Reading Room Table Display

Alert (AA22-321A)

“This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.”

 

“The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS) are releasing this joint CSA to disseminate known Hive IOCs and TTPs identified through FBI investigations as recently as November 2022.”

 

“FBI, CISA, and HHS encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents. Victims of ransomware operations should report the incident to their local FBI field office or CISA.”

Read full article, or download PDF version of this article, on the CISA site

This advisory uses the MITRE ATT&CK® for Enterprise framework, version 12. See MITRE ATT&CK for Enterprise for all referenced tactics and techniques.

*Excerpt taken from cisa.gov

Hive is an exceptionally aggressive, financially-motivated ransomware group known to maintain sophisticated capabilities who have historically targeted healthcare organizations frequently. The Health Sector Cybersecurity Coordination Center (HC3) recommends the Healthcare and Public Health (HPH) Sector be aware of their operations and apply appropriate cybersecurity principles and practices found in this document in defending their infrastructure and data against compromise.

The Hive ransomware group has been known to be operational since June of 2021 but in that time has been very aggressive in targeting the US health sector. One report covering the third quarter of 2021 – just months after they began operating – ranks them as the fourth most active ransomware operators in the cybercriminal ecosystem. Another report noted the observation of 355 companies in Hive’s first 100 days of operation.

Download Report as PDF.

The Ransomware Profile identifies the Cybersecurity Framework Version 1.1 security objectives that support identifying, protecting against, detecting, responding to, and recovering from ransomware events. The profile can be used as a guide to managing the risk of ransomware events. That includes helping to gauge an organization’s level of readiness to counter ransomware threats and to deal with the potential consequences of events.

Visit NIST to read more or download PDF.

Resource:

• Cybersecurity Framework 1.1

Healthcare Delivery Organizations (HDO) face a complex set of challenges in their information technology and operational environment, with threats that can impact patient care, business operations, medical devices, facilities, protected health information, and public confidence. A critical element for defense is the Cybersecurity Operations Center (CSOC), which acts as a focal point for an HDO’s cyber threat monitoring and response. This paper provides a framework that aligns with the threats that HDOs face, which cyber leadership can use to help assess the state of their operational cyber defenses and inform planning for future defensive capabilities.

Download Guide as PDF

Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. This website is the U.S. Government’s official one-stop location for resources to tackle ransomware more effectively.*

Visit CISA’s Ransomware Resource Hub to access all resources.

*Excerpt from www.cisa.gov.

The Common Vulnerability Scoring System (CVSS) assists organizations in assessing the severity of vulnerability to determine the urgency and priority of the response. CVSS was developed for enterprise IT systems and does not adequately reflect the clinical environment and potential patient safety issues. To address these challenges, MITRE developed the “Rubric for Applying CVSS to Medical Devices.” The CVSS Rubric consists of a structured set of questions and corresponding decision flow diagrams, along with medical device specific examples and guidance, to help assess a medical device vulnerability in a consistent and standardized way. In October 2020, FDA qualified the CVSS Rubric as a Medical Device Development Tool.

URL to the paper on MITRE.ORG https://www.mitre.org/md-cvss-rubric

Zero Trust Architecture (ZTA) can reduce the attack surface and limit adversarial lateral movement thereby reducing the impact of ransomware. The implementation of ZTA requires the integration of existing and new capabilities, as well as buy-in across the enterprise. Successful implementations will require multi-year planning that includes determination of drivers and use cases, policy development, architecture development, technology readiness assessment, pilots, user training, and phasing of deployments. The movement towards Zero Trust Architectures (ZTA) aligns with cybersecurity modernization strategies and practices to deter and defend against dynamic threats both inside and outside traditional enterprise perimeters. A key driver for ZTA adoption across the federal government space is the “Executive Order on Improving the Nation’s Cybersecurity” released from President Biden on May 12, 2021, directing executive agencies to “develop a plan to implement Zero Trust Architecture.”

