The Wall Street Journal reports on Chief Information Officer cybersecurity priorities for 2023:

At Cisco Systems Inc., CIO Fletcher Previn said the company is focusing on addressing cyber threats for a remote and in-office workforce, where “we might have video games and smart thermostats on the same network segment as an employee’s remote workplace.”

That means the networking-equipment maker is adopting a zero-trust architecture, as well as practices like two-factor authentication, investing in network automation, and application scanning, Mr. Previn said.

“The threat landscape has become more challenging and our networks more porous,” Mr. Previn said. “All it takes is one slip-up or letting your guard down for a minute for an adversary to get in.”

The Journal also lists CIO favorite reads in 2022.

Health IT Security “spoke with a variety of industry leaders who shared their healthcare cybersecurity and privacy predictions for the upcoming year.”

The experts suggested that in order to maintain cybersecurity and patient privacy, organizations will have to continue to adapt and enhance existing security practices to combat ongoing cyber threats.

However, positive regulatory changes may be on the horizon, and the lasting effects of the pandemic have shown that the sector is more than willing to pivot its strategies and remain resilient amid constant challenges.

The Cybersecurity Infrastructure Security Agency added two more known exploited vulnerabilities to its catalog.

Health IT Security also reminds us

Improper disposal of protected health information (PHI) can result in HIPAA violations, Office for Civil Rights (OCR) investigations, and hefty fines. * * *

Fortunately, HHS maintains a great deal of guidance on the proper and improper ways to dispose of physical records and electronic PHI as required under the HIPAA Privacy and Security Rules.

Happy New Year!

The American Hospital Association informs us

The Healthcare Cyber Communications Center, FBI, Cybersecurity & Infrastructure Security Agency and National Security Agency in December warned of new ransomware strains and other cyber threats targeting health care.

• The FBI and CISA warned of the “Cuba” Ransomware threat.
• HC3 warned of the Royal ransomware threat.
• HC3 warned that a new ransomware strain known as Blackcat was also targeting health care and appeared to be the successor of the notorious Russian speaking REvil ransomware gang.
• HC3 also warned of the latest version of the LockBit ransomware, known as LockBit 3.0. The LockBit “ransomware as service” in its various forms has targeted health care since 2019.
• The NSA advised of an advanced persistent threat known as APT5, which may be affiliated with the Chinese government, targeting the Citrix Application Delivery Controller which then provides the adversary broad network access.

“Our cyber adversaries believe we may pause for the holidays, which may result in their increased targeting of hospitals and health systems as we have seen around past holidays,” said John Riggi, AHA national advisor for cybersecurity and risk. “But our hospitals never close and our network defenders never cease their vigilance.

Cybersecurity Dive provides guidance on the same topic.

Health IT Security reports

HITRUST plans to release version 11 of its cybersecurity framework (CSF) in January with new and improved features for managing emerging cybersecurity threats and reducing certification efforts, the organization announced.

As previously reported, HITRUST can help healthcare organizations improve their security postures and manage third-party risk. The HITRUST CSF is a risk and compliance-based framework that aims to provide structure and guidance across a variety of data privacy and security regulations and standards, helping organizations reduce burden and complexity.

Specifically, CSF v11 offers improved control mappings and precision in order to reduce certification efforts by 45 percent. In addition, the new version “enables the entire HITRUST assessment portfolio to leverage cyber threat-adaptive controls that are appropriate for each level of assurance.”

CSF v11 also includes expanded authoritative sources, including the National Institute of Standards and Technology (NIST) SP 800-53, Rev 5, and the Health Industry Cybersecurity Practices (HICP) standards.  

HITRUST also developed artificial intelligence-based standards development capabilities to assist its assurance experts in mapping and maintaining authoritative sources. HITRUST said that this AI-based toolkit will reduce maintenance and mapping efforts by up to 70 percent.

In event news, CMS announced

The National Standards Group (NSG), on behalf of the Department of Health and Human Services (HHS), issued a Notice of Proposed Rulemaking (NPRM) CMS-0053-P. The proposed rule, if finalized, would make a regulatory change that would implement requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Patient Protection and Affordable Care Act (Pub. L. 111-148).

This webinar will provide a public forum for CMS to hear feedback on the proposed rule. The call will cover the following topics:

• Background on the current standards
• What the proposed rule would do
• How to submit comments on the proposed rule

Note: Feedback received during this call is not a substitute for formal comments on the rule. See the proposed rule for information on submitting comments.

This free webinar will be held on January 25, 2023, at 2 pm ET. You can register here.

From the vulnerabilities front, the Healthcare Sector Cybersecurity Coordination Center issued an Analyst Note last Thursday. According to the Executive Summary:

HC3 is closely tracking hacktivist groups which have previously affected a wide range of countries and industries, including the United States Healthcare and Public Health (HPH) sector. One of these hacktivist groups—dubbed ‘KillNet’—recently targeted a U.S. organization in the healthcare industry. The group is known to launch DDoS attacks primarily targeting European countries perceived to be hostile to Russia, and operates multiple public channels aimed at recruitment and garnering attention from these attacks.

