Membership Services
Trusted Healthcare and Public Health Cybersecurity Critical Infrastructure Protection
The nation’s healthcare and public health critical infrastructure protection is a public/private responsibility from the Executive Board Room to Finance, Legal, Regulatory Compliance, Information Technology, HR, Medical Informatics, Medical Staff, Pharmacy, Medical Devices, Patient Services, Records Management, Physical Facilities, Suppliers, etc.
Trusted, timely and actionable cyber intelligence, situational awareness (threat and vulnerability monitoring), countermeasure solutions, incident response, best practice and education are essential to defend patient data and protect healthcare and public health critical infrastructures.
H-ISAC Member Secure Portal
The H-ISAC Secure Portal provides members access to a secure information exchange infrastructure including: Business and Technology Best Practice, Standards and Regulatory Compliance Guidance, Risk Management, Sector Collaboration, Technical Information, Governing for Enterprise Security, White Papers, Discussion Boards, H-ISAC and Member-Generated Surveys, access to security education (free and discounted education programs), etc.
Healthcare & Public Health Cybersecurity Advisory Reports
U.S. Department of Homeland Security Daily Open Infrastructure Reports and Report Archive, US-CERT Cybersecurity Alerts
H-ISAC Cybersecurity Daily Advisory Report and Report Archive
Provided via the H-ISAC Member Secure Portal, H-ISAC Member Cybersecurity Advisories contain sector-specific analyzed alert data (subject, overview, systems affected, sector risk, description, resolution recommendations, references) including 24/7 access to H-ISAC security analysts.
Business and Technology Security Solutions Consulting – Best Practice
H-ISAC understands health IT information systems and cybersecurity. Just one successful cyber terrorist attack can have cascading impacts to organizational and national critical infrastructures. Keeping up with cyber threats and vulnerabilities while managing and implementing business, technology, and cybersecurity protection policies and information are the leading challenges for both the public and private sector. Managing the complexity of security and preventing breaches are the biggest network challenges organizations face. As a member of your team, H-ISAC can provide your organization with access to a proven national network of cybersecurity business, technology , and education expertise.
Cybersecurity Exercises
With cybersecurity attacks escalating against the nation’s critical infrastructures, cybersecurity exercises are a strategic way for an organization to detect and respond to information security threats and vulnerabilities in real-time. Exercises should focus on testing policy adherence, establishing working emergency management and response relationships, and awareness of forensics. In collaboration with the National Council of ISACs, H-ISAC participates on national cybersecurity exercises (US DHS Cyber Storm). H-ISAC holds annual regional and national cybersecurity exercises. H-ISAC’s Security team is also available to help design, develop and implement customized cybersecurity exercises for your organization.
IP and Domain Range Monitoring
Account Compromises, publicly posted data dumps, end users unknowingly participating in active botnets; these types of threats are known issues any organization will need to combat. Thankfully, the H-ISAC can offer IP and Domain Range monitoring, as part of the H-ISAC membership. A member organization can submit their publicly available domains and IP addresses to the H-ISAC and we then watch for any issues, immediately notifying the member of the issue.
H-ISAC Member Working Groups
The H-ISAC has a number of working groups in which a member organization may participate, and also may create their own working group. Currently members can join:
H-ISAC Big Data Working Group
The H-ISAC Big Data Controls Working Group provides a forum for individuals working in the healthcare industry to share lessons learned regarding the challenges and opportunities associated with big data systems. The working group seeks to identify information control best practices for big data systems and also identify data analytics best practices for security and business applications. Meetings are designed to provide an opportunity to learn about the different tools and techniques that have proven effective in our different environments.
Emergent Healthcare Identity and Authentication
The EHIA will establish expectations for functionality of healthcare identity and authentication with the H-ISAC membership and identify industry activities that are furthering this work. Overlapping, conflicting or missing capabilities will be tracked. The H-ISAC and membership will then identify opportunities to influence activities to create a more harmonized model. We will align with the goals of the 2011 Presidential Directive for a National Strategy for Trusted Identities in Cyberspace (NSTIC).
Privileged User Management Working Group
Organizations can face significant security exposure in everyday events. For example, privileged user management is not a part of the overall Healthcare ecosystem. Hundreds of system administrators potentially share passwords for privileged accounts on devices. When a systemadministrator leaves the company or moves to another department, there is not an initiative to change passwords for the shared accounts or devices that were used. This can leave an organization vulnerable to attacks by the former employees, contractors, or potential hackers who fall upon the information.
H-ISAC T.I.P. Working Group
TIP Working Group (TIP WG) specializes in defining best ways to share threat intelligence through existing platforms such as Bright Point Security (formerly known as Vorstack) as well as identifying new platforms that would be beneficial for H-ISAC members. TIP WG will provide help and assistance for new members of H-ISAC to integrate their respective log management solutions into Threat Intelligence Platform. The group will create a set of documents on how to integrate into TIP, properly share threat intelligence between members of H-ISAC, and provide recommendations on best and most effective ways to utilize Threat Intelligence Platform available to H-ISAC members.