The ZTA Tech Watcher report explores the state of the technology today and provides background, applicability, and benefits to organizations, outstanding challenges and issues, and recommendations. The paper can be found at  https://www.mitre.org/publications/technical-papers/zero-trust-architectures-are-we-there-yet;

CISA has published the Rising Ransomware Threat to OT Assets fact sheet in response to the recent increase in ransomware attacks targeting operational technology (OT) assets and control systems. The guidance:

· Provides steps to prepare for, mitigate against, and respond to attacks;

· Details how the dependencies between an entity’s IT and OT systems can provide a path for attackers; and

· Explains how to reduce the risk of severe business degradation if affected by ransomware

Read or download PDF.

“International Medical Device Regulators Forum  guidance document provides concrete recommendations to all responsible stakeholders on the general principles and best practices for medical device cybersecurity (including in vitro diagnostic (IVD) medical devices). It outlines recommendations for medical device manufacturers, healthcare providers, regulators, and users to: minimize cybersecurity risks that could arise from use of the device for its intended purposes; and to ensure maintenance and continuity of device safety and performance.  This document considers cybersecurity in the context of medical devices that either contain software, including firmware and programmable logic controllers (e.g. pacemakers, infusion pumps) or exist as software only (e.g. Software as a Medical device (SaMD)).”*

Download “Principles and Practices for Medical Device Cybersecurity” PDF.

*Excerpt from http://www.imdrf.org/.

“The FBI identified at least 16 Conti ransomware attacks targeting US healthcare and first responder networks, including law enforcement agencies, emergency medical services, 9-1-1 dispatch centers, and municipalities within the last year. These healthcare and first responder networks are among the more than 400 organizations worldwide victimized by Conti, over 290 of which are located in the U.S. Like most ransomware variants, Conti typically steals victims’ files and encrypts the servers and workstations in an effort to force a ransom payment from the victim. The ransom letter instructs victims to contact the actors through an online portal to complete the transaction. If the ransom is not paid, the stolen data is sold or published to a public site controlled by the Conti actors. Ransom amounts vary widely and we assess are tailored to the victim. Recent ransom demands have been as high as $25 million.”*

Read full FBI Watch report.

*Excerpt from https://www.aha.org.

“Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access.

 

Here’s an example of how a ransomware attack can occur:

1. A user is tricked into clicking on a malicious link that downloads a file from an external website.
2. The user executes the file, not knowing that the file is ransomware.
3. The ransomware takes advantage of vulnerabilities in the user’s computer and other computers to propagate throughout the organization.
4. The ransomware simultaneously encrypts files on all the computers, then displays messages on their screens demanding payment in exchange for decrypting the files.”*

To read all information, visit the Computer Security Resource Center on the NIST site.

*Exerpt from https://csrc.nist.gov/.

“This report details a comprehensive strategic framework for tackling the dramatically increasing and evolving threat of ransomware, a widespread form of cybercrime that in just a few years has become a serious national security threat and a public health and safety concern.”*

Visit the Institute for Security & Technology site to download PDF.

*Excerpt from securityandtechnology.org.

“This ​​​Industry Advisory Committee paper on Ransomware builds awareness for all Australians and their businesses on the current ransomware threat landscape. The paper presents real case studies and provides advice on how all Australians can best protect themselves from ransomware attacks.​”*

Download “Locked Out: Tackling Australia’s Ransomware Threat” as PDF.

*Excerpt from https://www.homeaffairs.gov.au/.

Assess Technical Readiness

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is voluntary guidance intended to help organizations to better manage and reduce cybersecurity risk. The Framework provides a set of desired cybersecurity activities and outcomes using common language that is easy to understand and communicate to all stakeholders.

The NIST Cybersecurity Framework consists of three-parts:

• The Framework Core helps organizations manage and reduce cybersecurity risk in a manner that complements their existing risk management practices.
• Framework Implementation Tiers help organizations assess the maturity of their existing cybersecurity risk management practices.
• Framework Profiles are unique to an organization and assist in defining and prioritizing cybersecurity requirements and objectives.

Visit the NIST Cybersecurity Framework site.

No-Cost Cyber Defense for U.S. Hospitals

“The Center for Internet Security® (CIS®), in partnership with Akamai, is offering the Malicious Domain Blocking and Reporting (MDBR) service AT NO COST to all public and private hospitals and related healthcare organizations in the United States. This service provides an additional layer of cybersecurity protection that is proven, effective, and easy to deploy.