From the ransomware front, Cybersecurity Dive reports

• CrowdStrike researchers discovered a new exploit method by Play ransomware actors that can bypass URL rewrite mitigations released by Microsoft in October, according to a Tuesday blog post from the incident response firm. Microsoft’s updates were designed to mitigate ProxyNotShell vulnerabilities.
• Crowdstrike researchers discovered the new method while investigating Play ransomware activity. The entry vector was suspected to be zero-day vulnerabilities CVE-2022-41080 and CVE-2022-41082, according to the blog. 
• While investigating the attacks, researchers found threat actors entered through Outlook Web Access (OWA) and leveraged Plink and AnyDesk in order to maintain access.

Bleeping Computer’s The Week in Ransomware is available here. After sharing its thoughts on the Microsoft issue, Bleeping Computer adds

TrendMicro also confirmed this week our September report that a Conti cell known as Zeon rebranded to Royal Ransomware.

Other reports this week shed light on various ransomware operations:

• A report on how Reveton was the precursor to Ransomware-as-a-Service operations.
• A report on the Nokoyawa ransomware operation.
• Vice Society finally gets its own custom ransomware encryptor instead of relying on other operations’ malware.
• A technical report on the Play ransomware, which has expanded its operations recently.

From the cybersecurity defenses front

• Healthcare IT News offers a roundup of strategies and next steps for improving cybersecurity in 2023.

• ISACA offers interesting articles titled “Cybersecurity: What is Changing and What Isn’t” and “Top Cyberattacks of 2022: Lessons Learned.”

• The Wall Street Journal reports that Chief Information Officers and Chief Information Security Officers are working together to better align their respective positions.

From Capitol Hill, Roll Call informs us

The Senate voted overwhelmingly Thursday to pass the final defense authorization bill for fiscal 2023, clearing the sweeping measure for President Joe Biden’s signature.

If Biden signs the NDAA into law, as he is expected to do, it would be the 62nd straight fiscal year that the defense policy measure has been enacted.

The Senate’s final NDAA passage vote was 83-11, and 60 votes were required. The House passed the bicameral compromise on Dec. 8.

Of note to FEHB carriers in the bill, as noted last week, is the Chinese-made semiconductor provision. The law requires a FAR rule to implement the provision within three years, and the FAR rule cannot take effect until December 2027, five years after enactment, which will occur when the President signs the bill.

The New York Times adds

The Biden administration on Thursday stepped up its efforts to impede China’s development of advanced semiconductors, restricting another 36 companies and organizations from getting access to American technology.

The action, announced by the Commerce Department, is the latest step in the administration’s campaign to clamp down on China’s access to technologies that could be used for military purposes and underscored how limiting the flow of technology to global rivals has become a prominent element of United States foreign policy. * * *

Among the most notable companies added to the list is Yangtze Memory Technologies Corporation, a company that was said to be in talks with Apple to potentially supply components for the iPhone 14.

On Thursday, Congress passed a military bill including a provision that will prevent the U.S. government from purchasing or using semiconductors made by Y.M.T.C. and two other Chinese chip makers, Semiconductor Manufacturing International Corporation and ChangXin Memory Technologies, because of their reported links to Chinese state security and intelligence organizations.

The Wiley law firm helpfully offers details on this important provision.

From the cyber vulnerabilities front —

The Cybersecurity Infrastructure and Security Agency (CISA) added five known exploited vulnerabilities and then one more to its catalog.

Healthcare Dive reports

The HHS’ Office of Information Security has released a report looking at the implications of automation for healthcare cybersecurity and how criminals are using artificial intelligence in their hacking activities.

Cyberattackers are using AI to build better malware, the office said. The technology includes machine learning-enabled penetration testing tools, AI-supported password guessing and data to enable impersonation on social networking platforms.

Hackers are also using automated software to identify valuable information such as emails, passwords, credit cards and personal data, according to the report.

The Healthcare Sector Cybersecurity Coordination Center issued this sector alert:

Citrix released patches for a vulnerability that impacts both their Application Delivery Controller and Gateway platforms. This vulnerability allows a remote attacker to completely compromise a target system. These vulnerabilities are known to be actively exploited by a highly capable state-sponsored adversary. Furthermore, the Department of Health and Human Services is aware of U.S. healthcare entities that have already been compromised by the exploitation of this vulnerability. HC3 strongly urges all healthcare and public health organizations to review their inventory for these systems and prioritize the implementation of these patches.

Forbes explains “Why Employee-Targeted Digital Risks Are The Next Frontier Of Enterprise Cybersecurity.”

From the ransomware front —

Bleeping Computer’s The Week in Ransomware has a long introduction which begins

To evade detection by security software, malware developers and threat actors increasingly use compromised code-signing certificates to sign their malware.

This trend was illustrated this week when Microsoft disclosed during the December Patch Tuesday that developer accounts were compromised to sign malicious, kernel-mode hardware drivers in the Windows Hardware Developer Program.

Health IT Security reports

The HHS Health Sector Cybersecurity Coordination Center (HC3) issued two new analyst notes detailing the tactics and indicators of compromise for LockBit 3.0 and BlackCat. The LockBit ransomware family and the BlackCat ransomware variant have been observed targeting the healthcare sector.

Healthcare organizations should remain vigilant and apply recommended mitigations to reduce risk.

CISA released an update to its Cuba ransomware advisory.

From the cybersecurity defenses front

• Health IT Security tells us

Organization executives are doubling down on investments toward cybersecurity reliance as an uptick in data security breaches jeopardizes business operations and overwhelms industries, including the healthcare sector, according to a recent Cisco report.

