Cybersecurity Practices for Health Care Organizations~ RJ BLANCHARD BENEFIT SERVICES

Table 2. Basic Endpoint Controls to Mitigate Risk at Endpoints Control

Antivirus (AV)

Description

Technology capable of detec�ng known malicious malware using signatures, heuris�cs, and other techniques

Implementation Specification • Push AV packages out using endpoint management systems that interface with Windows and Apple opera�ng systems (OS). • Develop metrics to monitor the status of AV engines, signature updates and health. • Dispatch ﬁeld services/desktop support for malware that is detected but not automa�cally mi�gated. • Leverage network access control (NAC) to conduct a valida�on check prior to enabling network access. • Ensure that encryp�on is enabled on new endpoints acquired by the organiza�on.

Full disk encryption

Technology capable of encryp�ng an en�re disk to make it unreadable for unauthorized individuals

• Connect encryp�on management to endpoint management systems that interface with both Windows and Apple OS. • Develop metrics to monitor the status of encryp�on. • Dispatch ﬁeld services/desktop support teams to resolve encryp�on errors. • Use an�-the� cable locks to lock down any device that cannot support encryp�on. • Leverage NAC to conduct a valida�on check prior to enabling network access. • Limit usage of local administrator accounts. Enable only local administra�ve rights required by the user. Use a separate account dedicated to this purpose.

Hardened baseline images

Conﬁgure the endpoint opera�ng system in the most secure manner possible

• Enable local ﬁrewalls and limit inbound access to the endpoint to only required ports. • Disable weak authen�ca�on hashes (e.g., LANMAN, NTML Version 1.0). • Prevent so�ware from auto-running/star�ng, especially when using thumb drives. • Disable unnecessary services and programs. • Permit usage only of known hardware encrypted thumb drives for wri�ng data. • Review and consider the implementa�on of Security 25

Cybersecurity Practices for Health Care Organizations~ RJ BLANCHARD BENEFIT SERVICES

Articles inside

Appendix B: References

Table 13. Incident Response Plays for Attacks Against Medical Devices

Table 15. Acronyms and Abbreviations

Table 14. Example Cybersecurity Policies for Consideration

Cybersecurity Practice #9: Medical Device Security

Table 12. Timeframes for Resolving Medical Device Vulnerabilities

Table 11. Roles and Responsibilities for an Organizational CIRT

Table 9. Factors for Consideration in Penetration Test Planning

Cybersecurity Practice #6: Network Management

Cybersecurity Practice #8: Security Operations Center and Incident Response

Table 10. Example Incident Response Plays for IR Playbooks

Cybersecurity Practice #7: Vulnerability Management

Cybersecurity Practice #5: IT Asset Management

Table 7. Expanding DLP to Other Data Channels

Table 6. Data Channels for Enforcing Data Policies

Table 3. Example of a Data Classification Schema

Table 5. Security Methods to Protect Data

Table 4. Suggested Procedures for Data Disclosure

Cybersecurity Practice #4: Data Protection and Loss Prevention

Cybersecurity Practices at Medium-Sized Health Care Organizations

Table 1. E-mail Protection Controls

Cybersecurity Practice #3: Identity and Access Management

Cybersecurity Practice #2: Endpoint Protection Systems

Table 2. Basic Endpoint Controls to Mitigate Risk at Endpoints

Cybersecurity Practices at Large Health Care Organizations

Cybersecurity Practice #1: E-mail Protection Systems

Introduction