CSIRT Capabilities in Healthcare Sector

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustw orthiness of ICT products, services and processes w ith cybersecurity certification schemes, cooperates w ith Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow . Through know ledge sharing, capacity building and aw areness raising, the Agency w orks together w ith its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its w ork can be found here: w w w.enisa.europa.eu.

CONTACT

For contacting the authors, please use etl@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

EDITORS

Adrian A. Baumann, ENISA Apostolos Malatras, ENISA Edgars Taurins, ENISA

LEGAL NOTICE

Notice must be taken that this publication represents the view s and interpretations of ENISA, unless stated otherw ise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881.

This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external w ebsites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknow ledged.

Catalogue number: TP-07-21-067-EN-N – ISBN: 978-92-9204-542-5 – DOI: 10.2824/201143

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

TABLE OF CONTENTS

EXECUTIVE SUMMARY 3 LIST OF ABBREVIATIONS 5 1. OVERVIEW AND SCOPE OF THE STUDY 6

1.1 CONT EXT OF T HE ST UDY 6

1.2 OBJECTIV ES OF T HE ST UDY 7

2. METHODOLOGY AND DATA COLLECTION 8

2.1 OV ERVIEW OF T HE M ET HODOLOGY 8

3. KEY FINDINGS 10

3.1 IRC SET- UP A ND LA NDSCA PE 10

3.2 CREATION OF SECTORAL CSIRT S 15

3.3 CSIRTS SERVIC ES 19

3.4 IR T OOLS A ND PROC EDUR ES 22

3.5 IR MAT URITY DEV EL OPM ENT 26

3.6 CSIRTS C HALL ENGES A ND GA PS 28

3.7 CSIRTS L ESSONS L EA RNED 30

4. RECOMMENDATIONS 31

4.1 INT RODUCTION 31

4.2 REC OMMENDATION 1: ENHA NC E A ND FA CILITAT E T HE C REATION OF HEALT H SECT ORAL C SI RTS 31

4.3 RECOMMENDATION 2: CAPITALISE ON THE EXPERTISE OF THE HEALTH CSIRTS FOR HELPING

OESS DEV EL OP T HEIR I R CAPA BILITIES 31

4.4 REC OMMENDATION 3: EM POWER HEALTH CSIRT S ROL E ON INFORMATION SHA RING ACTIVITIES 32

5. BIBLIOGRAPHY 33 A ANNEX: SURVEY – QUESTIONNAIRE 37 CSIRT CAPABILITIES IN HEALTHCARE SECTOR

EXECUTIVE SUMMARY

In recent years, digitalisation has turned everything into something connected and smarter. How ever, w hile creating numerous opportunities for the European economy and society, technologies bring forw ard several new challenges. According to a recent study , cyber threats increase year over year, as the popularity of emerging technologies, such as Internet of Things (IoT), Artificial Intelligence (AI), big data, the large use of cloud computing, as w ell as connected devices, provide copious w ays to invade an organisation.

An attack directed at a critical infrastructure, such as a hospital, can lead to physical damages and put the lives of patients at risk . Therefore, there is a need for solid Incident Response Capabilities (IRC) in the health sector, in particular health care settings (including hospitals and private clinics). This sector indeed faces threats along its entire supply chain w ith potentially disastrous societal consequences for a multiplicity of stakeholders (citizens, public authorities, regulators, professional associations, large industries, SMEs), w hich become even more vulnerable in the context of the Covid-19 pandemic.

This report focuses on sectoral CSIRT capabilities status and development w ithin the health sector since the implementation of the NIS Directive. The aim of the report is to offer insights on current incident response (IR) trends in order to draw practical recommendations about the development of IR capabilities in the health sector.

KEY FINDING

Based on a methodological approach, a series of findings is identified, as follow s:

Key Finding #1 The main entity in charge of Incident Response in the health sector are National CSIRTs. Health Sectoral CSIRTs are still an exception across Member States. How ever, there is a strong trend in developing sectorw ide CSIRTs collaborations, w hich include, but are not limited, to information sharing.

Key Finding #2 The creation of sector-specific IRC in the health sector appears to be the result of the lack of sector-specific know ledge of the National CSIRT, as w ell as lesson learned from past incidents, and the implementation of the NIS Directive.

Key Finding #3 National Health Sectoral CSIRTs tend to provide services more adapted to the sector’s specificities and needs in addition to the generic services provided by National CSIRTs.

Key Finding #4 According to the respondents to the survey, the main resources and tools in place to support the development of constituents’ IRC in the health sector are shared framew orks for incident classification and threat modelling, training and education activities and a netw ork of IR actors.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Key Finding #5 This study found out that the key forces driving CSIRTs’ IR development are sector-specific clarifications on the security requirements and responsibilities of the organisations, and the exchange of IR related information.

Key Finding #6 When it comes dow n to IR, this study found out that the main challenges faced by the health CSIRTs are the lack of security culture among operators of essential services (OESs), the fact that management (and the security) of OESs IT infrastructure is often outsourced, and the lack of established cooperation tools and channels w ith OES incident response teams.

The study m akes the follow ing recommendations:

• Enhance and facilitate the creation of healthcare sectoral CSIRTs. • Capitalise on the expertise of the healthcare CSIRTs for helping Operators of Essential Services (OESs) develop their IR capabilities. • Empow er healthcare CSIRTs role on information sharing activities.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

LIST OF ABBREVIATIONS

AEDs Vital providers and providers of essential services ANSSI National Agency for the Security of Information Systems CCB Cyber Security Belgium CERT Computer Emergency Response Team CII National Critical Information Infrastructure CSIRT Computer Security Incident Response Teams DSP Digital Service Providers EFTA European Free Trade Association ENISA European Union Agency for Cybersecurity ICT Information and Communication Technology IOC Indicators of Compromise IoT Internet of Things IR Incident Response IRC Incident Response Capabilities IT Information Technology MISP Malw are Information Sharing Platform and Threat Sharing NCSC National Cyber Security Center OES Operators of Essential Services SOP Standard Operating Procedure TTP Tactics, Techniques, and Procedures

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

1. OVERVIEW AND SCOPE OF THE STUDY

1.1 CONTEXT OF THE STUDY

The volum e and intensity of cyberattacks on the health sector increased in 2020 (e.g., 5 6 Ryuk ransomw are ; shut dow n of the UVM Health Netw ork ). Health care organisations in general and hospitals in particular have been a major target for cybercrime, primarily because of the value of data that can be obtained from an attack, as w ell as its disruptive impact .

The cyber threats are now increasingly visible to executive committees, boards, politicians and citizens. It is now mandatory for companies, governments, and citizens to think about and act upon cybersecurity . To face such threats, Member States and public and private entities must strengthen their Incident Response (IR) capabilities and the coordination betw een Computer Security Incident Response Teams (CSIRT).

As critical infrastructure and services, health care organisations, including hospitals and private clinics must be prepared to face such cy ber-attacks. Disruption of their services w ould lead to fundam ental im pact on both governm ents and populations.

Nevertheless, the number of highly technical-skilled cybersecurity experts is insufficient. To fill the gap betw een the demand and the human resources available, the public and the private sector have started to w ork together to create new training programmes and certifications for cybersecurity experts / IR experts. ENISA has also been w orking on the European Cybersecurity Skills Framew ork . These new experts led to the multiplication of response teams (CSIRT) for both the public and the private sector.

Regarding this evolution of CSIRTs in the health sector, some new topics may emerge in w hich ENISA w ill be a key player. On one hand, ENISA supports the NIS Directive enforcement as the Secretariat of the CSIRT Netw ork, tasked to actively support the CSIRTs cooperation, provide the secretariat and active support for incident coordination upon request. ENISA also supports sectorial CSIRTs in the standardisation of exchanges and monitoring specific sectorial threats at national/European scale.

On the other hand, ENISA w orks to strengthen public and private relationships w ithin the health sector by building a trust circle at European scale. For example, by setting up a collaboration platform dedicated to EU Member States and fostering relevant information sharing and analysis initiatives Several R&D initiatives at team levels need to be steered at European level to foster cross-CSIRTs developments, at least w ith guidelines about IR/Threat Intelligence priorities for EU.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

In this context of rapid grow th of CSIRTs in Europe, this study supports ENISA and Member States tow ards a better understanding of sectorial CSIRTs and their current IR capabilities, on w hich they rely in case of major and systemic cyber-attack. The objectives of the study are explained in more detail in the follow ing section.

