I'm Mary Ann Kolbesak-McGee, executive editor at Information Security Media Group. Today I'm speaking with Denise Anderson, president of the Health Information Sharing and Analysis Center. We're going to be speaking about cyber threat concerns for the healthcare sector involving the war between Israel and the terrorist group Hamas. So, Denise, as we know, it's been less than a week now since the deadly surprise attack by Hamas on Israel.
Have any of your H-ISAC members in the U.S. or elsewhere been reporting or hearing of any cyber-related incidents potentially related to the conflict? Any examples? So right now, as of this moment, we're not seeing that, but definitely the potential is there.
And, of course, I first want to say that, you know, the events over there in the Middle East have been terrible, and we certainly are thinking of all of our friends and members in those locations. But obviously, this is a situation where they were taken by surprise. And I always preach that every company needs to be mindful of situations like this or any situation and how they can impact their organization. So, for example, you know, looking at it from a perspective of physical attack, being prepared for that.
And I'll touch on that a little bit later. But from the cyber side too, obviously, we're going to see, and there have been, there has been a little bit of noise where, you know, when any event happens, there's opportunistic threat actors who try to do things with phishing attempts. We've also seen, we broke a huge vulnerability this week through our partners that shared that with us, and then we were able to get it out to our members and a couple other ISACs did that as well for their memberships, which is around a distributed denial of service attack, DDOS attack, vulnerability, which I'm sure some threat actors, you know, will definitely be looking at to take advantage of. And, of course, we've been seeing hacktivist type of activity.
We saw that with Ukraine and Russia with Killnet back earlier in the year in January, February, where they went after hospitals. So certainly, we can see that kind of scenario happen here in the U.S. and in Europe. So, Denise, with that said, what sorts of healthcare and public health sector entities might be at higher risk for hacktivism, any sort of incident, whether it's DDOS or maybe even something even more malicious, and why, and what should these entities be doing at this point?
Certainly hospitals. You know, who would have thought earlier in the year that hospitals in the U.S. and Europe would be seeing attacks because of the Ukraine-Russia situation? And they were.
They got DDOS attacks through the hack of this group Killnet. And so, you know, that's certainly plausible here in the U.S. Obviously, we're seeing New York ramping up today because of threats. So we know that that is certainly a very viable situation.
And so hospitals definitely, any organizations that have ties to companies in Israel or, you know, pharmaceutical firms that have business in Israel or certainly medical device manufacturers. So, you know, anybody could be a potential target. And Denise, you mentioned tech companies in Israel. And, you know, as we all know, there are many cybersecurity, IT, medical tech companies that are based in Israel that U.S.
companies, including healthcare sector organizations, depend upon. What sort of impact might the situation in Israel have on healthcare sector entities as consumers of these cyber and other products? And what's your advice to them? You mentioned earlier about the physical aspect.
Yeah, so this is definitely a big piece of situational awareness. So being aware of your supply chain, where it comes from, and how it can be impacted. As you stated, there are a lot of security firms, software, hardware firms over there in Israel. And, you know, if the war becomes prolonged, that could have an impact on their ability to support their infrastructure.
So that certainly is a concern. If people are relying on medical devices or pharmaceutical products or other types of supplies coming out of that area, obviously that's something that they need to be mindful of as well. We've certainly seen this in other situations, both physical and cyber. For example, back when Hurricane Maria hit Puerto Rico and there was an IV bag shortage as a result.
So definitely something that the companies need to be very mindful of. So you mentioned a few moments ago about the Killnet DDoS attacks. And as we know, in the early days of the Russia-Ukraine war, there was a lot of concern about potential cyber attacks on the critical infrastructure on the U.S. and elsewhere motivated by that conflict.
Thankfully, for the most part, the worst of those fears have not materialized, at least not yet. Any cybersecurity lessons from the Russia-Ukraine war so far that you think could potentially apply now for how the Israel situation might play out in terms of the healthcare sector and other sectors when it relates to cyber preparedness? I think there's always that possibility. So obviously the DDoS attacks are certainly a concern for hacktivists.
