The White House has issued a proclamation from President Biden declaring November as Critical Infrastructure Security and Resilience Month – A month dedicated to raising awareness of the need to improve critical infrastructure and strengthening the resilience of critical infrastructure against physical and cyber threats.

President Biden has recommitted to improving and fortifying critical infrastructure, “by building better roads, bridges, and ports; fortifying our information technology and cybersecurity across sectors, including election systems; safeguarding our food and water sources; moving to clean energy; and strengthening all other critical infrastructure sectors,” and by doing so will lay the foundation for long-term security and prosperity.

One of the main focus areas is improving defenses and shielding critical infrastructure against malicious cyber activity. President Biden has confirmed his administration will be establishing clear international rules of the road as they relate to cyberspace. In the United States, most critical infrastructure is owned and operated by private companies. Federal agencies have been working closely with critical infrastructure owners and operators to improve resilience to cyberattacks.

As part of this effort, CISA has recently published a set of cybersecurity performance goals for critical infrastructure organizations to guide their cybersecurity efforts to help them achieve minimum standards for cybersecurity. President Biden has also “reinvigorated the National Infrastructure Advisory Council to advise on how to reduce physical and cyber risks and improve the security and resilience of our Nation’s critical infrastructure sectors.”

CISA is encouraging all critical infrastructure organizations to take steps to improve resilience to cyber threats this November. CISA urges all organizations to strengthen their security plans by gaining a better understanding of the unique risks to their organization and systems, conducting exercises of preparedness plans and updating them with the latest techniques and tactics, focusing on ways risk can be reduced and resilience built on physical and cyber fronts, and considering ways to embed resilience as a foundational design feature when upgrading or building new critical infrastructure.

The post President Biden Declares November as Critical Infrastructure Security and Resilience Month appeared first on HIPAA Journal.

MFA is one of the most important measures to take to prevent unauthorized account access; however, it does not provide complete protection and some forms of MFA can be circumvented. Any form of MFA is better than none at all, but for maximum protection, organizations should implement phishing-resistant MFA, especially in industries such as healthcare that are extensively targeted by malicious cyber actors.

Multifactor authentication requires more than just a password to be provided before account access is granted, with the additional authentication being something a person has (physical device, one-time code) or something they are (fingerprint, voice print, etc.). In the event of a password being stolen in a phishing attack or being guessed using brute force tactics, it makes it much harder for a threat actor to access the account.

Phishing campaigns are now being conducted that use phishing kits with reverse proxies that allow threat actors to steal login credentials, MFA codes, and session cookies to circumvent MFA protection. Some forms of MFA are also susceptible to push bombing, Signaling System 7 (SS7) protocol vulnerabilities, and SIM Swap attacks.

CISA is urging all organizations to implement phishing-resistant multifactor authentication – the gold standard for MFA – or, if that is not possible, to implement number matching MFA. CISA has produced two fact sheets offering guidance for organizations on implementing phishing-resistant MFA and number matching MFA. The latter does not provide as strong protection as phishing-resistant MFA; however, it is suitable as an interim measure for any organization that is currently using mobile push-notification-based MFA and cannot yet switch to phishing-resistant MFA. Number matching helps prevent push bombing, by requiring users to enter a number from the identity platform into the app to approve the authentication request.

FIDO/WebAuthn authentication is the most widely available form of phishing-resistant MFA and is supported by major web browsers, OSs, and smartphones. WebAuthn works with the related FIDO2 standard to provide a phishing-resistant authenticator, such as a physical token connected to a device via USB or NFC, or can be embedded into laptops or mobile devices as platform authenticators. FIDO authentication also supports other forms of authentication such as biometrics and PIN codes.

As an alternative, public key infrastructure (PKI)-based MFA can be implemented. While this form of MFA is less widely available but may be better suited for large organizations. Guidance is offered in the fact sheets on implementing both forms of MFA, including how to prioritize the implementation phases and some of the stumbling blocks organizations can encounter, with advice on how to overcome them.

The post CISA Urges Organizations to Implement Phishing-Resistant Multifactor Authentication appeared first on HIPAA Journal.

Last week, the OpenSSL Project announced a patch would be released on November 1, 2022, to address a critical OpenSLL vulnerability, the details of which were being kept secret to prevent exploitation of the flaw ahead of the patch being released. The news of the vulnerability caused considerable concern amongst the open source community and beyond due to the extent to which  OpenSLL is used – It is extensively used to encrypt communication channels and HTTPS connections, so the implications of such a flaw are enormous.