1.2 OBJECTIVES OF THE STUDY

This study aims to support the understanding of the status and development of sectoral healthcare CSIRTs across EU . The conclusions of the study should help ENISA and Member States to identify and draw conclusions about the developm ent of incident handling and response (IR) w ithin the health sector follow ing the implementation of the NIS Directive.

The study looks into potential gaps, overlaps and challenges in the services offered as w ell as in the procedures, processes and tools in place. More specifically the study provides an overview of the key factors facilitating or hindering the development of sectoral CSIRTs in this particular sector, as w ell as the specific resources and tools in place to support the development of IRC in the health sector.

The main objectives of this study are the follow ing:

• To collect data on the current IRC in the health care sector; • To analyse gathered information to assess current sectorial capabilities, services, processes, tools and cooperation m echanisms; and • To draw conclusions and recom mendations based on the key aspects facilitating and or hindering IR procedures.

The study aimed to collect relevant information in order to provide the follow ing:

• Statistics of distribution of services offered to constituency by CSIRTs and other IR entities; • Analysis of the tools used (e.g., open source / commercial / homemade) and their distribution w ithin CSIRTs and other IR entities; • Analysis of the IR setup (e.g., central, distributed, hybrid, etc.) and the resources needed to provide services (e.g., number of resources, skillset, etc.); • Analysis of gaps and overlaps in services, processes, tools, resources, especially betw een CSIRTs and other IR entities w ithin the health sector; • Description of existing policies and guidelines applicable to IR; • Good practices and lesson learned; and • Conclusions and recommendations for the development of CSIRTs and other IR entities.

The study findings may also support ENISA w ith the delivery of the Output 8.2 of “ENISA single program ming docum ent 2021-2023” Activity 8: ‘Provide targeted as well as general reports, recommendations, analysis and other actions on future cybersecurity scenarios and threat landscapes (incident response landscape mapping for NIS Directive sectors)’.

To achieve the project objectives, a solid methodological approach w as proposed based on desktop research and an online questionnaire distributed to EU National CSIRTs and Sectoral CSIRTs as w ell as OES Incident Response Teams. The methodological approach is further explained under section 2.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

2. METHODOLOGY AND DATA COLLECTION

2.1 OVERVIEW OF THE M ETHODOLOGY

This Chapter describes the methodological approach taken for identifying, collecting and analysing data on IR development and capabilities in the health care sector.

2.1.1.1 Definition of the research focus for the data collection

The scope of the research and the focus for data collection w as mainly on the operational domain as outlined by ENISA based on current needs and previous w ork already conducted on IR. At this stage it w as also decided that the data collection methods w ould be mainly desktop research and an online survey.

2.1.1.2 Desktop research on the health sector IRC

A literature review w as conducted to investigate all aspects of IR responsibilities w ithin the health sector for CSIRTs and other entities in each EU Member State. The desktop research w as guided by the need to:

• identify the relevant bodies and/or organisations that play a role in the field of IR capabilities w ithin the health sector in the European Union; and • analyse the IR responsibilities of the different stakeholders, focusing on the operational aspects of IR.

While conducting desktop research w e review ed previous ENISA publications, policy documents, national strategies and other documents and reports made available by CSIRTs, National Cybersecurity Centres, and the European Commission. Additionally, studies carried out by technology research, strategic research companies, and academic researchers w ere consulted. The activities at this stage also included informal consultation w ith IR experts.

2.1.1.3 Designing and testing the online survey

Based on the categorisation of public available information, w e w ere able to identify gaps and additional information needed to be collected to complement desk research. As such, a questionnaire w as designed and made available online in order to collect relevant data on IR setup, and related services, procedures, processes and tools. The survey also covered the main enabling and hindering factors for establishing sectoral CSIRTs as w ell as the specific resources and tools in place to support the development of incident response capabilities (IRC) in the health sector.

Before being distributed to stakeholders the online questionnaire w as extensively tested to ensure that the questions addressed the study objectives and that they ar e clear, coherent, and covered all relevant aspects of IR capabilities in the health sector. The final version of the questionnaire is available in Annex A: Survey – questionnaire.

2.1.1.4 Conducting the survey

Upon validation, the questionnaire w as uploaded on EU Survey and the link w as distributed by ENISA to the members of the CSIRTs Netw ork (CNW), the CyCLONe Netw ork, and the NIS Cooperation Group. The survey included an introduction to the objectives of the study, instructions on how to respond to the questionnaire, and a privacy statement.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

The survey w as available online for four w eeks. ENISA follow ed-up w eekly w ith the targeted audience and sent reminders to the respondents to complete their contributions. A total of 15 responses w ere provided representing 12 Member States.

2.1.1.5 Analysis and identification of recom m endations

We performed an analysis of the raw data collected from the desktop research and the survey w hich w ere aggregated in a structured matrix. This preliminary analysis allow ed the mapping of the key findings of the study.

2.1.1.6 Final report

Final remarks and/or feedback from the pool of experts that w ere used to validate the study (the study w as distributed for validation to the same group of stakeholders to w hich the survey w as distributed) w ere incorporated in the final report.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

3. KEY FINDINGS

3.1 IRC SET-UP AND LANDSCAPE

The m ain entity in charge of incident response in the health sector are National CSIRTs. Health Sectoral CSIRTs are still an exception across Member States . How ever, there is a trend in developing sector-wide CSIRTs collaborations, w hich include, but are not lim ited, to inform ation sharing.

The results of desk research and the survey targeting relevant bodies and organisations that play a role in the field of incident response capabilities w ithin the EU health sector show s that:

• 22 out of 27 Member States have no Health Sectoral CSIRTs, but 2 have plans to create one in the near future; • 2 Member States are currently setting up a Health CSIRT at national level; and • 3 Member States have a Health Sectoral CSIRT at national level. Among these Health Sectoral CSIRT, 2 (CERT Santé and HealthNet) w ere created respectively by the French and Luxembourgish government; meanw hile, Z-CERT, the Dutch Health Sectoral CSIRT, w as developed specifically for institutions in the healthcare sector.

In addition to Z-CERT, the data collected highlight that an increasing number of sectoral CSIRTs is being created by operators of essential services . Evidence of this trend is HelseCER T, Norw ay health and care sector's national centre for cyber security . Although Norw ay is not a member of the European Union, HelseCERT is an interesting Health Sectoral CSIRT to mention among the CSIRTs operating in the European Free Trade Association (EFTA) countries.

Table 1 provides a summary of the sectoral IR layout and set-up at European level in the health sector .

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Table 1: Overview of all MS’ basic IR set-up in the health sector (w ith available data collected)

Presence of Sum m ary of national approach tow ards IR Developm ent Countries Health Sectoral in the health sector status CSIRT

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Presence of Sum m ary of national approach tow ards IR Developm ent Countries Health Sectoral in the health sector status CSIRT

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Presence of Sum m ary of national approach tow ards IR Developm ent Countries Health Sectoral in the health sector status CSIRT

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Presence of Sum m ary of national approach tow ards IR Developm ent Countries Health Sectoral in the health sector status CSIRT

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

As illustrated in Table 1, at national level, incident response set-up is structured around:

• IR services are provided by the national/governmental CSIRT in each EU Member State for all sectors, including the health sector. This applies in particular to countries w ith a centralised incident response model, w hich do not plan to develop specific sectoral CSIRT capabilities since IR tend to be managed by the OES and supervised by the National CSIRT or governmental CSIRT . • For three Member States, dedicated sectoral CSIRTs coordinate incident response at national level, supervised by the National CSIRT.

To conclude, it is w orth mentioning the existence of the Health Information Sharing and Analysis Centre (H-ISAC). H-ISAC is a global, non-profit, member-driven organisation offering health care stakeholders a trusted community and forum for coordinating, collaborating and sharing vital physical and cyber threat intelligence and best practices w ith each other . Launched in 2010 in the US, H-ISAC dropped its national focus in favour of an international one in 2018 . Now adays H-ISAC facilitates know ledge transfer across the w orld through educational summits, w ebinars, w orkshops and w hite papers, supporting in this w ay the exchange of information and the building of relationships that may contribute to make the health sector more resilient and proactive in the face of future cyberattacks.

H-ISAC is not an isolated initiative. There is a multiplication of ISACs and netw orks to foster information exchange and increase aw areness among stakeholders w ithin a sector, even for sectors than are not defined in the NIS Directive .

3.2 CREATION OF SECTORAL CSIRTS

The creation of sector -specific IR capacities in the health sector appears to be the result of the lack of sector -specific know ledge of the National CSIRT, as w ell as lessons learned from past incidents, and the im plem entation of the NIS Directive.

