Rishi Tripathi

What is Today's Cost ("Good Investment" ) for a CyberSecurity Program..? How about $22 Million..? Think this is (too) High..?? Then... Is $1 Billion too much..? How about $1.6BB..? The Costs of Change Healthcare (Ransomware) CyberSecurity Attack is now close to exceeding $1 Billion... (currently at $872 Million)... but projected to be between $1.35 - 1.6 BB when the while event is concluded. This includes the $22 Million Ransomware Payment to the AlphaV BlackCat criminal organization. This Cost will "eclipse that of Casino Group MGM, which didn't pay a ransom following an attack on its systems last year, and which faces recovery costs of $100 million to rebuild its systems and paying for the fallout...". 95% of Ransomware is Preventable.. CyberSecurity A-Team has an Industry-PROVEN Ransomware Methodology that will help prevent Companies from suffering a Ransomware Attack. Don't wait until it's Too Late..! (after you are Attacked) to contact them - www.CyberSecurity-A-Team .com #Ransomware #CyberSecurity-A-Team #Healthcare #MostVulnerable https://lnkd.in/g5B7fqEu

6

CMMC Level 2 Assessment Objective: Security Engineering PRACTICE: Organizations must employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. ASSESSMENT: Examples of systems security engineering concepts and principles include: · Developing layered protections; establishing security policies, architecture, and controls as the foundation for design · Incorporating security requirements into the system development life cycle · Delineating physical and logical security boundaries · Ensuring that developers are trained on how to build secure software · Performing threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk Be prepared! Your assessor could ask to 🔍 EXAMINE security planning policy. 🗣 INTERVIEW personnel with responsibility for determining information system security requirements. 📝 TEST organizational processes for system security plan development, review, update, and approval. (CMMC Assessment Guide: Level 2 Version 2.11, page 209) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

48

Key mitigation from the recent Joint Cybersecurity Advisory "Social Engineering Tactics Targeting Healthcare & Public Health Entities and Providers": "MFA bypasses should not be allowed for any individual calling into the Help Desk." How is your organization handling these calls? Are there exceptions, and if so, are there guardrails to prevent them from being leveraged by threat agents? The advisory can be found at the following link: https://lnkd.in/e2SpXUFM #cybersecurity #criticalinfrastructure #socialengineering #mfa #riskassessment #riskanalysis #healthcare #hipaa #hitrust #IC3 #CISA

3

ICYMI: HHS says hospitals impacted by Change Healthcare cyberattack can delegate breach notifications to UnitedHealth Group Three key points made in this update: 1) Covered entities affected by the Change Healthcare breach may delegate to Change Healthcare the tasks of providing the required HIPAA breach notifications on their behalf. 2) Only one entity – which could be the covered entity itself or Change Healthcare – needs to complete breach notifications to affected individuals, HHS, and where applicable the media. 3) If covered entities work with Change Healthcare to perform the required breach notifications in a manner consistent with the HITECH Act and HIPAA Breach Notification Rule, they would not have additional HIPAA breach notification obligations. See the HHS Cybersecurity Incident FAQs here: https://lnkd.in/ejEebTXK #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

1

Does anyone believe that we know "the half of it" when it comes to the impact on patients due to Ascension's failed enterprise cyber risk management (ECRM) program? Anyone who's been a patient (that's all of us) knows how difficult it is to receive access to care, timely care, and quality care when the healthcare system is ostensibly operating at its best. In addition to patients not getting their prescriptions, having important diagnostic tests postponed, being treated without access to vitally important records, being diverted from ERs etc. etc., etc., I'm convinced there are deaths occurring. C'mon healthcare!@#! Top two root causes: 1. Risk illiteracy 2. Lack of C-suite/Board engagement #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors https://lnkd.in/esvF_ETP

18

3 Comments

Bob Zukis and the Digital Directors Network (DDN) recently published a summary and full text of Glass, Lewis & Co.'s latest strengthening of their position on cyber governance for their members. If you're not a member of DDN, you should consider applying. Both ISS | Institutional Shareholder Services (ISS)and Glass Lewis, the two most prominent proxy advisory services in North America, had already taken measures to include disclosures and other similar requirements to the SEC's final cybersecurity disclosure requirements in their governance assessments of public companies. This latest Glass Lewis announcement raises the ante even more. As a public company, UnitedHealth Group will continue to be under scrutiny for their handling of the current matter. Lots to learn from this one. #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors

7

2 Comments

The recent cyberattack on Ascension, a major Catholic health system, which forced the diversion of patients and the delay of surgeries, accentuates the critical importance of having a robust incident response plan in place. In response to the attack, Ascension took several key systems offline, a move indicative of an active incident response strategy aimed at containing the breach and assessing its impact. The attack is suspected to have been executed through sophisticated malware, exploiting vulnerabilities potentially introduced by third-party vendor software or through phishing schemes targeting the healthcare system's employees. The swift shutdown of critical operational software following the breach was likely a preemptive measure to prevent further spread and damage, highlighting the necessity for immediate and decisive action in the wake of a security incident. Incident response investigations play a crucial role in not only addressing the immediate threats but also in preparing for future security challenges. These investigations help in understanding how the breach occurred, the extent of the infiltration, and the data compromised. In the case of Ascension, a comprehensive forensic analysis would be essential to determine the specifics of the malware used, the entry points exploited, and any data exfiltration that may have occurred. This situation illustrates the importance of incident response as a fundamental component of cybersecurity, especially in sectors like healthcare, where the stakes involve not just data privacy but direct patient care. Through meticulous investigation and a structured response approach, healthcare providers like Ascension can better manage cyber threats, mitigate the impacts of such incidents, and refine their security measures to prevent future attacks. #incidentresponse #databreachinvestigations #Ascension #ransomware

2

Need help finding that ITGC talent for the upcoming audit season? Let Raul Ruiz & Associates source the top talent in the market for you. We focus on ITGC, cybersecurity, architects, and engineers. Reach out and start the conversation. https://lnkd.in/g3TgQ-zR #itgc #generalcontrols #auditprofessionals #cisapros #raulruizassociates #directhire #itgcplacements #cisspprofessionals

6

Boards and Cybersecurity. Is your Board and CEO doing enough? Having been on the board of a #cybersecurity and #riskmanagement company, I understand the critical importance of having a #CISO or cybersecurity expert on the executive team, available to the board, to lead/advise the plan and protection against breaches. It’s not IF, it’s WHEN a breach will occur-because it will! Fortunate to be involved in several #cyber conferences and retreats, I know many outstanding #risk experts - if you need one, please contact me! Breaking report on Black Basta, a #ransomware-as-a-Service (RaaS) that has targeted at least 12 targeted infrastructure sectors, including #healthcare and #publichealth. As of May 2024, they have impacted over 500 organizations worldwide across North America, Europe, and Australia. The #FBI, #CISA, #HHS, and #MS-ISAC have issued a joint Cybersecurity Advisory (CSA) regarding the Black Basta ransomware activity as part of the StopRansomware initiative. An ounce of prevention is worth so much more than a pound of cure! Get proactive on protection. My thanks to friend Bob Fabien "BZ" Zinga (版主) 🇺🇸🇺🇦 who brought this breaking article to my attention. #cybersecurity #riskmanagement #boardofdirectors

53

17 Comments

Chairmen, Chairwomen, Directors on Boards and CEO's should all watch this United Health CEO's testimony from 5/1/24 on their Cybersecurity Incident. Ask: Do you have any certified CISSP or CISO qualified Board Members at the table, asking the hard questions and understanding the gaps? I would bet CEO Andrew Witty's board will change drastically with $22M ransom paid out of pocket and $872M in other costs and fees (plus inbound HIPAA fines). https://lnkd.in/gXsPtPxm

3

1 Comment

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

What policies made healthcare more vulnerable to hacking and made taking care of patients even more difficult? "Ascension hack: What's new in 11 states and DC" #CyberSecurity #CyberAttacks #Advocacy #HealthcareAdvocacy #Healthcare #Medicine #Patients #HealthcareHeroes #HealthcareProfessionals #FirstResponders #Pharmacists #Nurses #Doctors #NursesOnLinkedin #Nursing #HealthcareOnLinkedin #AMA #ANA https://lnkd.in/gKuejtCR

1

🚨 Zero Day Threats Alert! 🚨 Why should you care and listen to Drex's #2MD? Because your digital security matters more than ever. Zero day threats are like ninjas of the cyber world – silent, swift, and lethal. They exploit vulnerabilities before developers even know they exist! 💥 Your data is at risk: Zero day attacks can compromise your personal information, financial data, and even sensitive business intel in the blink of an eye. 💻 No one is immune: From individuals to corporations, everyone is a potential target. Don’t assume you’re safe – be proactive! ⚠️ Stay ahead of the game: Understanding and addressing zero day threats keeps you one step ahead of cyber criminals. Ignorance is not bliss when it comes to digital security. 🔒 Protect yourself: Invest in robust cybersecurity measures, stay vigilant against suspicious activity, and always keep your software updated. It’s not paranoia, it’s smart protection. Stay safe, stay informed! #CyberSecurity #ZeroDayThreats #229 🛡️🔒

23

2 Comments

Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile is in the public comment phase. If you have an interest in cyber IR and you haven't read rev. 3, it's well worth a look. https://lnkd.in/g8bQ_5Bp #dfir #nist Nearshore Cyber

9

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment