Happy New Year.

Due to the holidays, there has been a two week long break in the FEHBlog’s cybersecurity posts. The December 18 post focused on the Java Log4j vulnerability which is still causing cybersecurity problems according to this Cyberscoop article:

A Chinese hacking group known for industrial espionage and intelligence collection used a vulnerability in Log4j to go after a large academic institution, researchers at CrowdStrike revealed Wednesday.

Tech Republic reports on how to check for Log4j vulnerabilities using a “simple to use script.” The article walks the reader through a sample scan. HC3 also released an alert calling attention to the availability of this vulnerability scanner.

This Health IT Security article adds that “The HHS 405(d) Task Group issued a brief outlining the risks associated with the recently discovered Apache Log4j vulnerability that could have catastrophic security implications for healthcare and other sectors.” Bleeping Computer offers a detailed situation report on the Log4j vulnerability.

Speaking of catastrophes, Bleeping Computer looks back at the ten largest healthcare protected health information breaches in 2021 and Tech Republic identifies the ten worst password snafus this year. Tech Republic adds

How can you make sure your employees follow strong password security guidelines to protect your organization’s sensitive data? Dashlane offers the following tips:

— Establish a culture of security. Employees need to understand what part they play in securing your company’s data. They must be involved in discussions about security. And they should have the tools required to follow strong password and security hygiene.

— Train employees. Show employees how to spot and report possible security risks and threats. You may want to create a special email or contact they can use to report an incident.

— Implement the right technology. This means using such tools as email security, endpoint protection and password managers.

— Track the results of your security tools. Find ways to measure the effectiveness of your security defenses. For example, some password managers have a health feature that analyzes and rates the strength of your passwords.

Also, Health IT Security offers expert cybersecurity predictions for 2022. For example,

By December 31, 2022, healthcare organizations will be required to migrate to Fast Healthcare Interoperability Resources (FHIR) APIs in order to enable seamless data sharing. As organizations adjust and implement the new data standards, it is likely that threat actors will use APIs as a network entry point.

“As interoperability becomes more of a mainstream priority for healthcare organizations and we see more APIs that are being introduced between critical systems, I think we’re going to see a rise in the number of attacks that are focused on compromising those APIs,” Mac McMillan, CEO of CynergisTek, predicted in an interview with HealthITSecurity.

“It’s another area where don’t typically have a good, consistent approach across the board in healthcare with respect to testing APIs for security.”