Figure 1 presents the findings of the survey (all respondents provided an answ er) in relation to the key reasons that motivated Member States to create sector -specific incident response capacities in the health sector.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Figure 1: Reasons to create sector-specific IR capacities

The need to overcome the lack of sector-specific know ledge or capacity of the National CSIRT appears to be the most relevant reason behind the creation of sector specific IR capacities (27% of responses). Similarly, ‘The difficulties in managing the cybersecurity incidents in the NIS Directive sectors’ (14% of responses), together w ith the ‘Lessons learned from past incidents’ (14% of responses), highlighted the need for sector-specific IR capacities in the health sector, according to the survey respondents .

How ever, the second most important reason w ith 18% of responses is the implementation of the NIS Directive. This confirms the ENISA finding related to the s ector-specific capabilities of the Energy and Air transport sectors : European legislation has an important and positive impact in pushing actors to develop sectoral capacities.

In particular, the survey respondents indicated that the NIS Directive had the follow ing impacts on their activity related to the creation of sectoral IR capacities :

• Provided additional financial support for security measures; • Changed the structures and architectures of the existing cybersecurity measures; and • Expanded the scope of CSIRTs’ responsibilities.

The expansion of the scope of the CSIRTs’ responsibilities, combined w ith the provision of additional financial support for new security measures, appear to have encouraged the creation of sector-specific IR capabilities.

Factors facilitating the developm ent of sectoral CSIRTs

As Figure 2 show s, apart from the main reasons that lead to the creation of sectoral CSIRTs and/or incident response capacities, there are also key factors facilitating their development.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Figure 2: Factors facilitating the development of sectoral CSIRTs

According to the survey respondents, the main enabling factors are the follow ing :

• The dissem ination of threat intelligence, exchange of good practice and lessons learned (19% of responses): There is an emerging trend in w hich actors, and CSIRTs in the same sector go beyond information sharing to organise IRC . Sectoral actors make use of existing reporting schemes such as the NIS Directive reporting and build trusted sectoral communities of users, w hich can securely exchange both ex -ante and ex-post incident information leveraging existing tools and automated solutions .

• The establishm ent of sector-specific regulations clarifying the security requirements and responsibilities (17% of responses): Sector specific regulations, including guidelines and requirements for reporting and management of incidents, tend to act as a key driver to enhance capabilities at the sectoral level . An example of sectoral regulation is Regulation (EU) 2017/745 on medical devices (MDR) , w hich bound manufacturers of medical devices to consider cybersecurity risks w hen placing product in the market.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

• The establishm ent of cooperation agreement between national and sectoral actors (13% of responses) : The support of National CSIRTs and other Sectoral CSIRTs to the development of Health Sectoral CSIRTs and capabilities tends to be of great added value because it capitalises on existing expertise. Sectoral actors can benefit from the experience and know ledge of National and other Sectoral CSIRTs, for instance, through the appointment of a liaison officer, sharing of know -how , expert advice or tailored training. A notew orthy initiative, pre-dating the NIS Directive, is that of the Dutch NCSC, w hich provided incentives and guidelines to support the creation of CERTs .

• The establishm ent of public-private partnership (11% of responses): Public-private partnerships are also a tendency in some Member States, as they play a key role in certain IR related activities. For instance, they can encourage the sharing of lessons learned on the use of open-access or commercial tools, especially those automated w ithin a specific sector to better benefit from each other’s experience and accelerate the maturation of new ly created IR entities. How ever, desk research indicated that among all the tasks under the scope of the CSIRTs, establishing cooperation relationships w ith the private sector w as one of the tasks w ith the least allocated time .

Overall, from Figure 2, it appears that a blend of bottom up and top dow n incentives could lead the w ay to the creation of sectoral CSIRTS and IR capabilities. Funding and the guidance of National CSIRTs are as important as the cooperation and infor mation sharing across sectoral actors for the development of Sectoral CSIRTs .

Table 2 presents the reasons and enabling factors that lead to the creation of a Health Sectoral CSIRT in the Netherlands.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Table 2: Case Study – Creation of the Z-CERT (The Netherlands)

Case study - The Netherlands

The Z-CERT w as founded in 2017 by a group of Dutch hospitals, to help health care institutions w ith cyber security protection and incident support. In 2017, all Dutch hospitals had show n to have vulnerabilities in their systems. The most prominent risks w ere configuration errors and w ebsites running on outdated softw are . Z-CERT w as founded to overcome these IR w eaknesses and provide specialised IR services to health care institutions. Z -CERT and National Cyber Security Centre (NCSC) w ork together by sharing relevant information and data. Today all hospitals (ranging from academic “UMCs”, top clinical “STZ” to “General” hospitals) as w ell as mental health care institutions ("GGZ") can register w ith Z -CERT as a participant to the Health Sectoral CSIRT constituency, and can, therefore, benefit from Z-CERT cyber security protection and IR support and know ledge. It appears that the responsibilities and services of Z-CERT w ill be expanded in the near future. COVID-19-related developments have accelerated Z-CERTs plans to implement Cyber Threat Intelligence Capability as w ell as other projects to enhance the digital resilience of the Dutch Health Care .

Sources

https://w w w .z-cert.nl/english/ https://w w w .cybersprint.com/new s/cybersprints -study-leads-to-national-investigation-into-Health cares-cyber-security/ https://w w w .thehaguesecuritydelta.com/partners/partner/663-z-cert https://w w w .prnew sw ire.com/new s-releases/z-cert-and-eclecticiq-cooperate-to-bring-benefits-ofcti-to-dutch-Health care-sector-301073185.html

The main reasons that seem to have led to the creation of Z-CERT is that Dutch hospitals had show n to have vulnerabilities in their systems . NCSC w as only allow ed by law to provide services to operators of essential and vital services, as w ell to the central government. Therefore, w ithout Z-CERT, the Dutch health care w ould not have access to relevant threat intelligence, w hich w ere particularly in face of the increasing number of cyber attacked against the health sector.

3.3 CSIRTS SERVICES

Health Sectoral CSIRTs tend to provide services m ore adapted to the sector’s

specificities and needs in addition to the generic services provided by Nation al CSIRTs.

Depending on their mandate, Health Sectoral CSIRTs appear to offer the same kind of services as the National CSIRTs. How ever, Health Sectoral CSIRTs seem to provide services that are more fitted to the specificities of the health sector.

According to the information gathered through the survey , in comparison to National CSIRTs, the Health Sectoral CSIRT provide the follow ing services, roles or functions:

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

• Specialised services to handle sector-specific threats, vulnerabilities and incidents; • Specific know ledge and expertise on medical devices, medical IT systems, as w ell as threats and incidents related to the health sector; • Providing sectoral expertise to the National CSIRT; • Assisting nonregulated operators in the health sector on incident response; • Coordination for multi-site compromised systems in the health sector; and • Vulnerability coordination w ith vendors of sector-specific systems / devices.

Overall, survey respondents believe that sectoral CSIRTs may offer deeper and more specialised know ledge on sector-specific threats and operational technology, as w ell as broader netw orking w ith sectoral bodies and organisations. Evidently, this observation also depends on the scale and capabilities of the national CSIRT.

Considerations on proactive approach to incident response in the health sector

Incident response in the health sector tends to be often reactive, i.e. aimed at responding to threats or attacks against the CSIRT’s systems, rather than proactive, i.e. aimed at preventing incidents and reduce their negative impact w hen they do occur. This reactive nature appears to be due to an insufficient communication and collaboration across different stakeholders of the vulnerability ecosystem (national/sectoral CSIRTs, end clients, Operators of Es sential Services) . To improve the current coordinated IRC to counteract threats, despite their reactive nature and responsibilities, sectoral CSIRTs may be an important player. Sectoral CSIRTs are indeed w ell placed to facilitate and encourage a more proactive approach to incident response, as they seem to have in-depth know ledge and close relationships w ith the main sectoral stakeholders at national level. They could also support the streamlining of information sharing, especially w ith OESs, w hich w ould highly benefit from guidance, for instance, in the form of guidelines and trainings, and exchange of know ledge and expertise .