The news of a critical flaw existing brought back memories of the Heartbleed Bug (CVE-2014-0160) which was exploited to read the memory of systems including servers and routers to eavesdrop on communications. It is now 8 years since that patch was released and there are still 240, 000 publicly accessible servers that remain vulnerable to Heartbleed.

The latest vulnerability affects versions 3.0 to 3.06 of OpenSLL. Version 3 was only released a year ago, so usage of the latest version is limited; however, the vulnerability still has the potential to be extremely serious and has been a major cause of concern. “The short answer is you should be worried,” said Yotam Perkal, Director of Vulnerability Research at Rezilion. As for how worried you should be, Perkal said, “that depends how many vulnerable instances of OpenSSL3.x you have in your environment and do you have the ability to accurately detect them so that you could apply the patch once it’s out.” For many organizations, the answer to the latter will be no. This is why it took so long for the Heartbleed bug to be patched.

The OpenSSL Project announced that the patch for the vulnerability would be released between 13:00 and 1700 UTC on November 1, 2022.

Not One But Two Vulnerabilities

The OpenSSL Project has now confirmed that the vulnerability is not one issue, but two. The two flaws are being tracked as CVE-2022-3602 and CVE-2022-3786, although there is some good news. The severity of the flaws has been downgraded from critical to high severity, and exploiting the flaws would be difficult and require a high level of technical skill.

CVE-2022-3602 is a 4-byte stack buffer overflow that, if exploited, could cause a crash or potentially lead to remote code execution. CVE-2022-3786 is a buffer overflow issue that could be exploited using malicious email addresses in a denial-of-service attack.

The OpenSSL Project said that at the time of releasing the patches, it was not aware of any working exploit in the public domain that would allow remote code execution and that no evidence has been found to indicate either vulnerability has been exploited to date.

The Health Sector Cybersecurity Coordination Center issued an alert about the flaw soon after the OpenSSL Project announced a patch was due for release, warning that exploitation of the flaw was very likely, and may start almost immediately after the publication of the patch. Even though the severity of the flaws is reduced, exploitation is still possible, so prompt patching is recommended if OpenSSL 3.0-3.0.6 has been used. Fortunately, the vulnerable versions of OpenSSL have yet to be heavily deployed in production – Currently, between 7,000 and 16,000 systems are exposed to the Internet and are running vulnerable OpenSSL versions.

Exploitation of the bugs would require a high level of technical skill, which limits the potential for exploitation. Researcher Marcus Hutchins said that while one of the flaws could theoretically lead to RCE, it would be extremely unlikely for the flaw to be exploited and lead to RCE.

That said, OpenSSL warns that “OpenSSL is distributed as source code, we have no way of knowing how every platform and compiler combination has arranged the buffers on the stack, and therefore remote code execution may still be possible on some platforms.”

A list of products confirmed to be affected by the OpenSSL vulnerabilities is being maintained here.

Akamai has released YARA Rules and OSQuery queries that can be used to detect vulnerable instances.

The post OpenSSL Downgrades Bug Severity to High and Releases Patches appeared first on HIPAA Journal.

A warning has been issued to the healthcare and public health sector about a critical vulnerability in the OpenSSL software library. OpenSLL is an open source cryptographic library that is used by most operating systems and applications for implementing Transport Layer Security for secure Internet communications, including connections to websites and web applications.

The OpenSSL project team says the vulnerability affects OpenSSL versions 3.0 to 3.0.6, but does not affect OpenSSL 1.1.1 or LibreSSL. Details about the exact nature of the vulnerability have yet to be disclosed to limit the potential for exploitation. Further information about the vulnerability is expected to be released along with the patch, which will be applied in OpenSLL version 3.0.7. At present, no CVE code has been assigned.

While vulnerabilities have been announced by the OpenSLL project team in the past, critical vulnerabilities are very rare. A critical vulnerability is one that affects common configurations and is likely to be exploited. In 2014, OpenSLL discovered a critical vulnerability dubbed Heartbleed, which could be exploited to obtain passwords or encryption keys. The flaw allowed anyone on the Internet to read the memory of systems that used vulnerable OpenSLL versions. The bug was rapidly exploited by threat actors to eavesdrop on communications, steal data directly from services and users, and to impersonate services and users. Because OpenSLL is so extensively used, the severity of such a vulnerability is enormous. Patching every instance where OpenSSL has been used could take considerable time.

