Latest Cybersecurity News 2022-12-19 Edition

ISA Cybersecurity CyberNews

Follow ISA Cybersecurity on LinkedIn for the latest cybersecurity news

Weekly CyberTip: Celebrating “Unboxing Day”

Get Cyber Safe, Canada’s national public awareness campaign, is proposing a new tradition: “Unboxing Day”. Taking place on December 27 – the day after Boxing Day in Canada – Unboxing Day is meant to be designated as a time to ensure your home is cyber safe over the holidays. In their recent blog post, Get Cyber Safe presents a handy tip sheet for securing your home and new devices, from securing your home network to locking down and personalizing new devices. Check it out this holiday season.

BC privacy watchdog issues report outlining “troubling” personal health data security issues

In a report released December 15, the Office of the Information and Privacy Commissioner (OIPC) in British Columbia has highlighted a number of significant risk exposures in the personal health information security system in that province.

“It is troubling that the Provincial Health Services Authority (the PHSA), charged with responsibility for managing the System, has known about these risks since at least 2019, and has made little progress to address them,” according to B.C.’s Information and Privacy Commissioner Michael McEvoy.

The document identifies a number of areas in which the systems maintained by the PHSA are potentially vulnerable to attack. “Multi-factor authentication is the industry standard for securing personal information, however it is not universally required for System access. Very disturbingly, there exists no proactive audit program that would alert authorities to those who try to use the System for nefarious purposes. Neither a malicious attack nor an authorized employee abusing their credentials is likely to be caught in the act,” charges the report.

Other issues identified include inadequate SIEM technology, the lack of comprehensive security architecture documentation, the absence of penetration testing on the PHSA network, and potential weaknesses in endpoint security administration.

The report makes seven key recommendations:

  • implement and support an improved SIEM solution
  • produce and maintain comprehensive, auditable security architecture documentation
  • implement a vulnerability management solution
  • implement encryption to protect personal information
  • conduct pen testing at least annually
  • improve endpoint and desktop security
  • implement an identity access management solution

As a cautionary tale, McEvoy cites the 2021 cyber attack on Newfoundland and Labrador’s largest health authority, an incident that exposed the personal data of over 58,000 people and disrupted healthcare services for months.

“These impacts are serious, and we need to treat them seriously,” McEvoy says.

In response to the OIPC report, David Byres, President & CEO of the PHSA issued a brief statement outlining some of the security changes they have implemented recently, confirming that the “PHSA takes privacy very seriously and on behalf of patients, clients and families throughout British Columbia, we are continually taking steps to ensure that people’s sensitive and private information is secure and protected.”

The statement did not acknowledge the specific issues raised by the OIPC, only thanking the privacy watchdog for the report, and committing to “carefully reviewing the findings and continuing to ensure our databases are safe and secure for everyone we serve.”

healthcare security

Report: 90% of largest healthcare data breaches in 2022 involve third-party vendors

In a year-end analysis, Security Magazine explains that 90% of the 10 largest U.S. healthcare data breaches reported in 2022 could be traced to exposure created by third-party vendors. “The fallout for many of these cyberattacks resulted in impacts for multiple connected providers, with two of these vendor incidents affecting hundreds of providers,” the report explains.

“These incidents should serve as a warning to revisit third-party vendor relationships, ensure the entity is at least annually performing a review of vendors, and consider consolidating vendors where possible.”

Strengthening third-party and supply chain security can reduce the likelihood of a damaging cyber incident, and help protect patient and staff data.

NSA releases 2022 Year in Review report

On December 15, the National Security Agency (NSA) in the United States released their annual Year in Review. The report highlights some of the NSA’s key achievements in 2022, noting their success in collaborating with industry to harden billions of endpoints against active and ongoing nation-state threats, disclosing zero-day vulnerabilities, releasing cybersecurity guidance, setting new security standards, and delivering tools and technology to help all industries protect themselves against cyber attack.

Happy Holidays from ISA Cybersecurity CyberNews!

CyberNews will be on hiatus for the holidays, returning on Tuesday, January 3, 2023. All the best to you and your families for the season. Stay cyber safe!

Related Articles

Cookie Notice
We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Technology Partners

Thanks for reaching out, we’d love to hear from you. Fill out the form below and we’ll get back.

Become an Infinity Partner

Thank you for reaching out, we’d love to hear from you. Fill out the form below and we’ll get back to you within one business day.