Table 3 show s the services provided by the Health Sectoral CSIRTs in the Netherlands in comparison w ith the National CSIRTs. The services are presented per service categories according to the FIRST CSIRT Services Framew ork . The service categories considered are the follow ing:

1. Inform ation security event m anagement: This category includes monitoring, detection and event analysis services. 2. Inform ation security incident m anagement: This category refers to services, such as information security incident report acceptance, information security incident analysis, artifact and forensic evidence analysis, mitigation and recovery procedures, information security incident coordination, and crisis management support. 3. Vulnerability m anagem ent: These services encompass vulnerability discovery / research, vulnerability report intake, vulnerability analysis, vulnerability coordination, vulnerability disclosure, and lastly, vulnerability response. 4. Situational aw areness: This category consists of the follow ing subtypes: analysis and synthesis and communication. 5. Know ledge transfer: It involves aw areness building, training and education, exercises, technical and policy advisory.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Table 3: Case Study – Z-CERT - Specific mandate and services compared w ith those the National CSIRT

Case study – The Netherlands

National CSIRT’s m andate Health Sectoral CSIRT’s m andate (Z-CERT)

The NCSC is the competent national authority for Z-CERT offers specialised services to health care the implementation of the Netw ork and Information institutions w ith regards to optimal cyber security Systems Security Act (Wbni), w hich has been in protection and offers support in case an incident force since 9 November 2018. The Wbni regulates has occurred. Z-CERT has in-depth know ledge of the statutory tasks of the NCSC in the field of medical applications, medical netw orks and cybersecurity. Organisations in vital sectors are medical devices. obliged to report serious digital security incidents to the NCSC. Under the Wbni, the NCSC is the designated CSIRT for vital providers and providers of essential services (AEDs).

National CSIRT’s services Health Sectoral CSIRT’s services

Under the Wbni, the services offered by the NCSC Inform ation Security Event Managem ent include: - Sending out alerts regarding possible threats and Inform ation Security Event Managem ent current attacks. - Monitoring incidents at national level, w arning - Checking periodically participants’ IP addresses providers early and disseminating information about and domain names for multiple blacklists (viruses, risks and incidents. w orms, botnets, etc.).

Inform ation Security Incident Managem ent Inform ation Security Incident Managem ent

- Carrying out analyses and technical investigations - Conducting forensic research into the Modus into threats and incidents. Operandi, in order to minimize technical and financial damage as w ell as any reputation risk.

Vulnerability Managem ent Vulnerability Managem ent

- Responding to incidents that are reported voluntarily or mandatorily and assist AEDs and parts - Immediately informing the participant(s) and offer of central government in taking measures to advice in case viruses, w orms, and botnets. guarantee the continuity of their services. - Offering advice on the approach and best Situational aw areness resolution method of the incident. - Maintaining cooperative contacts w ith the private Situational Aw areness sector. - Informing its participants of any vulnerabilities Know ledge Transfer detected in medical devices, medical netw orks and medical applications. - Sharing information w ith organisations tasked w ith informing other organisations or the public about Know ledge Transfer threats and incidents, and computer crisis teams. - Sharing know ledge w ith its participants. - Facilitating meetings for its participants, as w ell as hosts netw ork events and theme sessions.

Sources

https://w w w .z-cert.nl/english/ https://w w w .ncsc.nl/over-ncsc/w ettelijke-taak

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

The Dutch case seems to confirm the opinion of survey respondents and the desk research findings:

• Z-CERT appears to have specific know ledge of the risks and threats targeting the health sector, and is, therefore, better placed to inform sectoral operators of any vulnerabilities detected and provide advice on how best to deal w ith the situation. • In addition, as Z-CERT w orks on a smaller perimeter than the National CSIRTs, it can also invest m ore on proactive services, such as sending out alerts and publishing w hite papers regarding possible threats and attacks. • Lastly, Z-CERT appear to have m ore direct contact w ith sectoral operators, w hich can, for instance, participle to Z-CERT netw orks events and theme sessions.

3.4 IR TOOLS AND PROCEDURES

According to the respondents, the m ain resources and tools in place to support the developm ent of constituents’ IRC in the health sector are shared fram eworks for incident

classification and threat m odelling, training and education activities and a netw ork of incident response actors.

As per the article 9 of the NIS Directive, CSIRTs are responsible for risk and incident handling in accordance w ith w ell-defined process, supported by the adequate resources.

3.4.1 Tools

There are 5 different types of possible tools according to the service they offer w ithin the scope of CSIRTs’ responsibilities:

1. Inform ation security event m anagement tools. This type includes monitoring, detection and event analysis tools. 2. Inform ation security incident m anagement tools. This area involves tools and procedures such as information security incident report acceptance, information security incident analysis, artifact and forensic evidence analysis, mitigation and recovery procedures, information security incident coordination, and crisis management support. 3. Vulnerability m anagem ent tools. These services encompass vulnerability discovery / research, vulnerability report intake, vulnerability analysis, vulnerability coordination, vulnerability disclosure, and lastly, vulnerability response. 4. Situational aw areness tools. This category consists of the follow ing subtypes: analysis and synthesis and communication. 5. Know ledge transfertools. It involves aw areness building, training and education, exercises, technical and policy advisory tools.

The analysis of the CSIRTs through the survey offered the follow ing perspectives:

• On average, half of the respondents indicated that there is a tool operating for each of the service (see Table 4 below ). • In the cases w here there is not a tool in place, there is a plan to implement one quarter of the cases. • Notably, only the crisis management support services underscore compares to this trend (only 33% of organisations have a tool in place).

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Table 4: Uptake of tools per service/function

Planning to Service area and Services Tool in service im plem ent one

Service Area 1 – Inform ation security event Management

Monitoring and detection 60% 27% Event analysis 47% 33%

Service Area 2 - Inform ation security incident m anagem ent

Information security incident report 67% 7% acceptance Information security incident analysis 60% 27% Artifact and forensic evidence analysis 53% 20% Mitigation and recovery 47% 13% Information security incident coordination 60% 27% Crisis management support 33% 33%

Service Area 3 - Vulnerability m anagem ent

Vulnerability discovery / research 53% 27% Vulnerability report intake 47% 27% Vulnerability analysis 40% 27% Vulnerability coordination 47% 33% Vulnerability disclosure 40% 27% Vulnerability response 40% 13%

Service area 4 – Situational aw areness

Data acquisition 53% 27% Analysis and synthesis 47% 33% Communication 73% 13%

Service area 5 – Know ledge transfer

Aw areness building 53% 20% Training & Education 53% 20% Exercises 53% 20% Technical and policy advisory 47% 27%

Source: Survey for assessing incident response capabilities in the health sector, ENISA, June 2021. Q24: Which specific tools does your organisation rely on to conduct the follow ing services? (N=15).

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Furthermore, CSIRTs tools may be developed in-house, or a service/tool procured from vendors. As it w ill be mentioned in section 3.6 on CSIRTs Challenges and Gaps, the use of vendors’ solutions comes w ith its ow n specific challenges, such as the import of unforeseen vulnerabilities in the tool. They w ill require additional efforts (on top of those for in-house systems) for updates and patches to guarantee their safety/efficiency. Moreover, it is important to note that organisations that have few er resources are more likely to look at external tools. This may lead to some type of incidental standardisation of security practices impacting on the overall performance of externalised tools users.

When asked about the specific information exchange tools to enable the notification of incidents, the stakeholders pointed that the most common ones w ere secure emails, Malw are Information Sharing Platform and Threat Sharing (MISP) standard formats and technologies and special government secured netw orks. This also implies their reliance on internet access, obliging Health CSIRTs to have a minimum of tw o internet service providers or at least redundant physical connections. Moreover, the stakeholders pointed out that, in the majority of the cases, uptake by the National CSIRTs ensured the broader uptake of these tools and procedures by their constituents.

Finally, according to the survey responses, the main resources and tools in place to support the development of constituents’ IRC in the health sector are shared framew orks for incident classification and threat modelling (24% of responses), training and education activities (24%), and a netw ork of incident response actors at a national or sectoral level to exchange good practices about information exchange, capabilities, cooperation (20%).

Table 5: List of tools in service for the five service areas of CSIRTs

Service area Tool fam ily Com m ercial tools Free tools

Inform ation

security incident Response (SOARs) m anagem ent

Vulnerability m anagem ent

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Service area Tool fam ily Com m ercial tools Free tools

Service area 4 -

aw areness

Source: Survey for assessing incident response capabilities in the health sector, ENISA, June 2021. Q24: Which specific tools does your organisation rely on to conduct the follow ing services? (N=15).

3.4.2 Procedures

Beyond the existing types of tools in place, there are other variants that should be considered in the analysis to guarantee a successful handling of incidents. The clarity and availability of the procedures in place are key in the course of incident response; procedures for usage of the tools should be alw ays w ritten dow n.