We've certainly seen a lot of noise around the fact of people on either side of the conflict. And we can see that. We've seen some noise with Anonymous Sudan, who was affiliated with Killnet, making some noise about the conflict and anti-Israel. So that's certainly a concern.
Then, you know, I didn't get into the physical side earlier, but obviously another thing to be concerned about are protests, how they can impact hospitals. We've certainly seen a huge increase in workplace violence within hospitals. And I promised I was going to touch on that later. We're seeing some laws now on the books.
So California just passed one that by July of 2024, hospitals are going to have to have a workplace violence prevention plan or incident response plan in place. And there's a law being debated right now in Texas around that as well. So we're going to see a lot of activity in the workplace violence space. And Denise, when it comes to potential hacktivism, DDoS, also phishing that's sort of tied to the conflict there, what should entities be looking for right now that might be sort of a heads-up that, you know, they're being either targeted or they could fall victim to any of those sorts of incidents that maybe, you know, signs of things that maybe they wouldn't have looked for, you know, had this Middle Eastern crisis not exploded this way?
Well, we actually just had a webinar this week that we held where we were part of a coordinated disclosure or responsible disclosure from Cloudflare and Google around a major vulnerability that can cause DDoS. And DDoS at the levels that haven't been seen before, just because of the nature of the vulnerability and what it impacts within the infrastructure or the internet connections. So that certainly is a concern. There's not much that can be done internally.
I think a lot of it is having a DDoS or distributed denial of service mitigation plan. And there's certainly a number of lessons learned from many of the DDoS attacks we've seen, some of mine from my experience with the finance sector back in 2012, 2013. So having great relationships already in place with mitigation providers against DDoS, making sure you have more than one relationship in place because sometimes, especially if, you know, as we're seeing the volumes increase, that that's certainly a concern. And, you know, if the whole body of organizations are seeing DDoS all at once, obviously the suppliers of mitigation services are then impacted as well.
So that's always good to have more than one relationship in place. Have a plan. Have an incident response plan. Another one is to know your baseline traffic.
So know what your normal internet traffic connections are. And if you're starting to see anomalies, then you can address them very quickly. So now, Denise, it's still early on, but it appears so far that the attack on Israel represents a major intelligence failure, not only for Israel, but also for the U.S. and its allies that, you know, depend on this sort of, you know, national security-related intelligence.
What do you make of this? For instance, we know how critical the sharing and analysis is for cyber threat intelligence in terms of defending against cyber attacks. So are there any early or emerging potential intelligence lessons or caveats that you see in the Israel situation that could also apply to cyber intelligence and the sharing of that intelligence information at large? Any lessons or mistakes or, you know, what do you see here?
Right now, there's a lot of misinformation. You're hearing things like one party knew, then the next minute you hear that they didn't know. So I think it all needs to be sorted out. And that's always what happens when a big incident breaks.
We certainly saw this with Petra not Petra. A lot of misinformation happens at first because people are trying to figure out what the real story is. So that, number one, is making sure that you have the real story. But number two, having a good, basic, solid response plan in place for multiple scenarios will protect an organization.
Obviously, organizations don't necessarily have access to certain types of intelligence because usually that's done at the government level. But on the cyber side, they certainly can see things within their infrastructure. And, you know, obviously a lot of the telco, internet, and other software security suppliers have some insights within their infrastructure because they're serving numerous clients. And so they can get a big picture.
So being able to share anomalies that they're detecting, threats that they're seeing, and then helping companies understand what they need to do to mitigate against that or protect themselves is, I think, extremely important. And the more we can do that, the better off everyone will be. And finally, Denise, anything else that you, you know, strongly suggest that healthcare and public healthcare sector organizations in the U.S., but also outside the U.S., do right now just to be better prepared