According to the American Hospital Association (AHA), the Cybersecurity and Infrastructure Security Agency (CISA)—a component within the U.S. Department of Homeland Security—published guidance on Aug. 21 concerning best practices for so-called “event logging” of possible or definite security concerns in order to mitigate cyberthreats. The document containing this guidance was developed with help of the FBI, the National Security Agency and multiple international cybersecurity agencies. The guide provides recommendations designed to “improve organizational resilience in the current cyberthreat environment,” according to the AHA.
The executive summary of the CISA guidance broadly defines event logging and provides a synopsis of what it should entail. According to the document, event logging supports the continued delivery of operations and improves the security and resilience of critical systems by enabling network visibility. So, pay attention: visibility is the key component in event logging! The guidance goes on to make recommendations that improve an organization’s resilience in the current cyberthreat environment and takes into consideration resource constraints. The CISA guidance is of “moderate technical complexity” and assumes a basic understanding of event logging. So, in other words, it should be relatively digestible to the average hospital security/IT supervisor.
So, at this point, it may be helpful to get into some specifics. According to the new guidelines, an effective and comprehensive event logging solution aims to accomplish the following:
- Send alerts to the network defenders responsible for monitoring when cybersecurity events such as critical software configuration changes are made or new software solutions are deployed.
- Identify cybersecurity events that may indicate a cybersecurity incident, such as malicious actors employing living-off-the-land (LOTL) techniques or lateral movement post-compromise.
- Support incident response by revealing the scope and extent of a compromise.
- Monitor account compliance with organizational policies.
- Reduce alert noise, saving on costs associated with storage and query time.
- Enable network defenders to make agile and informed decisions based on prioritization of alerts and analytics.
- Ensure logs and the logging platforms are useable and performant for analysts.
CISA says there are four key factors to consider when pursuing logging best practices: (a) enterprise-approved event logging policy, (b) centralized event log access and correlation, (c) secure storage and event log integrity, and (d) detection strategy for relevant threats.
In commenting on the new CISA security guidance, Scott Gee, AHA deputy national advisor for cybersecurity and risk, wrote the following:
In the current cyberthreat environment, understanding your network and everything attached to it is critical. Quality log data helps in building a comprehensive picture of your environment, drives detection and alerting systems to discover issues quickly, and helps incident responders understand what went wrong if you do suffer a cybersecurity incident. This document provides guidance on implementing an event logging policy focused on capturing high-quality cyber security events to aid network defenders in correctly identifying cyber security incidents. Ideally, logs should be stored for a period of one year, subject to storage space constraints. In the middle of an incident is not the time to find out that you were not logging useful data, or that you were not retaining that data for long enough to thoroughly investigate the incident. Within the past year, Microsoft has added additional free log storage for several of their service tiers. The field is reminded that rural hospitals are eligible for free and heavily discounted Microsoft services.
For more information on the new CISA security guidelines, please click on the following link: Best practices for event logging and threat detection (cyber.gov.au).
Ultimately, it’s up to hospital decisionmakers and security and IT team members to take this guidance and put it into practice. Doing so may not be as iconic as stepping into a phone booth or sending out the bat signal, but it can make a significant difference in the safeguarding of hospital operations and patients’ private information. In the immortal words of Davie Bowie, “We can be heroes, if just for one day.”