The Health Sector Cybersecurity Coordination Center (HC3) explained in a cybersecurity alert that threat actors are likely to attempt to exploit the vulnerability at large scale, and warns that exploitation may begin very soon after the patch is released. Cybercriminal and nation-state threat actors are likely to immediately begin reverse engineering the patch as soon as it is released to determine the technical details of the vulnerability to allow an exploit to be developed.

HC3 urges all HPH sector organizations to treat this vulnerability with the highest priority and ensure the patch is applied rapidly. In order for that to happen, it will be necessary to find all instances where OpenSSL has been used. OpenSSL Project team says the patch will be released between 13:00 and 1700 UTC on November 1, 2022.

The post Patch Due for Release on November 1, 2022 to Fix Critical OpenSLL Vulnerability appeared first on HIPAA Journal.

A set of cross-sector Cybersecurity Performance Goals (CPGs) have been published by the Cybersecurity and Infrastructure Security Agency (CISA) for critical infrastructure organizations to adopt a minimum cybersecurity standard and better protect their networks and systems from attacks that threaten their ability to operate.

In response to the May 2021 ransomware attacks on the oil pipeline system operator, Colonial Pipeline, and the food processing firm JBS, President Biden signed an Executive Order on Improving the Nation’s Cybersecurity. As part of that initiative, President Biden signed the National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems on July 28, 2021, which called for CISA to publish a baseline set of CPGs with the aim of improving the cybersecurity of all critical infrastructure in the United States on which Americans depend.

According to CISA, the CPGs are “a prioritized subset of IT and operational technology (OT) cybersecurity practices that critical infrastructure owners and operators can implement to meaningfully reduce the likelihood and impact of known risks and adversary techniques.” The CPGs were developed from existing cybersecurity frameworks and guidance, and in response to real-world threats and the tactics techniques, and procedures that CISA and its partners have observed nation-state and cybercriminal hacking groups using. CISA Director Jen Easterly said the CPGs were “informed by extensive input from experts across sectors, public and private, domestic and international, the CPGs reflect some of the best thinking gleaned from across the cybersecurity community.”

In the United States, the majority of critical infrastructure is owned and maintained by the private sector, which is resistant to cybersecurity regulation. Consequently, it is not mandatory for the CPGs to be adopted by critical infrastructure owners and operators. Compliance is voluntary, although strongly recommended.

The CPGs are unique from other control frameworks, as they consider not only the practices that address risk to individual entities, but also the aggregate risk to the nation. They are intended to help critical infrastructure organizations, especially small- and medium-sized organizations, accelerate their cybersecurity plans and rapidly improve resilience to cyberattacks. The CPGs are not a comprehensive set of practices for developing an effective cybersecurity program. They are a set of prioritized security practices that have proven risk-reduction value, which can be implemented by all critical infrastructure organizations to address the most pressing risks and vulnerabilities that are known to be exploited by malicious actors.

The CPGs cover account security, device security, data security, governance and training, vulnerability management, supply chain and third-party risk management, and response and recovery, and have been written to be easy to understand and communicate to non-technical audiences, including senior business leadership.

The best practices include important cybersecurity measures such as credential management, password management, asset inventories, disabling macros, security log collection and monitoring, data encryption, multifactor authentication, and basic and OT cybersecurity training.

The Biden Administration has stressed that the CPGs are voluntary and there are no reporting requirements. You can view the CPGs here (PDF).

The post CISA Publishes Voluntary Cybersecurity Performance Goals for Critical Infrastructure Organizations appeared first on HIPAA Journal.

A relatively new data extortion and ransomware gang known as Daixin team is actively targeting U.S. healthcare organizations, prompting a warning from the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS).

Daixin Team first appeared on the radar in June 2022, with the group predominantly conducting data extortion and ransomware attacks on organizations in the health and public health sector (HPH). The attacks have seen data encrypted, prevented access to electronic health records, and caused major disruption to healthcare services, including diagnostics, imaging, and postponed appointments. In the #StopRansomware: Daixin Team – Alert, the observed tactics, techniques, and procedures used by Daixin team have been shared along with indicators of Compromise (IoCs) and several suggested mitigations to make it harder for attacks to succeed.

Daixin Team gains access to healthcare networks, conducts reconnaissance, and identifies and exfiltrates data of interest, which is used as leverage to extort money from victims.  The group seeks to establish communications with victims directly and advises them not to work with ransomware remediation firms. If contact is not made within 5 days of the attack, the group threatens to publicly release the stolen data.

