’s cybersecurity, protocols for predicting and preventing cyber threats, and the ability to act as well as respond during and after an attack.”
The briefing suggests several steps for healthcare organizations to strengthen their cyber posture, including:
- Regularly conducting security posture assessments
- Consistently monitoring networks and software for vulnerabilities
- Defining departments to own risks and assigning managers to specific risk
- Regularly analyzing gaps in security controls
- Defining key security metrics
- Creating an incident response plan and a disaster recovery plan
The briefing adds that data protection for authorized access, loss, or deletion, improving customer confidence, protecting intellectual property, preventing cyber espionage, and preventing fraud are some of the benefits of strengthening an organization’s cyber posture.
Additionally, the briefing adds that it recommends all organizations follow the best practices outlined in CISA Insights to protect against cyber threats including reducing the likelihood of a potentially damaging cyber intrusion, taking steps to swiftly detect a potential intrusion, ensuring organizations are prepared to respond in the case of an intrusion, and maximizing organizations’ resilience to cyber incidents.
The briefing also explains the importance of security risk assessments. The briefing says that “According to the NIST Special Publication 800-39, a security risk assessment is the process of identifying risks to organizational operations, organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Six characteristics of an effective security risk assessment are:
- Identify Threat Sources
- Identify Threat Events
- Identity Vulnerabilities
- Determine the Likelihood of Exploitation
- Determine Probable Impact
- Calculate Risk as a Combination of Likelihood and Impact”
And as for the impact of cyber incidents, according to the briefing, research from the CyberPeace Institute found a large increase of incidents at the start of the COVID-19 pandemic. As for financial implications, according to a study from the law firm Baker Hostetler’s, the healthcare industry is the top sector regarding the number of lawsuits due to data breaches (23 percent). The other sectors analyzed were business and professional services (17 percent), finance and insurance (15 percent), education (12 percent), and manufacturing (10 percent). Furthermore, the study showed that there were at least one or more lawsuits stemming from 23 data breaches reported. Of 58 lawsuits filed, healthcare organizations made up 43 of those cases.
The briefing concludes by saying that “The health sector is responsible for handling vital and sensitive patient data. Over the years, there has been a significant increase in cyber incidents. The alarming spike after the COVID-19 pandemic has led to numerous changes in law and policy, most recently the Strengthening Cybersecurity Act of 2022. CISA offers free services and tools to organizations of all sizes, and HIPAA also provides a free Security Risk Assessment tool to help with monitoring risks. In addition to being compliant with the law, organizations within the health sector should strive to do their best to stick to the mission of protecting patient data and sensitive information in our network from malicious threat actors.”