MDBR is a fully-managed proactive domain security service, with CIS and Akamai fully maintaining the systems required to provide the service. Once an organization points its DNS requests to Akamai’s DNS server IP addresses, every DNS lookup will be compared against a list of known and suspected malicious domains. Attempts to access known malicious domains associated with malware, phishing, ransomware, and other cyber threats will be blocked and logged.

The logged data is then provided by Akamai to CIS’s Security Operations Center (SOC). The SOC uses this data to perform detailed analysis and aggregate reporting for the benefit of the hospital community, as well as organization-specific reporting and intelligence services. If circumstances require, remediation assistance is provided for each organization that implements the service.”*

Read about No-Cost Cyber Defense for U.S. Hospitals.

*Excerpt from www.cisecurity.org.

“The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) developed this publication to help managed service providers (MSPs) improve their cybersecurity and the cybersecurity of their customers. “*

Read more about A Guide for MSPs to Conduct, Maintain, and Test Backup Files and to download PDF.

*Excerpt from csrc.nist.gov.

IT and cybersecurity practitioners are responsible for the technical implementation of defensive technologies. Before a ransomware incident occurs, healthcare organizations should have an effective security architecture in place to identify, protect, detect, respond to and recover from ransomware. The NIST Ransomware Practice Guides below provide reference designs using existing commercial products that could aid an organization in remediating gaps in an organization’s cybersecurity implementation.

NIST SPECIAL PUBLICATION (SP) 1800-25
Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events

This NIST Ransomware Practice Guide shows how organizations can develop and implement appropriate actions/technologies to remediate gaps in an organization-cybersecurity implementation using existing commercial products, which can be deployed before a detected cybersecurity event.

NIST SPECIAL PUBLICATION (SP) 1800-11
Data Integrity: Recovering from Ransomware and Other Destructive Events

This NIST Ransomware Practice Guide shows how organizations can develop and implement appropriate actions and use various technologies to recover from a cybersecurity event.

EVALUATE CYBERSECURITY MATURITY

HHS recently published an overview of three Cybersecurity Maturity Models including the NIST Cybersecurity Framework. These models allow an organization to baseline their current capabilities against best practices.

Download the presentation on Cybersecurity Maturity Models.

“Matthew Halvorsen, Strategic Program Director for NCSC’s Supply Chain and Cyber Directorate, recently sat down with Gregory Garcia, the Executive Director for Cybersecurity of the Health Sector Coordinating Council, for an audio interview on current threats to the health care sector. The discussion focused on cyber and supply chain threats, including ransomware, nation-state targeting of COVID-19 research, and other current topics.”*

Listen to Podcast or read transcript.

*Excerpt from www.dni.gov.

“Email and messaging services (such as Skype, Twitter, or Snapchat) are one of the primary ways we communicate. We not only use these technologies every day for work, but also to stay in touch with friends and family. Since so many people around the world depend on these technologies, they have become one of the primary attack methods used by cyber attackers. This attack method is called phishing. Learn what phishing is and how you can spot and stop these attacks, regardless if you are at work or at home.”*

Learn more about phishing on the SANS site.

*Excerpt from www.sans.org.

Watch Rotem Guttman in this SEI Cyber Minute as he discusses “Mitigating Ransomware.”

“HHS established the Health Care Industry Cybersecurity Task Force following the passage of the Cybersecurity Act of 2015. The Task Force members represented a wide variety of organizations within the health care and public health sector, including hospitals, insurers, patient advocates, security researchers, pharmaceutical companies, medical device manufacturers, health information technology developers and vendors, and laboratories.”*

Read more about the Health Care Industry Cybersecurity Task Force.

*Excerpt from www.phe.gov.

“The Cybersecurity Toolkit for Digital Health serves as an educational resource for digital health companies at all stages of growth on both the fundamentals and best practices for cybersecurity and privacy protection.”*

Visit Mass Digital Health site to access all resources.

*Excerpt from massdigitalhealth.org.