The “Security Outcomes Report, Volume 3: Achieving Security Resilience” revealed that 96 percent of executives consider security resilience crucial, with 62 percent of organizations surveyed reporting a data security event that impacted business in the past two years.

When asked to elaborate on the types of resilience-impacting incidents, over half the respondents reported data breaches and system outages. Further, ransomware events and distributed denial of service (DDoS) attacks impacted more than 46 percent of surveyed organizations.

The report also indicated that the state of security resilience among organizations is mixed less than 40 percent confident their organization would fare well during a cybersecurity event.

• Forbes identifies ten qualities of a good security program and delves into “Tackling Mental Health And Burnout In Cybersecurity.”

From the cybersecurity policy front, Cyberscoop reports on the highlights of the cybersecurity provisions of the bipartisan National Defense Authorization Act that the House of Representatives passed this week and the Senate is expected to pass next week.

The December 7 FEHBlog quote included the following Roll Call quote:

Also of note, the bill would ban contractors across the government from using Chinese-made semiconductors, after a lengthy phase-in period, an aide with knowledge of the provision said Tuesday. Many federal contractors and other businesses say they are unclear how they will comply.

The Cyberscoop article does not treat this provision as a highlight of the bill. The FEHBlog turned to ComputerWorld, which provides more details on this provision —

While the draft legislation still provides for [Chinese made semiconductor] restrictions to be enacted, contractors now have five years to comply with them, rather than the two years stipulated in an earlier version of the proposal, and the language of the new draft leaves room for waivers to the restrictions under certain circumstances.

Cyberscoop adds

There are a few major exclusions in the combined House and Senate versions, too.

[For example,] FedScoop’s John Hewitt Jones reports that the NDAA left out an amendment to codify a software bill of materials, or SBOM, in the federal procurement process. Lawmakers removed it following strong criticism from industry.

That piece of the legislation would have required “all holders of existing covered contracts and those responding to requests for proposals from the U.S. Department of Homeland Security to provide a bill of materials and to certify that items in the bill of materials are free of vulnerabilities or defects,” Hewitt Jones reported.

Health IT Security tells us

Experts gathered in Boston on December 5 and 6 for the HIMSS Healthcare Cybersecurity Forum to explore topics such as risk quantification, clinical perspectives on cybersecurity, and medical device security.

Speakers included leaders from the Health Sector Coordination Council (HSCC), Northwell Health, Forrester, the Federal Bureau of Investigation, the National Institute for Standards and Technology (NIST), and more.

The presentations collectively showed that healthcare cybersecurity experts are well aware of the risks facing the sector. However, more collaboration, communication, and balance are needed to effectively tackle those risks and emerge stronger as an industry.

The Cybersecurity Infrastructure and Security Agency (CISA) offers a readout from the December 6 meeting of its Cybersecurity Advisory Committee:

[CISA] Director [Jen] Easterly led a discussion with committee members on the CSAC’s strategic focus for 2023.   

“I truly appreciate the caliber of experts who have taken the time to participate in this committee and, moreover, for their continuous work in helping CISA become the Cyber Defense Agency our nation needs and deserves,” said CISA Director Jen Easterly. “I look forward to working with the Committee in the new year to ensure we are continuing to build a more cyber resilient nation to confront the challenges we face in cyber space.”   

“In a time of critical cybersecurity threats, CISA is in a unique position to make a meaningful impact on our Nation’s security,” said the CSAC Chair and Chairman, President & CEO of Southern Company, Tom Fanning. “The Committee members and I look forward to providing strategic recommendations to CISA’s Director Jen Easterly in the coming year to advance CISA’s mission, as they continue to strengthen the cybersecurity posture of the United States.” 

From the cyber vulnerabilities front —

HHS’s Health Sector Cybersecurity Coordinating Center (HC3) released the following documents on this topic:

• November Vulnerabilities of Interest to the Health Sector

• A presentation titled “Automation and Hacking: Potential Impacts on Healthcare.”

CISA added one more known exploited vulnerability to its catalog.

Cybersecurity Dive looks back at the log4shell cybersecurity crisis that first gained widespread public attention in December 2021.

One year after the disclosure of a critical vulnerability in the Apache Log4j logging utility, the nation’s software supply chain remains under considerable threat as federal authorities and the information security community struggle to transform how it develops, maintains and consumes applications in a more secure fashion. 

The vulnerability, dubbed Log4Shell, allowed unauthenticated and untrained threat actors to gain control over applications using a single line of code. 

Thus far, many of the initial fears of catastrophic cyberattacks have failed to materialize, but federal authorities warn this constitutes a long-term threat that must be carefully monitored and fully remediated to prevent a major security crisis. 

From the ransomware front —

Cybersecurity Dive reports, “Ransomware attacks shift beyond US borders; U.S.-based organizations remain the top target for ransomware gangs, but the scale of that misfortune is waning, according to Moody’s.” Here’s the Moody report on 2023 Global Cyber Risk.

HC3 released an analyst report on Royal ransomware. “Royal is a human-operated ransomware that was first observed in 2022 and has increased in appearance. It has demanded ransoms up to millions of dollars. Since its appearance, HC3 is aware of attacks against the Healthcare and Public Healthcare (HPH) sector. Due to the historical nature of ransomware victimizing the healthcare community, Royal should be considered a threat to the HPH sector.”

The Bleeping Computer’s Week in Ransomware informs us

This week has been filled with research reports and news of significant attacks having a wide impact on many organizations.

