The health care sector has been advised by the Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) to take immediate action in addressing 21 new cyber vulnerabilities. These vulnerabilities were recently identified by the Cybersecurity and Infrastructure Security Agency in January. The affected products include those from Ivanti, Microsoft, Google/Android, Apple, Mozilla, Cisco, SAP, VMWare, Adobe, Fortinet, Atlassian, and Jenkins. It is important to note that some of these vulnerabilities are being actively exploited by cyber criminals.
John Riggi, the AHA’s national advisor for cybersecurity and risk, emphasized the significance of these monthly updates from HC3. He highlighted how vulnerabilities in third-party technologies pose a significant cyber risk to hospitals. Riggi also pointed out that foreign-based hackers often take advantage of these published vulnerabilities by exploiting them before patches are released. To mitigate such risks, hospitals and health systems are encouraged to adhere to the HHS voluntary cybersecurity performance goals and maintain effective risk-based vulnerability management and third-party risk management programs.
For further information on this matter or any other cyber and risk issues, you can reach out to John Riggi at jriggi@aha.org. To stay updated on the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.