“The ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers.”*

Vist the Internet Storm Center.

*Excerpt from isc.sans.edu.

“InfraGard is a partnership between the Federal Bureau of Investigation (FBI) and members of the private sector for the protection of U.S. Critical Infrastructure. Through seamless collaboration, InfraGard connects owners and operators within critical infrastructure to the FBI, to provide education, information sharing, networking, and workshops on emerging technologies and threats. InfraGard’s vetted membership includes: business executives, entrepreneurs, lawyers, security personnel, military and government officials, IT professionals, academia and state and local law enforcement—all dedicated to contributing industry-specific insight and advancing national security.”*

Visit FBI InfraGard site.

*Excerpt from infragard.org.

As part of its mission, CISA leads the effort to enhance the security, resiliency, and reliability of the Nation’s cybersecurity and communications infrastructure.

Visit the US-CERT site.

“The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes.”*

Read more about CVSS.

*Excerpt from first.gov.

CVE® is a list of records—each containing an identification number, a description, and at least one public reference—for publicly known cybersecurity vulnerabilities.

Visit CVE site.

If you are getting started in cybersecurity operations, evolving your existing security operations center (SOC), or engaging with a SOC regularly, MITRE offers free downloads of 11 Strategies of a World-Class Cybersecurity Operations Center—both for the 20-page summary document and the full textbook. Fully revised, this second edition of the popular 10 Strategies of a World-Class Cybersecurity Operations Center includes new material and evolved thinking to bring a fresh approach to excelling at cybersecurity operations and leveraging up your cyber defenses.

You will learn to:

• Identify the right SOC structure and functions for your organization.
• Hire and grow talented staff, foster a sense of community, and create a place people want to be.
• Instrument digital assets and fuse their data to speed workflow, maximize detection, and inform situational awareness.
• Leverage cyber threat intelligence to operationalize threat-oriented defense, adversary emulation, hunting, and response.
• Tell the SOC’s story through effective metrics and communications, internally and externally.

Read more and download PDFs.

The Department of Homeland Security/Cybersecurity and Infrastructure Security Agency (DHS/CISA) offers a Cyber Resilience Review.

“CRR is a no-cost, voluntary, non-technical assessment to evaluate an organization’s operational resilience and cybersecurity practices. CRR assesses enterprise programs and practices across a range of ten domains including risk management, incident management, service continuity, and others. The assessment is designed to measure existing organizational resilience as well as provide a gap analysis for improvement based on recognized best practices.”*

Visit the CISA site to access all resources.

*Excerpt from us-cert.cisa.gov.

Evaluate your cyber response plan

Cyber Tabletop Exercises (TTX) are a way to evaluate your cyber response plan with scenarios that identify gaps between what you’ve planned for and what can actually happen, practice roles and responsibilities, and improve communications throughout organizations.

Intelligence Driven Exercises and Solutions (IDEAS) is a TTX methodology – during which participants explore dynamic problem sets or threats in a unique way to challenge assumptions, methods, and strategies and bolster understanding.  The resources below provide both an overview and detailed description of the methodology.

Resources:

• IDEAS Overview
• IDEAS Methodology

Other Resources:

• Enhancing Cyber Wargaming – This report describes a framework for cyber wargaming that bridges the gap between strategic tabletop exercises and hands-on cyber red-teaming. Included in the report is a comprehensive survey of existing cybersecurity exercises.

“Crowdsourced Cyber Security | Sector Threat Intelligence | Shared Best Practices

Health-ISAC Inc. (H-ISAC, Health Information Sharing and Analysis Center), is a global, non-profit, member-driven organization offering healthcare stakeholders a trusted community and forum for coordinating, collaborating and sharing vital physical and cyber threat intelligence and best practices with each other.”*

Visit the H-ISAC site for more information and resources.

*Excerpt from h-isac.org.

“Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP), the primary publication of the Cybersecurity Act of 2015, Section 405(d) Task Group, aims to raise awareness, provide vetted cybersecurity practices, and move organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector. It seeks to aid healthcare and public health organizations to develop meaningful cybersecurity objectives and outcomes.”*

Visit the Public Health Emergency site to access all documentation.

*Excerpt from www.phe.gov.

“A Prescription for Health Sector Cybersecurity

Health Sector Cybersecurity Coordination Center (HC3) was created by the Department of Health and Human Services to aid in the protection of vital, healthcare-related controlled information and ensure that cybersecurity information sharing is coordinated across the Health and Public Health Sector (HPH).”*

Visit HC3 site to access all products.

*Excerpt from www.hhs.gov.

“The Health Sector Coordinating Council (HSCC), in partnership with the U.S. Department of Health and Human Services, is pleased to announce the release of the “Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients” publication. The four-volume publication seeks to raise awareness for executives, health care practitioners, providers, and health delivery organizations, such as hospitals. It is applicable to health organizations of all types and sizes across the industry.”*

Read more on the HSCC site or download “HICP: Managing and Protecting Patients” PDF directly.

*Excerpt from healthsectorcouncil.org.

Cyber Assessments include a full range of vulnerability and penetration testing, and adversary assessment methods to bolster an organization’s ability to identify, protect, and detect ransomware threats. By tailoring and applying assessment methodologies and tools focused on business requirements, employing these methods can help improve an organization’s ability to assess and manage their enterprise ransomware risk.

Download Cyber Assessment PDF.

TRAIN STAFF TO AVOID INFECTION

Users are often the most effective cyber sensors. User awareness training helps every employee in your organization to better recognize, avoid, and report potential threats that can compromise critical systems via known attack vectors, including phishing and ransomware.

MITRE has implemented a program to train users on how to recognize and handle suspicious emails.  We provided an overview of how to establish such a program.  The EARNEST Practice helps educate End Users to be effective Cyber Sensors.

Resources:

• Establishing a Suspicious Email Program
• How to Use EARNEST Practice

NIST Special Publication (SP) 1800-11 – Data Integrity: Recovering From Ransomware and Other Destructive Events

This NIST Ransomware Practice Guide shows how organizations can develop and implement appropriate actions and use various technologies to recover from a cybersecurity event.

Visit NIST to read more or to download PDF.

The resources below provide additional resources that could aid an organization in recovering from ransomware or other destructive events.

Other Resources:

• NIST Cybersecurity Framework
• Health and Human Services Brief on Ransomware and Privacy Breaches
• National Cybersecurity Center of Excellence (NCCoE): Healthcare Sector Use Cases
• NCCoE Data Security Program

Assess Cybersecurity Operations

Cyber Operations Rapid Assessment (CORA) is a lightweight assessment tool used to evaluate your overall cybersecurity operations and infrastructure. CORA can enable healthcare organizations to gather a snapshot of their cybersecurity operations capabilities and provides specific recommendations for improvement. CORA emphasizes threat analysis, incident prevention and response, and threat intelligence information sharing. CORA is an effective model for an organization seeking a quick review of its cybersecurity operations capability, and as a possible prelude to a more rigorous assessment such as Crown Jewels Analysis (CJA).

The resources below provide addition detail on CORA and its application.

Resources:

• CORA Overview
• CORA Presentation and Sample Report
• CORA: Threat Informed Cybersecurity Operations
• CORA and Alternative Methodologies
• Threat-Informed Cybersecurity Operations for Healthcare Delivery Organizations Guide

Technical Paper

The primary purpose of the MITRE Systems Engineering Guide, or SEG, is to convey The MITRE Corporation’s accumulated wisdom on a wide range of systems engineering subjects—sufficient for understanding the essentials of the discipline and for translating this wisdom into practice in your own work environment.

Read more about the SEG or request a PDF.

Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook

Technical Paper

This playbook outlines a framework for health delivery organizations (HDOs) and other stakeholders to plan for and respond to cybersecurity incidents around medical devices, ensure effectiveness of devices, and protect patient safety.  This document can help HDOs to prepare for and respond to ransomware attacks.

Read more about the Playbook or Download PDF directly.

Essential Clean-Slate Cyber Recovery Assessment for Time-Critical Processing

Technical Paper

This document outlines a framework and set of criteria for assessing an organization’s ability and time to recover from a devastating cyberattack. Assessment criteria provide stakeholders with a common language for analyzing recoverability, and the framework offers a method for performing introspective assessments. These tools can help organizations better ensure that they are prepared and able to execute recovery plans in the event of a ransomware or other cyberattack.

Read more about the framework in the PDF.

Resource:

The ASPR TRACIE Healthcare System Cybersecurity: Readiness & Response Considerations resource can help healthcare facilities, particularly hospitals, and the systems they may be a part of, understand the roles and responsibilities of stakeholders before, during, and after a cyber incident. Information within this document is specifically related to the effects of a cyber incident on the healthcare operational environment, specifically the ability to effectively care for patients and maintain business practices and readiness during such an event. While the focus of this document is on disruptions associated with a large-scale cyberattack, many strategies and principles outlined are relevant to a range of cybersecurity incidents and healthcare facilities.

File Agenda:

• Ransomware Prevention
• Ransomware Recovery
• Breach Review
• Ransomware and Security Incidents
• Ransomware and Breaches
• Breach Resources

Download PDF from Health & Human Services Office for Civil Rights.

“Ransomware exploits human and technical weaknesses to gain access to an organization’s technical infrastructure in order to deny the organization access to its own data by encrypting that data. However, there are measures known to be effective to prevent the introduction of ransomware and to recover from a ransomware attack. This document describes ransomware attack prevention and recovery from a healthcare sector perspective, including the role the Health Insurance Portability and Accountability Act (HIPAA) has in assisting HIPAA covered entities and business associates to prevent and recover from ransomware attacks, and how HIPAA breach notification processes should be managed in response to a ransomware attack.”*

Download “Ransomware and HIPAA Fact Sheet” from the Health & Human Services site.

*Excerpt from www.hhs.gov.

“My entity just experienced a cyber-attack! What do we do now?

A Quick-Response Checklist from the HHS, Office for Civil Rights (OCR)

Has your entity just experienced a ransomware attack or other cyber-related security incident, and you are wondering what to do now? This guide explains, in brief, the steps for a HIPAA covered entity or its business associate (the entity) to take in response to a cyber-related security incident.”*

Download Cyber Attack Checklist from Health & Human Services (HHS) site.

*Excerpt from www.hhs.gov.

Health Information Privacy

“On this website you will find educational materials specifically designed to give HIPAA covered entities and business associates insight into how to respond to a cyber-related security incidents.”*

Visit the Health & Human Services site for resources.

*Excerpt from www.hhs.gov.

“Office of Civil Rights (OCR) enforces nondiscrimination regulations that apply to programs, services, and activities receiving HHS Federal financial assistance.  We also enforce nondiscrimination provisions of other laws as they apply to programs and activities receiving HHS Federal financial assistance.”*

Visit the Health & Human Services (HHS) site for all resources.

*Excerpt from www.hhs.gov.

Recorded webinar, 1.5hrs long, deep tech

Watch video on YouTube.

This Ransomware Guide includes two resources:

• Part 1: Ransomware Prevention Best Practices
• Part 2: Ransomware Response Checklist

“These ransomware best practices and recommendations are based on operational insight from the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). The audience for this guide includes information technology (IT) professionals as well as others within an organization involved in developing cyber incident response policies and procedures or coordinating cyber incident response.”*

Download guide as PDF.

*Excerpt from www.cisa.gov

“CISA has observed continuing ransomware attacks across the country and around the world: See CISA’s Awareness Briefings on Combating Ransomware, Joint Ransomware Statement, and CISA Insights – Ransomware Outbreak. Below, please find resources on CISA’s newly redesigned ransomware information page to better connect you with helpful resources and tools you and your organization need to guard against the ransomware threat.”*

Visit CISA to access all guides and resources.

*Excerpt from www.cisa.gov

Read CISA document that covers:

• What is Ransomware?
• How do I protect my networks?
• How do I respond to ransomware?