Last week, Rackspace suffered a massive outage on their hosted Microsoft Exchange environment, preventing customers from accessing their email. On Tuesday, Rackspace finally confirmed everyone’s fears that a ransomware attack caused the outage.

However, today [December 9] they began warning customers to be on the lookout for targeted phishing emails and to monitor their credit reports and banking account statements for suspicious activity. This warning could indicate that the ransomware operation likely stole data in the attack.

From the cyber defenses front —

CISA provides us with

a Phishing Infographic to help protect both organizations and individuals from successful phishing operations. This infographic provides a visual summary of how threat actors execute successful phishing operations. Details include metrics that compare the likelihood of certain types of “bait” and how commonly each bait type succeeds in tricking the targeted individual. The infographic also provides detailed actions organizations and individuals can take to prevent successful phishing operations—from blocking phishing attempts to teaching individuals how to report successful phishing operations.

ZDNet also discusses how people can identify and deter phishing attacks.

The National Institute of Standards and Technology issued Special Publication (SP) 1800-34, which offers organizations guidance on verifying that the internal components of the computing devices they acquire are genuine and have not been tampered with.

From the cybersecurity policy front —

Health IT Security reports

Following reports that patient data was transmitted to Facebook through the use of tracking technology on hospital websitesand within password-protected patient portals, the HHS Office for Civil Rights (OCR) issued a bulletin outlining the dos and don’ts of using tracking tech as a HIPAA-covered entity or business associate.

Covered entities and business associates using tracking tools such as Google Analytics and Meta Pixel should pay close attention to their obligations under HIPAA, OCR noted.

Cybersecurity Dive informs us

The Cyber Safety Review Board is set to examine the Lapsus$ ransomware gang, the U.S. Department of Homeland Security announced Friday. A prolific group, Lapsus$ has targeted a wide range of global companies and government agencies, sometimes with ruthless digital extortion, since late 2021. * * *

“The CSRB will review how this group has allegedly impacted some of the biggest companies in the world, in some cases with relatively unsophisticated techniques, and determine how we all can build resilience against innovative social engineering tactics and address the role of international partnerships in combating criminal cyber actors,” Mayorkas said Friday during a conference call with reporters. “As cyberthreats continue to evolve, we have to evolve the methods we use to protect ourselves against cybercriminal activity and increase our resilience against future attacks.” * * *

CSRB Deputy Chair Heather Adkins, VP of security engineering at Google, noted that many of the reported targets of Lapsus$ were considered to have very strong cybersecurity programs. These organizations had followed recommended security controls, and in some cases even advanced controls, but still felt a significant impact from the attacks. 

Several alleged members of the extortion gang have been arrested, but researchers suspect other affiliates of Lapsus$ remain unaccounted for.

Healthcare Dive offers an interview with the National Coordinator for Health IT, Mickey Tripathi, about federal health information blocking enforcement.

From the cybersecurity breaches/vulnerabilities front —

• Health IT Security summarizes recent breaches suffered by healthcare organizations.

• ZDNet explains that

• ZIP and RAR files have overtaken Office documents as the file most commonly used by cyber criminals to deliver malware, according to an analysis of real-world cyber attacks and data collected from millions of PCs. 
• The research, based on customer data by HP Wolf Security, found in the period between July and September this year, 42% of attempts at delivering malware attacks used archive file formats, including ZIP and RAR.  
• That means cyber attacks attempting to exploit ZIP and RAR formats are more common than those which attempt to deliver malware using Microsoft Office documents like Microsoft Word and Microsoft Excel files, which have long been the preferred method of luring victims into downloading malware. 

From the ransomware front —

• The Health Sector Cybersecurity Coordination Center shared an updated CISA / FBI alert about a Cuba ransomware actor.

• The Bleeping Computer released its Week in Ransomware.

From the cybersecurity defenses front —

• Venture Beat offers Gartner analysts’ eight cybersecurity predictions for 2023.

• Health IT Security reports “Connected device security company Ordr published a maturity model to help healthcare organizations evaluate and improve the security of their connected devices. The guide is broken down into five stages of maturity, each with recommended actions and detailed descriptions.”

• The Wall Street Journal warns “Companies should do a better job of handling internal cybersecurity complaints before they escalate to whistleblowing, which is becoming more common in the cyber field, lawyers and industry veterans said.”

From the cybersecurity policy front, Cybersecurity Dive tells us

The Defense Department officially launched its zero trust strategy and road map Tuesday, part of a larger strategy to overhaul the way federal agencies combat sophisticated threat actors, including those from criminal organizations and rogue nation states. 

The DOD will move away from a perimeter-based approach for IT systems defense to a system that essentially assumes the risk of breach during regular interactions and will act accordingly. The plan calls for the Pentagon’s full implementation of the strategy and road map by fiscal 2027.  * * *

Microsoft, in a blog post released Tuesday, praised the DOD announcement on zero trust, noting the challenge of collaborating on zero trust amid the difficulties of comparing implementations across various organizations and technology stacks. 

“However the level of detail found in the DoD’s strategy provides a vendor-agnostic, common lens to evaluate the maturity of a variety of existing and planned implementations that were derived from the DoD’s unique insights on cybersecurity,” Steve Faehl, federal security CTO at Microsoft, said in the blog post. 

From the cybersecurity vulnerabilities front, Forbes offers “A Boiling Cauldron: Cybersecurity Trends, Threats, And Predictions For 2023.”

