In a joint effort, CISA and HHS have unveiled the “Healthcare Cybersecurity Toolkit.” Aimed at strengthening the healthcare sector’s defenses against cyber threats, it provides resources and guidance for organizations of all sizes. The toolkit addresses cyber hygiene, offers tools to build robust security foundations, and connects users to valuable industry resources. It aligns with CISA’s strategic plan for enhancing cybersecurity, emphasizing the need for collective responsibility in safeguarding healthcare systems from escalating cyberattacks.
In a concerted effort to bolster the cybersecurity defenses of the healthcare sector and mitigate the risk of successful cyberattacks, the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) have unveiled the Cybersecurity Toolkit for Healthcare and Public Health. This release follows extensive discussions on the cybersecurity challenges faced by the U.S. healthcare and public health systems, emphasizing the need for cooperation between the government and the healthcare industry to bridge resource gaps and enhance cyber capabilities.
The significance of this initiative lies in the fact that malicious actors increasingly view healthcare and public health organizations as attractive yet vulnerable targets. Nitin Natarajan, Deputy Director of CISA, highlighted the importance of securing healthcare entities, particularly those with limited resources, such as under-resourced hospitals and health centers. These organizations, due to their possession of a trove of personally identifiable information, financial data, health records, and numerous medical devices, present an enticing one-stop shop for cyber adversaries.
The newly unveiled toolkit caters to healthcare organizations of all sizes, offering solutions for improving cyber hygiene, establishing robust cybersecurity foundations, and accessing resources to strengthen defenses against ever-evolving threats. HHS stated that the toolkit is adaptable to organizations at various levels of cybersecurity capability.
This toolkit provides valuable links to resources from the Healthcare and Public Health Sector Coordinating Council, facilitating risk management, security enhancement, and the implementation of mature cybersecurity and response measures, including the Health Industry Cybersecurity Practice by HSCC—an industry response to Section 405(d) of the Cybersecurity Act of 2015.
Additionally, the toolkit connects users to the HPH Sector Cybersecurity Framework Implementation Guide by HHS and CISA’s vulnerability scanning services. These services evaluate external network presence through continuous scans of public, static IPv4s to identify accessible services and vulnerabilities. The toolkit also serves as a centralized hub for various cybersecurity alerts relevant to the healthcare sector, as well as information on free cybersecurity services and tools, security training resources, reporting portals, and more.
This initiative aligns with CISA’s strategic plan for FY 2024-2026, which focuses on addressing immediate cybersecurity threats and strengthening systems against attacks while promoting accountability. CISA emphasizes the necessity of close collaboration among government entities, industry stakeholders, security researchers, the international community, and others to achieve enduring cybersecurity.
Under the National Cyber Incident Response Plan, CISA aims to increase the number of participating organizations and develop cyber defense strategies for high-priority risks. Greg Garcia, Executive Director of HSCC Cybersecurity Work Group, underscores the collective responsibility for enhancing cyber preparedness, emphasizing the wisdom of collective intelligence.
Overall, Deputy Director Nitin Natarajan reaffirms the commitment to cybersecurity education as a means of safeguarding our world. CISA has taken proactive measures, such as pre-ransomware notifications to over 65 U.S. healthcare organizations, to thwart ransomware encryption and alert entities to early-stage ransomware activity. HHS Deputy Secretary Andrea Palm underscores the escalating threat of cyberattacks against hospitals and health systems, emphasizing the increasing severity and costliness of these incidents as they persist over time.