“Ransomware has rapidly emerged as the most visible cybersecurity risk playing out across our nation’s networks, locking up private sector organizations and government agencies alike. And that’s only what we’re seeing – many more infections are going unreported, ransoms are being paid, and the vicious ransomware cycle continues on. We strongly urge you to consider ransomware infections as destructive attacks, not an event where you can simply pay off the bad guys and regain control of your network (do you really trust a cybercriminal?).”*

Read or download PDF.

*Excerpt from us-cert.cisa.gov.

“The recent ransomware attacks targeting systems across the country are the latest in a string of attacks affecting State and local government partners. The growing number of such attacks highlights the critical importance of making cyber preparedness a priority and taking the necessary steps to secure our networks against adversaries. Prevention is the most effective defense against ransomware.”*

Read or download PDF.

*Excerpt from us-cert.cisa.gov.

“This document is a U.S. Government interagency technical guidance document aimed to inform Chief Information Officers and Chief Information Security Officers at critical infrastructure entitites, including small, medium, and large organizations.  This document provides an aggregate of already existing Federal government and private industry best practices and mitigation strategies focused on the prevention and response to ransomware incidents.”*

Download PDF from www.fbi.gov

*Excerpt taken from www.fbi.gov.

Security Tip (ST19-001).

“Ransomware is a type of malware threat actors use to infect computers and encrypt computer files until a ransom is paid. (See Protecting Against Malicious Code for more information on malware.) After the initial infection, ransomware will attempt to spread to connected systems, including shared storage drives and other accessible computers.”

 

“If the threat actor’s ransom demands are not met (i.e., if the victim does not pay the ransom), the files or encrypted data will usually remain encrypted and unavailable to the victim. Even after a ransom has been paid to unlock encrypted files, threat actors will sometimes demand additional payments, delete a victim’s data, refuse to decrypt the data, or decline to provide a working decryption key to restore the victim’s access. The Federal Government does not support paying ransomware demands. (See the FBI’s ransomware article.)”

Visit CISA site for more info on Security Tip (ST19-001).

*Excerpt take from us-cert.cisa.gov

Alert (AA20-302A)

“This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS). This advisory describes the tactics, techniques, and procedures (TTPs) used by cybercriminals against targets in the Healthcare and Public Health (HPH) Sector to infect systems with ransomware, notably Ryuk and Conti, for financial gain.”

 

“CISA, FBI, and HHS have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers. CISA, FBI, and HHS are sharing this information to provide warning to healthcare providers to ensure that they take timely and reasonable precautions to protect their networks from these threats.”

Read full article, or download PDF version of this article, on the CISA site.  

This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques.

*Excerpt taken from us-cert.cisa.gov

Watch educational video* on:

• What is ransomware
• How it works
• What are the signs of infections
• What can you do
• Case studies
• More info

  *Video located on dhsconnect.connectsolutions.com.  Source found at www.cisa.gov.

“The MS-ISAC in 2019 observed a 153% increase in the number of reported SLTT government ransomware attacks from the previous year. Many of these incidents resulted in significant network downtime, delayed services to constituents, and costly remediation efforts. The MS-ISAC largely attributes this increase to Ryuk ransomware infections and compromises affecting Managed Service Providers (MSP) that service SLTT governments. Not only are victims at risk of losing access to their systems and files, but they may also experience financial loss due to legal costs, purchasing credit monitoring services for employees/customers, or ultimately deciding to pay the ransom. The effects of a ransomware attack are particularly catastrophic when they impact emergency services and critical infrastructure, such as 911 call centers and hospitals.”*

Read more information and download PDF on the CIS site.

*Excerpt from www.cisecurity.org.

“Ransomware is a type of malware that has become a significant threat to U.S. businesses and individuals during the past two years. Most of the current ransomware variants encrypt files on the infected system/network (crypto ransomware), although a few variants are known to erase files or block access to the system using other methods (locker ransomware). Once access to the system is blocked, the ransomware demands a ransom in order to unlock the files, frequently $200 – $3,000 in bitcoins, though other currencies and gift cards are occasionally reported. Ransomware variants almost always opportunistically target victims, infecting an array of devices from computers to smartphones.”*

Learn more facts, threats, and countermeasures on the CIS site.

*Excerpt from www.cisecurity.org