For instance, after the collection of the incident reported, CSIRTs ought to define and apply some type of information classification . Follow ing the incident classification, there should be a formal document indicating the statistics on how the handled incidents are created and disclosed. Within this context, an over complicated or imprecise plan w ill deter a sw ift reaction to a cyberattack on an organisational level or prevent rising aw areness on potential vulnerabilities across the sector or cross border.

In this line, more than half of Health Sectoral CSIRTs offer clear procedures. In the consultation process carried out w ithin the scope of this study, the stakeholders stressed that their organisation had standard operating procedures (SOPs) that OESs’ teams should follow in case of incident in 67% of the cases. Moreover, 60% of respondents pointed that their organisation made use of an incident notification template, available to all constituents, w hile only 40% did not. In this context, according to the stakeholders consulted for this s tudy, the most recurrent types of information reported through the different tools are root causes (20% of the cases), the services affected (18% of the cases), and the description of the incident, w ith the indicators of compromise (IOCs) and the tactics, techniques, and procedures (TTPs) (in 16% of the cases). This information compilation is important, as the use of a template indicates how efficiently and easily the CSIRTs can categorise the information collected.

In relation to the incident response in cross-border crisis situations, w hile half of respondents (47%) declared that there are specific procedures to address cross -border incidents, there is not a clear trend on how those are dealt w ith: in some cases, there is a sectoral or national procedure, in other cases it is done through a third-party Point of Contact. Some of the specific

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

procedures mentioned by the respondents w ere the organisation of cross -border exercises or the participation of a representative of the other country in the crisis response processes.

Furthermore, these stakeholders stressed that in 60% of the cases, their CSIRTs had specific measures in place to inform the relevant actors (national authorities and OES) in neighbouring countries about an incident that may impact them; 47% percent w ould inform other stakeholders through a Point of Contact (a trusted third-party) w hile only 13% w ould rely on a direct contact (communicating w ith relevant actors using their direct contact information, w ithout going through an intermediary).

Notably, w hile these recommendations are universally applicable, each health CSIRT has specific needs, w hich should be reflected in the tailoring of their tools and procedures. For that reason, each team should have an in-house developer that takes into account the requirements and suggestions that emerge from the team through their experience. Moreover, procedures are dependent on w orkflow s. Thus, they should be designed consequently, for instance w ith one procedure that fits all incidents reported, or various procedures for different types of incidents.

Lastly, another key element to consider is the usage and maintenance of the CSIRTs solutions: tools and processes should be managed, tested, and updated in order to achieve full protection against attacks, as w ell as complementary training should be provided for the personnel w ho use them.

3.5 IR M ATURITY DEVELOPM ENT

This study found out that the key forces driving CSIRT’s IR developm ent are sectorspecific clarifications on the security requirements and respo nsibilities of the organisations, and the exchange of IR related inform ation.

The maturity of a CSIRT is defined as the measurement of its capability in terms of structure, people, processes, and technologies. Its capabilities must guarantee that the organisation can perform its activities and functions consistently, as w ell as being able to continuously develop these capabilities.

More in detail, ENISA has developed a maturity assessment model that can be used to evaluate the capabilities of CSIRTs. Based on this maturity model, there are three pillars that greatly influence the development of CSIRTs capabilities: the uninterrupted performance of tasks and procedures, a w orkplace culture of continuous improvement of the CSIRT’s capabilities (monitoring of tasks performance, for instance), and education and training continuously provided to the team (to educate and also update the teams expertise). In addition, it is key to put in place policies, procedures and w orkflows that support the team’s goals and tasks, polished through real life application. Lastly, these pillars may only be attainable if the CSIRT fills in the follow ing prerequisites: it must have been operating for a w hile, have sufficient budget and have a low turn-over rate of staff members.

CSIRTs maturity can be measured and classified in three levels:

• Basic Maturity Level: the CSIRT coordinates handling of incidents, has a minimum foundation in terms of their existence (mandate etc.), is easily reachable and has a basic incident handling process in place.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

• Interm ediate Maturity Level: the CSIRT coordinates the handling of incidents, and also allow s additional joint activities (like vulnerability handling), it has a mature foundation, w ith detail descriptions of all relevant tools, processes , and human aspects. • Advanced Maturity Level: the CSIRT coordinates the handling of incidents, w hile also reliably supports additional joint activities, such as sharing of threats and early -w arning data, vulnerability handling. This implies that the CSIRT has w ell described, approved, and actively assessed processes, tools, and human aspects.

The assessment model offers a clear image of a CSIRTs maturity. According to this model, the average health CSIRT has achieved the Basic Maturity level and is close to achieve the Intermediate level of maturity, only needing to formalise already existing procedures. Interestingly, more than 90 percent of all National CSIRTs or government teams w ith national scope reached the Basic Maturity level as w ell, according to the model, on average being close to reaching the Intermediate Maturity level.

In the frame of the ENISA model, reaching the basic maturity level implies that the CSIRT analysed is operational, w ith a basic functioning incident handling process in place, its contact information available to other teams, fully functional in its other responsibilities, its services are defined according to the RFC2350, and the team has reached an appropriate level of maturity. These features are essential requirements for capacity building, collaboration w ith other CSIRTs and to support the national landscape of CSIRT.

How ever, the consultation carried out for this study revealed that only 40% of Health CSIRTs use a specific CSIRT maturity assessment methodology to support the development of IRC w ithin their sector. Within the 40% of stakeholders that use a specific CSIRT maturity assessment methodology, the majority of them relied on the SIM3 model (Security Incident Management Maturity Model), and to a lesser degree, the National CSIRT maturity tool available in their country. All methodologies are seen as relevant to enhance the maturity of CSIRTs. Moreover, they pointed that the key factors facilitating the maturity development of Health CSIRTs and/or their IR capacities depend mainly on the follow ing:

• The establishment of sector-specific regulations clarifying the security requirements and responsibilities (18% of responses); • The dissemination of threat intelligence, exchange of good practice and lessons learned (16% of responses); and • To a lesser extent, the establishment of cooperation agreement betw een national and sectoral actors (13% of responses).

Unsurprisingly, the survey respondents explained that they seek specific support or guidance from external stakeholders to design and implement sectoral IR capacities in the majority of the cases, mainly through CSIRT communities/peers, national authorities, and industry players. Ultimately, both top-dow n and peer-to-peer support, in the form of training, tooling, and trus ted communication channels, is needed for CSIRTs to reach an intermediate level of maturity, w hich requires further w ork on the organisational, human, tooling and process parameters.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR 3.6 CSIRTS CHALLENGES AND GAPS

When it com es dow n to incident response, this study found out that the m ain challenges faced by the health CSIRTs are the lack of security culture am ong OESs, the fact that m anagem ent (and the security) of OESs IT infrastructure is often outsourced, and the lack of established cooperation tools and channels w ith OESs incident response team s.

3.6.1 OESs cybersecurity challenges

In general, health care operators face some specific complications in the realm of cybersecurity and IR, due to the nature of their services. Consequently, these barriers also impac t the w ork and efficiency of health CSIRTs in fulfilling their responsibilities. Below , the main challenges faced by health care providers are presented in more detail.

Equipm ent: legacy system s and lack of cybersecurity by design

Traditional sectors, including health care, are more vulnerable to cyberattacks health care operations and equipment have a long-lasting lifetime (15 years on average), they w ere not conventionally designed to deal w ith malicious acts from the beginning of the product life cycle , w hile at the same time the Information Technology cycles have continuously shorten in the past decades.

These have resulted in a constant grow ing number of vulnerabilities founded in digital device providers and hardw are manufacturers, forcing hospitals to update and adapt their systems in a very short span of time, accumulating vulnerabilities as a result of the IT layer obsolescence through their lifecycle. Hence, the pace of updates is quickly outrun by the pace of IT technology evolution. Moreover, this vendor dependence is accentuated by the IoT device adoption taking place in health care providers, leading to an endpoint complexity that expands greatly the areas that can be attacked. The fact that this array of devices is closely interconnected only exacerbates the risk and potential impact of the threats. At the same time, practitioners usually circumvent security in order to deliver better care to patients.

In this line, some recurrent problems are inappropriate encryption configurations, and the incapacity for safe health information sharing and exchange w ith third-party and cross-border partners (there are no sophisticated data security tools in the health industry).

Organisational com plexity m eets incident reporting

Closely linked to the previous section, organisational complexity challenges the cybersecurity of health providers. The large supply chain of the health care ecosystem involves many stakeholders, w hich leads to potential cascade effects in the middle of a crisis. Concretely, existing organisational silos as w ell as excessive disparities among members of the hospital are recurrent risks.

