Technical Volume 2: Cybersecurity Practices for Medium and Large Health Care Organizations Table of Contents Introduction ............................................................................................................................................... 3 Cybersecurity Practices at Medium-Sized Health Care Organizations ...................................................... 4 Cybersecurity Practices at Large Health Care Organizations .................................................................... 7 Document Guide: Cybersecurity Practices ................................................................................................ 9 Cybersecurity Practice #1: E-mail Protection Systems ............................................................................ 14 Cybersecurity Practice #2: Endpoint Protection Systems ....................................................................... 24 Cybersecurity Practice #3: Identity and Access Management ................................................................ 31 Cybersecurity Practice #4: Data Protection and Loss Prevention ........................................................... 42 Cybersecurity Practice #5: IT Asset Management ................................................................................... 52 Cybersecurity Practice #6: Network Management ................................................................................. 57 Cybersecurity Practice #7: Vulnerability Management ........................................................................... 65 Cybersecurity Practice #8: Security Operations Center and Incident Response ..................................... 73 Cybersecurity Practice #9: Medical Device Security ................................................................................ 87 Cybersecurity Practice #10: Cybersecurity Policies ................................................................................. 98 Appendix A: Acronyms and Abbreviations ............................................................................................ 101 Appendix B: References ......................................................................................................................... 105 List of Tables Table 1. E-mail Protection Controls ........................................................................................................ 15 Table 2. Basic Endpoint Controls to Mitigate Risk at Endpoints ............................................................. 25 Table 3. Example of a Data Classification Schema .................................................................................. 43 Table 4. Suggested Procedures for Data Disclosure ............................................................................... 44 Table 5. Security Methods to Protect Data ............................................................................................ 45 Table 6. Data Channels for Enforcing Data Policies ................................................................................ 48 Table 7. Expanding DLP to Other Data Channels .................................................................................... 49 Table 8. Recommended Timeframes for Mitigating IT Vulnerabilities ................................................... 68 Table 9. Factors for Consideration in Penetration Test Planning ............................................................ 69 Table 10. Example Incident Response Plays for IR Playbooks ................................................................ 75 Table 11. Roles and Responsibilities for an Organizational CIRT ............................................................ 79 Table 12. Timeframes for Resolving Medical Device Vulnerabilities ...................................................... 92 Table 13. Incident Response Plays for Attacks Against Medical Devices ............................................... 93 Table 14. Example Cybersecurity Policies for Consideration .................................................................. 97 Table 15. Acronyms and Abbreviations ................................................................................................. 100 2 Introduction This volume will help answer the question, “How do I mitigate the five threats that were outlined in the Main document?” The practices outlined in this volume are most appropriate for medium-sized and large organizations. This volume is for the technical practitioner; it contains technical details for implementing cybersecurity practices. It provides an overview of cybersecurity practices that have been outlined by the industry as highly effective at mitigating risks to the health care industry. This volume is an index of existing industry practices, with guidance on how to start your journey implementing these practices. Details and explanations of the cybersecurity practices are included for additional context where needed. Please consider these simple instructions when reading this volume: 1) If you are a medium-sized organization, start with the sub-practices labeled with the heading “Sub-Practices for Medium-Sized Organizations.” Feel free to consider the additional sub- practices as well. 2) If you are a large organization, consider implementing all the sub-practices listed in the document, including both those under the heading “Sub-Practices for Medium-Sized Organizations” and those labeled “Sub-Practices for Large Organizations.” 3 Cybersecurity Practices at Medium- Sized Health Care Organizations Medium-sized health care organizations perform critical functions for the health care and public health (HPH) sector. These organizations include critical access hospitals in rural areas, practice management organizations that support physician practices, revenue cycle or billing organizations, mid-sized device manufacturers, and group practices. Medium-sized health care organizations generally employ hundreds of personnel, maintain between hundreds and a few thousand information technology (IT) assets, and may be primary partners with and liaisons between small and large health care organizations. It is typical for a medium-sized organization to have several critical systems that are interconnected to enable work activities in support of the organization’s mission/ These organizations tend to have a diverse inventory of assets that support multiple revenue streams. They also tend to have narrow profit margins, limited resources, and limited flexibility to implement robust cybersecurity practices. For example, it is rare for a medium-sized organization to have its own dedicated 24x7x365 security operations center (SOC) Medium-sized organizations tend to focus on preventing cybersecurity events, implementing rigid security policies, with few exceptions permitted. This rigidity is often due to insufficient resources to support more open and flexible cybersecurity models, such as those larger organizations can often afford. Medium-sized organizations usually struggle to obtain cybersecurity funding that is distinct from their standard IT budgets. The top security professional in an organization of this size might often feel overwhelmed by compliance and cybersecurity duties, wear multiple hats, and experience constraints around execution plans. Medium-sized organizations operate in complex legal and regulatory environments that include but are not limited to the following: The Office of the National Coordinator for Health Information Technology (ONC) regulations for interoperability of Certified Electronic Health Information Technology The Medicare Access and hildren’s Health Insurance Program Reauthorization Act of 2015 (MACRA)/Meaningful Use Multiple enforcement obligations under the Food and Drug Administration (FDA) The Joint Commission accreditation processes The Health Insurance Portability and Accountability Act (HIPAA)/Health Information Technology Economic and Clinical Health Act (HITECH) requirements The Payment Card Industry Data Security Standard (PCI-DSS) Substance Abuse and Mental Health Services Administration (SAMHSA) requirements The Gramm-Leach-Bliley Act for financial processing The Stark Law as it relates to providing services to affiliated organizations The Family Educational Rights and Privacy Act (FERPA) for those institutions participating within Higher Education 4 The Genetic Information Nondiscrimination Act (GINA) The new General Data Protection Regulation (GDPR) in the European Union IT Assets Used by Medium-Sized Organizations Medium-sized organizations may have up to a few thousand IT assets, with a mix of dozens to a hundred information systems. All assets may have cybersecurity vulnerabilities and are susceptible to cyber threats. There are three important factors in securing assets: (1) understanding their relationship within the organization’s IT ecosystem; (2) understanding how the workforce leverages and uses the assets; and (3) understanding the data that are generated, stored, and processed within those assets. Not all assets are equally important; some are mission critical and must always be fully operational, while others are less critical, and might even be offline for days or weeks without harming the organization’s mission. Some assets have large repositories of sensitive data that represent significant risk, but are not as critical to the enterprise’s business. In all cases, the organization uses IT assets for business reasons and should protect those assets with proper cyber hygiene controls. Examples of assets