From the ransomware front, Health IT Security reports

Lorenz ransomware poses a threat to the healthcare sector, particularly larger organizations, the Health Sector Cybersecurity Coordination Center (HC3) warned in its latest analyst note. The human-operated ransomware group has been known to focus on “big-game hunting,” targeting large, high-profile entities rather than private users.

Lorenz threat actors are known to publish data publicly as a tactic to pressure victims during the extortion process. The actors have been observed demanding hefty ransoms, ranging from $500,000 to $700,000.

From the cybersecurity defenses front, Cybersecurity Dive informs us

Cybercriminals are prepared and ready to target online shoppers with fake websites, malicious links and fake charities, the Cybersecurity and Infrastructure Security Agency warned as the holiday shopping season gets underway.

“By following a few guiding principles like checking your devices, shopping from trusted sources, using safe purchasing methods, and following basic cyber hygiene like multifactor authentication, you can drastically improve your online safety when shopping online for gifts this year,” CISA Director Jen Easterly said in a statement.

The federal agency shared tips for individuals to limit cyber risks while shopping online, and encouraged organizations to review guidance it released last year with the FBI to manage cyberthreats during the holidays.

From Capitol Hill, Politico tells us about developments in privacy and cybersecurity legislative efforts.

From the cyber vulnerabilities front —

• The HHS Health Sector Cybersecurity Coordination Center (HC3) issued its monthly vulnerabilities bulletin for October 2022.

• The Cybersecurity and Information Security Agency (CISA) added another known exploited vulnerability to its catalog.

• ZDNet reports on a “concerning” tactic that hackers are using to dodge multi-factor authentication.

• Health IT Security adds “Numerous cloud attacks are successfully exploiting the healthcare sector for financial gain, according to a newly released 2022 Cloud Security Report by cybersecurity vendor Netwrix.”

Cybersecurity Dive warns us

More than one-third of respondents said it took their organization longer to assess the scope, stop and recover from a holiday or weekend attack compared to a weekday, according to a Cybereason survey published Wednesday November 16]. Larger organizations with more than 2,000 employees were even more likely to experience delays.

Organizations would lose more money as a result of a ransomware attack on a weekend or holiday than they were a year ago, according to Cybereason. One-third of respondents said their organization lost more money from a holiday or weekend ransomware attack, up from 13% in 2021.

Organizations in education and travel and transportation reported a greater likelihood of financial losses from a holiday or weekend attack instead of a weekday. About 2 in 5 respondents in those industries said their organization suffered a larger economic impact.

From the ransomware front —

Health IT Security reports

HHS, the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory about Hive ransomware actors. The ransomware actors have been repeatedly targeting critical infrastructure, especially the healthcare sector since they were first observed in June 2021.

As of November 2022, Hive ransomware actors have victimized more than 1,300 companies globally and gained $100 million in ransom payments. The group has claimed multiple healthcare victims, including an attack on Memorial Health System in August 2021 that resulted in appointment cancellations, clinical disruptions, and EHR downtime. * * *

Healthcare organizations should secure and monitor RDP, install updates for software, firmware, and operating systems as soon as they are released, and maintain offline data backups. In addition, organizations were encouraged to enable PowerShell Logging and install and regularly update antivirus software.

The federal bodies also urged organizations to prepare for the event of a ransomware attack by reviewing the security postures of third-party vendors, implementing a recovery plan, and documenting external remote connections.

In the event of a Hive ransomware attack, organizations should isolate infected systems, secure backups, and turn off other computers and devices to manage the attack. Paying the ransom is also highly discouraged, as it may incentivize threat actors to continue victimizing organizations.

“This is another example of foreign-based, primarily Russian-speaking, hackers attacking U.S. health care, John Riggi, the American Hospital Association’s (AHA) national advisor for cybersecurity and risk, said in a subsequent announcement.

Here is Bleeping Computer’s current Week in Ransomware.

Other news this week are new reports on rising ransomware operations:

• Both Microsoft and SecurityScorecard released reports on the Royal Ransomware operation, which is believed to be comprised of ex-Conti members.

• ASEC released a report on Dagon Locker, a rebrand of the Quantum ransomware operation.

• BlackBerry warns of the expanding operations of the ARCrypter ransomware.

From the cybersecurity defenses front

• Cybersecurity Dive informs us that “The Cybersecurity and Infrastructure Security Agency on Thursday [November 17] released its Guide for Stakeholder-Specific Vulnerability Categorization and outlined three areas of focus for continued improvement.”

• The National Institutes of Standards and Technology issued SP 800-125, which is a “Guide to a Secure Enterprise Network Landscape.”

• Mitre shared a “Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook.“

• Forbes provides a new approach to closing the cybersecurity talent gap.

From the cybersecurity policy front, Cybersecurity Dive tells us

Virginia Democrat Sen. Mark Warner, chairman of the Senate Select Committee on Intelligence, has released a white paper detailing a series of potential regulatory requirements for health systems aimed at improving cybersecurity across the industry.

Cyber vulnerabilities increasingly threaten patient safety as well as leaving organizations exposed to data theft, the paper argues. “It has become readily apparent that the way that cybersecurity is treated by those in the healthcare sector needs to change.”