Moreover, the coordination of an incident response is highly affected by this complexity. In the course of an incident, overcomplicated response plans that involve many stakeholders delay the effectiveness of the procedure, as each team member is not alw ays aw are of their role in the process. As a result, the health sector tends to have a time lag betw een an attack and its detection.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Exchange of inform ation

This study found out there is a lack of exchange of information and best practices on a sectoral level and across countries. It is notew orthy to mention again the H-ISAC, as it facilitates know ledge transfer across the w orld through educational summits, w ebinars, w orkshops and w hite papers, supporting in this w ay the exchange of information and the building of relationships that may contribute to make the health sector more resilient and proactive in the face of future cyberattacks. How ever, w hile H-ISAC has shifted its focus tow ards an international approach in 2018 , effort is still needed to increase and maintain the exchange of information across health care stakeholders.

Lack of expertise

There is a lack of sufficiently skilled experts in the health care industry. In general IT security experts are hard to find, w hile dealing w ith an incident can be challenging if the team is not mature or does not know how to best use a tool. For instance, buying the most protective equipment w ill not shield an operator from cyberattacks if it is used inadequately due to the fact that the personnel has not been trained.

Lack of security aw areness

There is low aw areness on cyber risks in the health sector, and its potential impact on the organisation. Concretely, health practitioners are not aw are of the consequences of cyber risky behaviour, due to the lack of policies and reinforcement of secure behaviour. Through the pandemic, w hile digitalisation increased in all sectors, there w ere no increase on cybersecurity procedures, or guidance on revised procedures and technologies. This lack of aw areness is partly due to an inadequate board-level risk communication in the hospitals.

Uninterrupted functioning systems

It is challenging to implement certain cybersecurity procedures in real time in the health sector, w ithout shutting dow n the equipment. And continuous monitoring coverage or shutdow ns of the systems are not easily implemented. For instance, few health care IT infrastructures could be shut dow n w ithout serious impact on the patients’ life (and hence the functioning of the hospitals or health care facilities).

3.6.2 Health CSIRT Challenges

Within this landscape, the Health CSIRTs consulted for this study stressed that the main challenges faced w hen collaborating w ith OESs in the health sector are usually the follow ing, in order of importance:

• Lack of security culture among operators of essential services; • The management and the security of operators of essential services IT infrastructure is often outsourced; • Lack of established cooperation tools and channels w ith operators of essential services incident response teams; • No 24/7 coverage / capabilities; and • Resources or expertise issues.

Unsurprisingly, all the challenges listed by the consulted Health CSIRTs are closely linked to or referred directly to the challenges faced by the OESs themselves. To a lesser extent, supply

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

chain management and confidentiality issues w ere also listed by the consulted stakeholders as particular challenges.

Notably, 60% of consulted stakeholders pointed to the absence of a specific Health Sectoral CSIRTs, hence in these cases there are no overlaps betw een the responsibilities and services offered by the National CSIRTs, and the ones offered by Health Sectoral CSIRTs. Only 13% of interview ees pointed to an existing overlap betw een National and Health Sectoral CSIRTs.

In parallel to the overlaps, they also referred to the gap betw een the responsibilities and services offered by the National CSIRTs and the responsibilities and services offered by Health Sectoral CSIRTs: the stakeholders stressed that “the main gap is that National CSIRT have more coordination functions and they have a different constituency”. Particularly, the Health CSIRTs address all potential victims of cyberattacks from the health care industry, including non-essential services such as social health care. Other stakeholders pointed to the gap of information, as Health CSIRTs can only share information in its industry across the National one, creating delays or even under informing the other Health CSIRTs stakeholders.

Regarding the internal w ork of the CSIRTs, respondents to the consultation also explained that recurrent personnel-related challenges in the context of incident response teams include lack of know ledge and skills and high personnel rotation, w hile organisational-related challenges in the context of incident response activities usually involve also lack of personnel, and of formal definition of responsibilities and duties.

3.7 CSIRTS LESSONS LEARNED

73% of stakeholders w ho participated on the survey stressed the support received from groups/forums to exchange w ith peers IR information, good practices, and experience in the health sector. These types of information are key for the enhancement of sectoral IR capacitybuilding. Some stakeholders suggested that they often communicate w ith the EU institutions, bodies, and agencies to share information. Some other forums mentioned are international groups such as the CSIRTs Netw ork Members.

In the same line, the respondents suggested that existing capacity -building initiatives implemented at European level related to information sharing tools, and aw areness raising actions in relation to security incidents, are very useful for improving the effectiveness of the Health CSIRTs, particularly their IR capacities. Moreover, the stakeholders also pointed to more guidance on the use of vendor health care systems.

Regarding specific tools/ processes in place in their organisation that w ould help improve the effectiveness of sector IR capacities in other Health CSIRTs, respondents to the survey pointed to the follow ing:

• Policy and procedure trainings and exercises; • Vulnerability response tools; and • Information sharing actions.

Finally, stakeholders pointed tow ards the creation of public-private-partnership programs, that w ould help create a common vision among OESs and CSIRTs, minimising the lack of trust among players.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

4. RECOMMENDATIONS

4.1 INTRODUCTION

Overall, this study has found that Health sectoral CSIRTs are still scarc e in a landscape w here health OESs need specialised support in their incident response activities. Moreover, the insights shared by the consulted parties stressed the great potential of Health CSIRTs in offering this support, in particular, in information sharing initiatives.

Based on this key area of opportunity, and the needs expressed by the OESs, the follow ing recommendations have clearly emerged across the study:

4.2 RECOM M ENDATION 1: ENHANCE AND FACILITATE THE CREATION OF HEALTH SECTORAL CSIRTS

While there is a trend in developing sectoral CSIRTs and sector-w ide CSIRTs collaborations by the health OESs, still few governments have Health CSIRTs or intend to create one. In general, incident response capabilities are handled by the main OESs and supervised by the national/governmental CSIRT, leaving the IR coordination and information sharing activities to parties w ith less expertise on this niche: the intersection betw een cybersecurity and health care.

Active efforts should be placed in facilitating funding, guidance - in relation to capacity building, inform ation sharing, aw areness raising - and cooperation to guarantee the

creation of Health Sectoral CSIRTs.

Recommendation aimed at: National Cybersecurity Authorities.

4.3 RECOM M ENDATION 2: CAPITALISE ON THE EXPERTISE OF THE HEALTH CSIRTS FOR HELPING OESS DEVELOP THEIR IR CAPABILITIES

OESs stressed the need for guidance, direction and capability building w hen it comes dow n to incident response; one concrete challenge is that incident response in the health sector tends to often rely more on reactive services rather than proactive ones, due to a lack of a coordinated incident response capacity to counteract threats. Concretely, OESs need help identifying lessons learned from past incidents w ithin the sector. At the same time, the lack of sectorspecific know ledge of the National CSIRT prevents them from executing this coordination role to the best of the health OESs interest, leaving an unfulfilled role that Health CSIRTs can take on.

For these reasons, Health CSIRTs should be em pow ered to gain the role of supporting

OESs w .r.t. incident response, encouraging the organisation and pool of incident response capabilities, and facilitating a m ore proactive approach to incident response in

general.

Recommendation aimed at: National Cybersecurity Authorities, Sectoral and/or National CSIRTs.

Ideally, this role w ould include the follow ing responsibilities: promotion of specialised services to handle sector-specific threats, vulnerabilities and incidents; dissemination of specific know ledge and expertise on medical devices, medical IT systems, as w ell as threats and incidents related to the health sector in real time; provide sectoral expertise to the National CSIRT; assist nonregulated operators in the health sector on inc ident response; coordination for multi-site compromised systems in the health sector; and vulnerability coordination w ith vendors of sector -

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

specific systems / devices. These activities address the core challenges of both health OESs and CSIRTs. Furthermore, the fulfilment of these activities w ill require strong efforts from the Health CSIRTs, as w ell as development of expertise and cooperation w ith national/international CSIRTs.

In order to achieve this, the follow ing measures may enhance health CSIRTs capabilities: establishing sector-specific regulations clarifying the security requirements and responsibilities (such as guidelines and requirements for reporting and management of incidents); the establishment of cooperation agreement betw een national and sectoral actors (through the appointment of a liaison officer, sharing of know -how , expert advice or tailored training); establishing a direct and fluent communication channel w ith the OESs; and the use of public private partnerships, w hich can accelerate the maturity of Health CSIRTs and OESs IR capabilities. Linked to this, this study found that Health CSIRTs have an opportunity to reach an Intermediate Maturity Level on its IR capabilities by formalising their existing procedures.