Daixin Team is known to gain access to the networks of victims by exploiting vulnerabilities in VPN servers, often using compromised VPN credentials for accounts that do not have multi-factor authentication enabled. In some attacks, the group has obtained VPN credentials through phishing emails with malicious attachments. Once access is gained, they move laterally within networks using Secure Shell (SSH) and Remote Desktop Protocol (RDP), escalate privileges through credential dumping and pass the hash, exfiltrate data – including using tools such as Rclone and Ngrok – then deploy their ransomware payload, which is believed to be based on publicly-released Babuk Locker ransomware code.

In some attacks, privileged accounts have been used to gain access to VMware vCenter Server, and account passwords have been reset for ESXi servers. SSH was then used to connect to the ESXi servers, where ransomware was deployed.

The FBI, CISA, and the HHS have shared several mitigations that can help healthcare organizations protect against Daixin Team attacks. These measures include:

• Patching promptly and keeping software up to date
• Implementing phishing-resistant multi-factor authentication
• Securing or disabling Remote Desktop Protocol
• Turning off SSH and network device management interfaces such as Telnet, Winbox, and HTTP for wide area networks (WANs)
• Securing passwords with strong encryption
• Implementing and enforcing multi-layer network segmentation
• Limiting access to data through public key infrastructure and digital certificates to authenticate connections to devices
• Securing ePHI at collection points using encryption
• Ensuring compliance with the HIPAA Security Rule with respect to ePHI

The post Government Issues Warning to Healthcare Organizations About Daixin Team Extortion and Ransomware Attacks appeared first on HIPAA Journal.

Check Point’s 2022 Mid-Year Report has revealed the healthcare industry has seen the biggest percentage rise in cyberattacks out of all industry sectors, increasing by 69% in 1H 2022, compared to 2021.  Healthcare now ranks fifth highest in the number of weekly attacks, behind education, government/military, ISP/MSP, and communications.

Check Point explains in the report that 2022 has demonstrated that cyberattacks have become firmly entrenched as a state-level weapon, with the first half of the year seeing an unprecedented increase in state-sponsored attacks due to the ongoing war in Ukraine, along with a major increase in hacktivism – the recruitment of private citizens for an ‘IT Army’ for conducting attacks. Check Point says the fallout from this is likely to be felt by governments and enterprises worldwide.

The ability of cyberattacks to affect everyday lives has become crystal clear. 2022 has seen attacks conducted on TV stations that have stopped broadcasting, while attacks on critical infrastructure and government departments have crippled essential services. Many of these attacks have been conducted in Ukraine, but this is a worldwide problem. The attack on Costa Rica crippled services across the country, including healthcare, and it was not an isolated incident, with a similar attack hitting Peru shortly after. Cyberattacks that have a country-wide impact may become more common. In education, the ransomware attack on Lincoln College forced it to close its doors after 157 years, and numerous ransomware attacks on healthcare providers have caused major disruption to healthcare services.

There has been a step up from cybercriminal organizations conducting attacks for financial gain on individual organizations to them acting like nation-state-level threat actors. The Conti ransomware operation, in response to the decision of Costa Rica not to pay the ransom, sought to overthrow the government by encouraging citizens to revolt. Some cybercriminals groups now consist of hundreds of individuals and have revenues of hundreds of millions or even billions of dollars. In some cases, these groups function like genuine businesses, with some even paying for physical office space, and operating at that scale becomes difficult without at least some backing from governments in the countries where they are based. There has also been a trend that has seen cybercriminals dispense with ransomware altogether, and instead, they are opting for plain extortion – stealing data and demanding a ransom for its return, as is the modus operandi of the Lapsus$, RansomHouse, and Karakurt threat groups.

Check Point’s data shows there has been a 42% increase in cyberattacks globally in the first half of 2022, with all regions experiencing a significant escalation in cyberattacks. Globally, 23% of corporate networks have been attacked with multipurpose malware, 15% have seen attacks using cryptominers, 13% have had infostealer infections, 12% have experienced mobile attacks, and 8% have suffered ransomware attacks. Healthcare is one of the most attacked sectors, with attacks increasing by 69% to an average of 1,387 attacks on organizations every week.

In the Americas, Emotet has regained its position as the most common malware threat following its takedown by law enforcement in January 2021 which brought attacks to a grinding halt. Emotet has been used in 8.6% of malware attacks in 1H, 2022, with a wide range of malware variants now being used, with Formbook (4.2%), Remcos (2.3%), and XMRig (1.9%) the next most common.