Assembled by Warner’s staff with input from cybersecurity and healthcare experts, the paper outlines the challenges facing care delivery organizations and offers proposals aimed at strengthening providers’ cybersecurity capabilities and building response systems to help recover from attacks. * * *

The paper proposes establishing minimum cyber hygiene practices for healthcare organizations, addressing insecure legacy systems, requiring a “software bill of materials” for medical devices and all healthcare industry software, streamlining information sharing and looking at how Medicare payment policies should be changed to incorporate cybersecurity expenses.

The public comment deadline is December 1, 2022.

From the cyber vulnerabilities front

While the Cybersecurity and Infrastructure Security Agency did not add any new known exploited vulnerabilities this week, the Federal Times offers an article on how to use the catalog which lead the FEHBlog to CISA’s guidance on that topic. CISA allows identified three steps that the agency is taking to transformthe vulnerability management landscape.

• First, we must introduce greater automation into vulnerability management, including by expanding use of the Common Security Advisory Framework (CSAF)
• Second, we must make it easier for organizations to understand whether a given product is impacted by a vulnerability through widespread adoption of Vulnerability Exploitability eXchange (VEX)
• Third, we must help organizations more effectively prioritize vulnerability management resources through use of Stakeholder Specific Vulnerability Categorization (SSVC), including prioritizing vulnerabilities on CISA’s Known Exploited Vulnerabilities (KEV) catalog

Cybersecurity Dive adds

Multiple threat actors are launching attacks against unpatched users of Zimbra Collaboration Suite, a business productivity software and email platform, the Cybersecurity and Infrastructure Security Agency said in a warning Thursday [November 10].  

CISA, in a joint advisory with the Multi-State Information Sharing and Analysis Center (MS-ISAC) and contributions from the FBI, said threat actors are exploiting multiple CVEs to launch attacks against unpatched government and private sector users. 

The advisory updates previous guidance issued in August regarding vulnerabilities in ZCS. Officials urge administrators that failed to patch their systems or are otherwise exposed to the internet, to assume they have been compromised and use third-party detection signatures in the advisory to hunt for threat activity. 

and

Federal authorities are encouraging users and corporate administrators to apply security updates after major vulnerabilities were found in Citrix ADC (Application Delivery Controller) and Citrix Gateway.

The Cybersecurity and Infrastructure Security Agency warned Wednesday that a remote attacker could exploit the vulnerability to take control over an affected system.

Citrix is not aware of any known exploitation in the wild, but is urging administrators to immediately patch their systems, according to a company spokesperson.

Security Week explains how “Microsoft’s latest Patch Tuesday [November 7] updates address six zero-day vulnerabilities, including one related to the Mark-of-the-Web (MotW) security feature that has been exploited by cybercriminals to deliver malware.”

From the ransomware front

Bleeping Computers’ The Week in Ransomware is back.

From the same publication we learn

The U.S. Department of Health and Human Services (HHS) warned today [November 10] that Venus ransomware attacks are also targeting the country’s healthcare organizations.

In an analyst note issued by the Health Sector Cybersecurity Coordination Center (HC3), HHS’ security team also mentions that it knows about at least one incident where Venus ransomware was deployed on the networks of a U.S. healthcare organization. * * *

The threat actors behind the Venus ransomware attacks are known for hacking into the victims’ publicly-exposed Remote Desktop services to encrypt Windows devices.

Besides terminating database services and Office apps, the ransomware will also delete event logs, Shadow Copy Volumes, and disable Data Execution Prevention on compromised endpoints.

Since August, when it began operating, Venus ransomware has been relatively active, with new submissions being uploaded to ID Ransomware every day.

From the cybersecurity defenses front —

Cybersecurity Dive advises us

NIST Special Publication 800-63B Digital Identity Guidelines offers best practices for password lifecycle management, as well policy standards for other authentication methods. The guidelines for password management are straightforward: 

Check passwords against breached password lists

Block passwords contained in password dictionaries

Prevent the use of repetitive or incremental passwords

Disallow context-specific words as passwords

Increase the length of passwords

* * *

[F]ewer than half, 44%,  of organizations provide their employees with guidance and best practices governing passwords and access management, according to Keeper’s 2022 U.S. Cybersecurity Census Report.

Nearly one-third allow employees to set and manage their own passwords – and admit that employees often share access to passwords.

But organizations are reaching a point of no return with passwords. The NIST framework doesn’t just recommend guidelines for password management, but for a variety of authentication methods, including biometrics and multifactor. 

“Time spent on enhancing password-based authentication is a wasted cost; instead, organizations should get out of password schemes as soon as possible and investigate alternatives,” said Maynor. 

Still, it’s helpful to be familiar with these practices for personal use. The article also discusses password manager security.

The Wall Street Journal provides an update in rising cybersecurity insurance premiums:

Data from the latest WSJ Pro Research cybersecurity survey reveals cyber insurance insights including coverage levels, challenges related to buying policies, and claim rates.

There is a wide disparity in purchases of cyber insurance depending on company size: Nine out of ten of the largest companies have cybersecurity insurance coverage, while six in ten of the smallest have coverage.

Premiums are rising: 86% of companies renewing their cyber insurance policies noted an increase in premiums for the same level of coverage.

Reasons for small businesses lacking cyber insurance include not thinking it represents good value for money and believing they are unlikely to be hit with a successful cyberattack.

Larger companies are more likely to claim against their cyber insurance: 11% of large companies made claims in the last 12 months, more than three times the number of smaller businesses that made claims.