4.4 RECOM M ENDATION 3: EM POWER HEALTH CSIRTS ROLE ON INFORM ATION SHARING ACTIVITIES

In the same line, the last recommendation stresses the importance of empow ering Health CSIRTs on the information sharing across OESs.

The organic emergence of Health CSIRTs, such as the Health Information Sharing and Analysis Centre (H-ISAC), points tow ards OESs’ strong need for information exchange, bypassing national centralised systems that do not have sector-specific know ledge and that may create unnecessary extra steps in the information sharing process.

Health CSIRTs could have a role in breaking dow n the barriers associated to incident information sharing, w hich are specially complicated in the health care industry. Concretely,

Health CSIRTs should be supported on the development of this inform ation exchange activities, w hich am ong others should include: dissem ination of threat intelligence (both ex-ante and ex-post incident inform ation), exchange of good practice and lessons learned, and inform ation regarding trainings and exercises for the capacity building of

OESs.

Recommendation aimed at: National Cybersecurity Authorities, CSIRTs Network, Sectoral and/or National CSIRTs.

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

5. BIBLIOGRAPHY

Argaw , S. T., Troncoso-Pastoriza, J. R., Lacey, D., Florin, M. V., Calcavecchia, F., Anderson, D., & Flahault, A, Cybersecurity of Hospitals: discussing the challenges and working towards mitigating the risks, BMC Medical Informatics and Decision Making, BioMed Central Ltd 20(1), 1-10, 2020. Available: https://bmcmedinformdecis mak.biomedcentral.com/articles/10.1186/s12911-020-01161-7

Check Point, The 2020 Cybersecurity Report, Check Point Online, 2020. Available: https://research.checkpoint.com/2020/the-2020-cyber-security-report/

CYBERSPRINT, Study Leads to National Investigation Cyber Security Health care, CYBERSPRINT Online, 2019. Available: https://w w w .cybersprint.com/new s/cybersprints -studyleads-to-national-investigation- into- Health cares-cyber-security/

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of netw ork and information systems across the Union, OJ L 194/1,19.7.2016, Brussels. Available: https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=celex:32016L1148

Dyrda, Laura, Inside UVM Medical Center's ransomware attack: 11 details, Becker's Health care Online, 2020. Available: https://w w w .beckershospitalreview .com/cybersecurity/inside-uvmmedical-center-s-ransomw are-attack-11-details.html

EclecticIQ, Z-CERT and EclecticIQ Cooperate to Bring Benefits of CTI to Dutch Health care Sector, Cision, 2020. Available: https://w w w .prnew sw ire.com/new s-releases/z-cert-andeclecticiq-cooperate-to-bring-benefits-of-cti-to-dutch-Health care-sector-301073185.html

ENISA, CSIRT Capabilities. How to assess maturity? Guidelines for national and governmental CSIRTs, European Union Agency for Netw ork and Information Security, 2016. Available: https://w w w .enisa.europa.eu/publications/csirt-capabilities

ENISA, Strategies for incident response and cyber crisis cooperation, European Union Agency for Netw ork and Information Security, 2016. Available: https://w w w .enisa.europa.eu/publications/strategies -for-incident-response-and-cyber-crisiscooperation

ENISA, CSIRT maturity assessment model, European Union Agency for Netw ork and Information Security, 2019. Available: https://w w w .enisa.europa.eu/publications/study-on-csirtmaturity

ENISA, Strategies for incident response and cyber crisis cooperation, European Union Agency for Netw ork and Information Security, 2016. Available: https://w w w .enisa.europa.eu/publications/strategies -for-incident-response-and-cyber-crisiscooperation

ENISA, Study on CSIRT landscape and IR capabilities in Europe 2025, European Union Agency for Netw ork and Information Security, 2019. Available: https://w w w .enisa.europa.eu/publications/study-on-csirt-landscape-and-ir-capabilities-in-europe- 2025

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

ENISA, EU Member States incident response development status report, European Union Agency for Netw ork and Information Security, 2019. Available: https://w w w .enisa.europa.eu/publications/eu-ms-incident-response-development-status-report

ENISA, CSIRT maturity assessment model, European Union Agency for Netw ork and Information Security, 2019. Available: https://w w w .enisa.europa.eu/topics/csirts-in-europe/csirtcapabilities/csirt-maturity

ENISA, Sectoral CSIRTS Capabilities, European Union Agency for Netw ork and Information Security, 2020. Available: https://w w w .enisa.europa.eu/publications/sectoral-csirt-capabilitiesenergy-and-air-transport

ENISA, PSIRT Expertise and Capabilities Development, European Union Agency for Netw ork and Information Security, 2021. Available: https://w w w .enisa.europa.eu/publications/csirtexpertise-and-capabilities-development

He, Y., Aliyu, A., Evans, M., Lu,o C., Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review, JMIR Publications, 2021. Available: https://w w w .jmir.org/2021/4/e21747#figure2

ICF, CEPS and Wavestone, Study to support the review of Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive) – N° 2020-665, 2020. Available: https://op.europa.eu/en/publication-detail/-/publication/3b6ad641-d23c-11eb-ac72- 01aa75ed71a1

Interpol, Cybercriminals targeting critical health care institutions with ransomware, The International Criminal Police Organization, 2020. Available: https://w w w .interpol.int/New s-and- Events/New s/2020/Cybercriminals-targeting-critical-health care-institutions-w ith-ransomw are

Jalal, Mohammad S., Kaiser, Jessica P., Cybersecurity in Hospitals: A Systematic,Organizational Perspective, JMR Publications, 2018. Available: https://w w w .jmir.org/2018/5/e10059?utm_source=TrendMD&utm_medium=cpc&utm_campaign =JMIR_TrendMD_0

KPMG, Complying with the European NIS Directive. Cybersecurity for critical infrastructures, KPMG, April 2019. Available: https://assets.kpmg/content/dam/kpmg/nl/pdf/2019/advisory/complying-w ith-the-eu-nisdirective.pdf

Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC, 05.04.2017, Brussels. Available: https://eur-lex.europa.eu/legalcontent/EN/ALL/?uri=CELEX%3A32017R0745

Reuters staff, Prosecutors open homicide case after hacker attack on German hospital, The Guardian, 2020. Available: https://w w w .theguardian.com/technology/2020/sep/18/prosecutors open-homicide-case-after-cyber-attack-on-german-hospital

Sherman, C., Schiano, S., Best Practices: Medical Device Security - Control Your Hospital's Expanding Device Risk Exposure, Forrester, May 2019. Available: https://w w w .forrester.com/report/Best+Practices+Medical+Device+Security/-/E-RES132003#

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Staff Working Document 345 final, Impact Assessment Report Accompanying the document Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148, 16.12.2020, Brussels. Avalable: https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=C ELEX:52020SC0345 The Dutch Security Cluster, Z-Cert, Online. Available: https://w w w .thehaguesecuritydelta.com/partners/partner/663-z-cert (Accessed 04.08.2021).

WEBSITES OF NATIONAL AND SECTORAL CSIRTs

Austria, Computer Emergency Response Team Austria. Contact: cert.at Belgium, Belgian Federal Cyber Emergency Team. Contact: cert.be Bulgaria, CERT Bulgaria. Contact: govcert.bg Croatia, Croatian National CERT. Contact: cert.hr Cyprus, National CSIRT- CY. Contact: csirt.cy Czech Republic, CSIRT.CZ. Contact: csirt.cz/ Denmark, Centre for Cyber Security (formerly Danish GovCERT). Contact: govcert.dk/ Denmark, CSIS.DK. Contact: csis.dk/ Denmark, Danish Computer Security Incident Response Team. Contact: cert.dk Estonia, CERT Estonia. Contact: cert.ee/ European Union, CERT-EU. Contact: cert.europa.eu France, CERT- FR. Contact: cert.ssi.gouv.fr France, CERT Santé, https://esante.gouv.fr/securite/cert-sante Finland, National Cyber Security Centre Finland. Contact: viestintavirasto.fi/en/cybersecurity.html Germany, CERT-Bund. Contact: bsi.bund.de/EN/TheBSI/thebsi_node.html Greece, Greek National Authority Against Electronic Attacks. Contact: cert.gov.gr Hungary, HUN-CERT. Contact: cert.hu/hun-cert/index.html Hungary, National Cyber Security Center of Hungary. Contact: nki.gov.hu Iceland, Computer Incident Response Team Iceland. Contact: cert.is Ireland, National Cyber Security Centre (IE) (formerly NCSC (IE)). Contact: ncsc.gov.ie/CSIRT/