High-profile vulnerabilities continue to be exploited to gain access to corporate networks, with the Atlassian Confluence RCE vulnerability (CVE-2022-26134), Apache Log4j RCE vulnerability (CVE-2021-44228), F5 BIG IP RCE vulnerability (CVE-2022-1388) the most commonly exploited.

Check Point has made predictions for the rest of the year based on attack trends identified in 1H 2022. Ransomware is expected to become a much more fragmented ecosystem, the disabling of macros is likely to see more diverse email infection chains employed, hacktivism is expected to continue to evolve, and attacks on the blockchain and crypto platforms are expected to increase.

The advice of Check Point to improve defenses is to install updates and patches regularly, adopt a prevention-first strategy and approach, install anti-ransomware solutions, improve education about cyber threats, collaborate with law enforcement and national cyber authorities, and prepare for the worst by implementing and testing incident response plans that can be immediately actioned in the event of a successful attack.

The post Mid-Year Report Shows Healthcare Cyberattacks Have Increased by 69% appeared first on HIPAA Journal.

The U.S. government is taking steps to improve critical infrastructure cybersecurity, with healthcare, water, and the communications sectors the next focus areas for the White House. The White House is planning to issue new guidance and cybersecurity standards for these industries to improve resilience against malicious cyber actors, whose attacks are increasing in both frequency and sophistication.

Anne Neuberger, deputy national security advisor for cyber and emerging technology, outlined some of the key areas of focus for the White House in a recent Washington Post Live event. These steps are in line with the Biden administration’s May 2021 executive order (EO 14028) that sought to improve cybersecurity for critical infrastructure and federal information systems through public-private partnerships. A great deal of the critical infrastructure in the United States is controlled by private companies, and while there are regulations that require minimum security standards to be implemented in certain sectors, more needs to be done to ensure that standards apply to all critical infrastructure and they improving resilience.

Neuberger explained that the cybersecurity of critical infrastructure in the United States lags behind other Western countries, stating the U.S. is “pretty much last in the race” when it comes to ensuring minimum cybersecurity standards are set for critical infrastructure organizations. Neuberger said one advantage of this is the U.S. will be able to learn from its many peers.

Cyberattacks on critical infrastructure have been increasing, especially ransomware attacks, many of which have hit the healthcare sector. Those attacks often have a major impact on the ability of healthcare organizations to operate. One recent Trend Micro survey indicates 25% of healthcare organizations were forced to completely halt operations following a ransomware attack, with 60% saying the attacks caused some disruption to business processes. Those attacks naturally have an impact on public safety, with some studies (Proofpoint, Censinet, Health Services Research) suggesting patient mortality increases following ransomware or other major cyberattacks.

Other major ransomware attacks on critical infrastructure include the attack on Colonial Pipeline, which disrupted fuel supplies to the Eastern Seaboard, and the attack on JBS, which disrupted food processing. Those attacks demonstrated a lack of preparedness and were a major wake-up call, clearly demonstrating cybersecurity needs to be significantly improved for all critical infrastructure and for standards to be implemented to lessen the impact of attacks should they succeed.

The bipartisan Securing Systemically Important Critical Infrastructure (SICI) Act will play a key part in the process of improving cybersecurity for all critical infrastructure. The legislation seeks to establish a transparent, stakeholder-driven process to designate systemically important critical infrastructure (SICI). The legislation requires the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to establish a methodology and criteria for determining what critical infrastructure qualifies as SICI, to prioritize meaningful benefits to SICI owners and operators without any additional burden, and calls for CISA to provide SICI owners and operators with the option to take part in prioritized cybersecurity services. Currently, the government is not fully aware of exactly what SICI is and where security needs to be improved.

President Biden has also signed the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) into law, which requires CISA to develop and implement regulations requiring covered entities to report cyber incidents and ransomware payments. Reporting will allow CISA to rapidly deploy resources and render assistance to victims suffering from attacks. It will also allow the agency to rapidly identify cyber threat trends, and quickly share relevant, actionable information with network defenders to warn other potential victims.

Healthcare is one of the main focus areas for the White House, and efforts to improve cybersecurity across the sector are underway. Neuberger confirmed that the Department of Health and Human Services has been working with partners at hospitals and has been developing minimum cybersecurity guidelines and will be working on developing new standards and guidance for securing medical devices and other broader areas of healthcare in the near future.

The post White House Plans to Issue New Cybersecurity Standards for the Healthcare Industry appeared first on HIPAA Journal.