Cybersecurity Dive discusses a recent cybersecurity insurannce coverage dispute. “The legal dispute between the snack giant [Mondelez] and insurer Zurich American, which lasted four years, raises further questions about how insurers cover acts of cyber war.”

From the cybersecurity policy front —

Health IT Security informs us

President Biden issued a proclamation declaring November as Critical Infrastructure Security and Resilience Month. The President highlighted ways in which the Administration has taken action to protect critical infrastructure from cyber and physical threats and underscored the importance of security awareness and action to maintain critical infrastructure resilience.

The Cybersecurity and Infrastructure Security Agency applauded the President’s action.

Throughout November, CISA will be bringing the world of infrastructure security and resilience to life with interviews and blogs featuring CISA staff and external industry partners, as well as other activities. We encourage everyone to visit CISA’s Infrastructure Security Month webpage for more information and resources. Be sure to follow CISA on social media throughout the month for resources, tools, and tips you can use to help identify and reduce risk to infrastructure facilities, their internet and operational technology systems, employees, visitors and more.

Cybersecurity Dive adds

Officials at the Cybersecurity and Infrastructure Security Agency are optimistic that U.S. companies will embrace its efforts to boost cooperation on raising cybersecurity performance goals, sharing intelligence and building resiliency.  * * *

“We need to ensure that we’re coming together to really protect the technology ecosystem instead of putting the burden on those least able to defend themselves,” [CISA Director Jen] Easterly said during the forum [hosted by the Center for Strategic and International Studies on November 1]. “So [I’m] very excited about what I’m seeing from the technology companies.”

Another objective is to get more large companies to embrace cybersecurity as a corporate governance, not just technology concern, Easterly said.

From the cyber vulnerabilities front

The Healthcare Sector Cybersecurity Coordination Center issued a PowerPoint presentation about Iranian Threat Actors and Healthcare.

CISA added one more known exploited vulnerability to its catalog.

Last Tuesday, CISA announced

OpenSSL has released a security advisory to address two vulnerabilities, CVE-2022-3602 and CVE-2022-3786, affecting OpenSSL versions 3.0.0 through 3.0.6.

Both CVE-2022-3602 and CVE-2022-3786 can cause a denial of service. According to OpenSSL, a cyber threat actor leveraging CVE-2022-3786, “can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution,” allowing them to take control of an affected system.

CISA encourages users and administrators to review the OpenSSL advisory, blog, OpenSSL 3.0.7 announcement, and upgrade to OpenSSL 3.0.7. For additional information on affected products, see the 2022 OpenSSL vulnerability – CVE-2022-3602 GitHub repository, jointly maintained by the Netherland’s National Cyber Security Centrum (NCSC-NL) and CISA.

From the ransomware front

The Wall Street Journal reports

U.S. banks flagged ransomware-related transactions adding up to more than $1 billion in 2021, the Treasury Department said, although risk experts said that barely scratches the surface of cybercrime’s true economic scale.

Data released by the Financial Crimes Enforcement Network, or FinCEN, this week showed the number and value of transactions that banks had flagged as related to ransomware in 2021 reached $1.2 billion, spread across 1,489 reports to regulators. In 2020, such transactions totaled $416 million across 487 reports.

“I think we’re seeing the tip of the iceberg in terms of what these actual payments are,” said Paul Benda, senior vice president for operational risk and cybersecurity at the American Bankers Association, a trade group for banks. 

Wow.

Cyberscoop tells us

On Tuesday [November 1], the White House wrapped up a two-day ransomware summit, where participants agreed to stand up a voluntary International Counter Ransomware Task Force to serve as a base for coordinated disruption and threat sharing. The initiative, which will launch sometime early next year, will start with a fusion center operated out of Lithuania’s Regional Cyber Defense Center as a test case for a bigger information-sharing program.

From the cybersecurity defenses front

HIPAA Journal relates

The Department of Health and Human Services (HHS)’ Office for Civil Rights (OCR) has released a video presentation on its YouTube channel that explains in detail how the 2021 HITECH Act amendment regarding “Recognized Security Practices” applies to HIPAA-regulated entities, and how HIPAA-regulated entities can demonstrate to OCR that Recognized Security Practices have been in place for the 12 months prior to a security breach. * * *

In the video, Nick Heesters, senior advisor for cybersecurity at OCR, explains how the HITECH Act was amended, what constitutes Recognized Security Practices, and how they can be implemented to reduce liability. * * *

Heesters confirmed that in the event of an audit or investigation into potential HIPAA Security Rule violations, OCR will send a data request to the regulated entity to inform them they can voluntarily provide evidence that Recognized Security Practices have been in place. * * *

Heesters explained how HIPAA-regulated entities can demonstrate to OCR that Recognized Security Practices have been in place and the types of evidence that they can consider submitting.

Heesters confirmed that organizations that have implemented Recognized Security Practices, and are able to demonstrate that sufficiently, will not avoid financial penalties, but OCR will consider the Recognized Security Practices as a mitigating factor. These practices only mitigate against HIPAA Security Rule investigations and audits, not other investigations and audits, such as investigations into potential HIPAA Privacy Rule violations. Heesters also confirmed that the lack of Recognized Security Practices will not be considered an aggravating factor and will not result in increased penalties.

CISA released guidance on phishing-resistant multifactor authentication this week. Cybersecurity Dive adds

Phishing-resistant multifactor authentication isn’t just the strongest form of MFA — it’s “the gold standard for MFA,” according to the Cybersecurity and Infrastructure Security Agency.

The federal agency this week published a fact sheet to clarify its definition of phishing-resistant MFA and provide guidance and prioritization schemes for organizations to implement the safeguards in logical phases. 

• Three key recommendations from CISA.
• Stick to FIDO standards and the Web Authentication API (WebAuthn) protocol.
• Take stock of your IT systems, determine which platforms support MFA and start there.
• Roll out phishing-resistant MFA in phases, placing early emphasis on high-value targets and resources.

FIDO standards and the WebAuthn protocol are the only widely available phishing-resistant forms of MFA, according to CISA. The protocol and standard, both developed by the FIDO Alliance, can work together to bolster MFA.

From the cybersecurity policy front —

Cybersecurity Dive reports

The Cybersecurity and Infrastructure Security Agency released its long-awaited, cross sector cybersecurity performance goals Thursday, in a bid to raise the security baselines. Far from esoteric, the efforts listed are meant to serve as a broadly-digestible roadmap to minimum operational security.

The 37 voluntary goals span the technical and the tactical, weighing the cost, complexity and impact of security initiatives. But they are not exhaustive and do not capture all that is required to protect critical infrastructure security. 

The goals “capture a core set of cybersecurity practices with known risk-reduction value broadly applicable across sectors,” CISA said.

CISA placed a premium on low cost, high impact security efforts, which accounts for more than 40% of the goals. 

and

“CISA Director Jen Easterly, in a Thursday media call, said the guidelines would be particularly helpful for local organizations that may operate in the supply chains of larger companies or target rich, resource poor providers like hospitals, K-12 school districts or local water utilities.”

Cyberscoop adds

Danielle Jablanski, an OT cybersecurity strategist at cybersecurity firm Nozomi Networks, noted that the goals are “extremely accessible” and allows an organization to choose how to adopt the practices without a sort of formalized mandate.

“There’s a lot of things that are out of [asset owners] control and I think this document brings them in and focuses in on what is in their control what’s in their power and what’s in their capability to get done,” she said.

The CISA performance goals remind me of the flexibility built into the HIPAA Security Rule. Speaking of which, here’s the HHS Office for Civil Rights October Cybersecurity Newsletter, which discusses the HIPAA Security Rule’s Security Incident Procedures. Health IT Security discusses the newsletter’s recommendations.

From the cyber breach front —

U.S. News and World Reports lists the ten biggest breaches of 2022 so far.

Closer to home, Govexec reports on a federal employee’s unfortunate experience of having her Thrift Savings Account looted by a hacker.

From the cyber vulnerability front

Tech Republic tells us “In their new report, SonicWall explores some of the most dangerous trends that security professionals need to have on their radar.”

The Health Section Cybersecurity Coordination Center (HC3) issued its Monthly Cybersecurity Vulnerability Bulletin.

In September 2022, vulnerabilities to the health sector have been released that require attention. This includes the monthly Patch Tuesday vulnerabilities released by several vendors on the second Tuesday of each month, along with mitigation steps and patches. Vulnerabilities for this month are from Microsoft, Google/Android, Apple, Cisco, Adobe, SAP, and VMWare. A vulnerability is given the classification as a zero- day if it is actively exploited with no fix available or is publicly disclosed. HC3 recommends patching all vulnerabilities with special consideration to the risk management posture of the organization.

HC3 also released a sector alert titled “Critical OpenSSL Vulnerability Will Require Action by Healthcare Organizations.”

A software library called OpenSSL – used with many of the most common operating systems and applications for secure communications – is going to receive an important update on Tuesday, November 1, 2022. OpenSSL is deployed across industries ubiquitously, including the health sector. HC3 highly recommends all public and private heatlh sector organizations identify all instances of OpenSSL in their infrastructure and prepare to test and deploy the patch as soon as it is released.

CISA updated its Known Exploited Vulnerabilities Catalog with six plus one new vulnerabilities this week.

From the ransomware front —

Cybersecurity Dive reports

Ransomware attack activity jumped 26% from August to September, hitting 202 victims and reaching a number of cases not observed since May, according to NCC Group’s Monthly Threat Pulse report. Last year still holds the lead for monthly highs.

The jump in ransomware was partly accelerated by a summer spree of attacks initiated by the LockBit ransomware group, which was responsible for more than half of all attacks tracked by NCC Group’s threat intelligence team in September. The prolific threat actor first appeared in September 2019 and is now on version 3.0 of its ransomware strain and payloads.

While month-to-month ransomware activity ebbs and flows, the sectors most heavily targeted and hit by attacks have held steady, according to NCC Group. The industrials sector — including construction, manufacturing, distribution and engineering products, among others — was the most-targeted industry in September with 57 incidents and accounting for more than one-quarter of attacks. Attacks on industrials doubled the next most-hit target, consumer cyclicals.

Tech Republic identifies the top ransomware groups of 2022.

Healthcare Dive uses the recent ransomware attack on Common Spirit Health to explain why cybersecurity needs to be an important consideration in merger and acquisitions due diligence work.

Here’s the latest Week in Ransomware from Bleeping Computer.

From the cyber defense front —

• An expert writing in ISACA points out the top three mistakes IT security teams make.
• CISA issued guidance on “Understanding and Responding to Distributed Denial-of-Service Attacks.”