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Italy, Computer Security Incident Response Team – Italia. Contact: csirt.gov.it/ Latvia, Information Technologies Security Incident Response Institution (CERT.LV). Contact: cert.lv/ Lithuania, National Cert of Lithuania - CERT-LT. Contact: nksc.lt/en/ Luxembourg, HealthNet-CSIRT (formerly HealthNet). Contact: healthnet.lu Luxembourg, Governmental CERT of Luxembourg. Contact: govcert.lu Luxembourg, Computer Incident Response Center Luxembourg. Contact : circl.lu/ Malta, CSIRTMalta. Contact: maltacip.gov.mt/en/CIP_Structure /Pages/CSIRTMalta.aspx Netherlands (The), Nationaal Cyber Security Centrum. Contact: ncsc.nl Netherlands (The), CSIRT- DSP. Contact: csirtdsp.nl/ Netherlands (The), Z-CERT. Contact: z-cert.nl Poland, CERT POLSKA. Contact: cert.pl/ Poland, The Governmental Computer Security Incident Response Team of Poland. Contact: csirt.gov.pl/ Poland, CSIRT- MON. Contact: csirt-mon.w p.mil.pl/pl/index.html Portugal, Servico de Coordenacao Nacional da Resposta a Incidentes de Ciberseguranca. Contact: cncs.gov.pt/ Romania, Romanian National Computer Security Incident Response Team. Contact: cert.ro Slovakia, SK-CERT (formerly GovCERT-SK). Contact: sk-cert.sk Slovakia, Computer Security Incident Response Team Slovakia (formerly CERT-SK). Contact: csirt.gov.sk/ Slovenia, Slovenian Computer Emergency Response Team. Contact: cert.si/ Spain, INCIBE-CERT. Contact: incibe-cert.es/ Sw eden, CERT-SE (formerly SITIC). Contact: cert.se

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

A ANNEX: SURVEY – QUESTIONNAIRE

ABOUT YOUR ORGANISATION

Name: ……………………………………………………………………. Incident Response Team Full Time Employees: ………………………

What type of organisation are you part of? (*M andatory)

National CSIRT

Governm ent or Military CSIRT

Regulatory organisation, body or Ministry

Sectoral CSIRT

OES Incident Response Team

Other. Please specify: ………………………………………

If pertinent, please select relevant sub-sector (*Conditional)

Health care services and facilities

Manufacturer of medical devices, equipment, and hospital supplies Other. Please specify: ………………………………………

Com m ents

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

CSIRT INCIDENT RESPONSE CONTEXT

1. What are the services and associated functions provided by the sectoral CSIRTs or sector -specific IR capabilities in your sector ? (*Mandatory)

Service Area 1 – Inform ation security event m anagement Service Area 3 - Vulnerability m anagem ent

Monitoring and detection Vulnerability discovery / research

o Log and sensor management o IR vulnerability discovery o Detection use case management o Public source vulnerability discovery o Contextual data management o Vulnerability research

Event analysis Vulnerability report intake

o Correlation o Vulnerability report receipt o Qualification o Vulnerability report triage & processing

Service Area 2 - Inform ation security incident m anagem ent Vulnerability analysis

Information security incident report acceptance o Vulnerability triage o Vulnerability root cause analysis o Information security incident report receipt o Vulnerability remediation development o Information security incident triage and processing

Vulnerability coordination Information security incident analysis o Vulnerability notification/reporting o Information security incident triage o Vulnerability stakeholder coordination o Information collection o Detailed analysis coordination Vulnerability disclosure o Information security incident root cause analysis o Cross-incident correlation o Vulnerability disclosure policy & infrastructure maintenance Artifact and forensic evidence analysis o Vulnerability announcement / communication o Media or surface analysis o Post-vulnerability disclosure feedback o Reverse engineering o Run Time or dynamic analysis Vulnerability response o Comparative analysis o Vulnerability detection/scanning Mitigation and recovery o Vulnerability remediation o Response plan established

Service area 4 – Situational aw areness

o Ad-hoc measures and containment o System restoration Data acquisition o Other information security entities support o Policy aggregation, distillation, and Information security incident coordination guidance o Asset mapping to functions, roles, o Communication actions and key risks o Notification distribution o Collection o Relevant information distribution o Data processing and preparation o Activities coordination o Reporting o Media communication

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Crisis management support Analysis and synthesis

o Information distribution to constituents o Projection and inference o Information security status reporting o Event detection o Strategic decisions communication o Information security incident management decision support Communication o Situational impact

o Internal and external communication Exercises o Reporting and recommendations o Implementation o Requirements analysis o Dissemination / integration / information sharing o Format and environment development o Management of information sharing o Scenario development o Feedback o Exercise execution o Exercise outcome review

Service area 5 – Know ledge transfer

Technical and policy advisory Aw areness building o Risk management support o Research & information aggregation o Business continuity and disaster o Reports and aw areness materials developed recovery planning support o Information dissemination o Policy support o Outreach o Technical advice

Training & Education o Know ledge, skill, and ability requirements gathering o Educational and training materials development o Content delivery o Mentoring o CSIRT staff professional development

Com m ents

2. How m any incidents related to the health sector do you handle per year? (*Mandatory)

0-10

10-50

50-100

100+

Other. Please specify: ………………………………………

I do not know

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

3. What is the scope of your Incident Response? (*Mandatory) Company-level City-level National-level International-level I do not know Other. Please specify: ………………………………………

4. How long has your organisation been in place in years?

Com m ents

CREATION OF SECTORAL CSIRT/IR CAPABILITIES

5. Do you know if the health sector has, or is going to have a dedicated CSIRT in your country of operation? (*Mandatory)

Yes No I do not know

(Conditional question) If yes, please specify in the com m ent box the status of CSIRT e stablishm ent: existing, under developm ent, development process to be launched in 2021, plans for the com ing years, no plans yet. Please also specify w hether the CSIRT is/are listed, accredited or certified.

Com m ents

6. What are the key reasons to create such sector-specific IR capacities? (*Mandatory)

The implementation of the NIS Directive The lack of sector-specific know ledge or capacity of the National CSIRT Lessons learned from past incidents The difficulties in managing the cybersecurity incidents in the NIS Directive sectors The complexity of managing the high number of OES in some of the NIS Directive sectors The need to facilitate incident handling cross-borders

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

I do not know Other. Please: specify: ………………………………………………………………………………

7. What im pact(s) do you think the NIS Directive had on your activity? (*Mandatory)

Com m ents

8. In your opinion, w hat are the specific services, roles or functions of the sectoral CSIRTs in contrast to national, governm ental or m ilitary CSIRTs? (*Mandatory)

Com m ents

9. Based on your experience, is there any overlap betw een the responsibilities and services offered by the National CSIRTs and the responsibilities and services offered by Health Sectoral CSIRTs? (*Mandatory)

Yes No I do not know Not applicable – absence of health sectoral CSIRT

If yes, could you specify w hich overlaps? (Conditional question)

Com m ents

10. In your opinion, is there any relevant gap in the responsibilities and services offered by the National CSIRTs and the responsibilities and services offered by Health Sectoral CSIRTs? If yes, could you specify w hich ones? (*Mandatory)

Com m ents

11. Based on your experience, w hat are the key factors facilitating the developm ent of sectoral CSIRTs and/or IR capacities? (*Mandatory)

The lessons learned from past incidents The establishment of sector-specific regulations clarifying the security requirements and responsibilities Recommendations from a previous audit and certification programmes Requests from stakeholders or participating organisations/future members The establishment of cooperation agreements betw een national and sectoral actors

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Access to funding and support of IR capability development through the Connecting European Facility (CEF) programme Access to funding and support of IR capability development through other f unding The establishment of public-private partnerships. Please specify the nature of these PPPs: ……………………….. The dissemination of threat intelligence, exchange of good practices and lessons learned I do not know Other. Please specify: ……………………………….……………………………………………….………………………………

Com m ents

12. What specific resources and tools are in place to support the developm ent of constituents’ incident response capabilities (IRC) in the health sector? (*Mandatory)

Appointment of local or sectoral counsellors advising OES on the development of their IRC Training and Education activities A netw ork of IR actors at a national or sectoral level to exchange good practices about information exchange, capabilities, cooperation Methodological baselines and tools to support IR (e.g.: specific softw are tools, risk assessment methodologies, best practices, framew orks) Shared framew ork for incident classification and threat modelling Certification by cybersecurity companies providing reliable services and products I do not know Other. Please specify…………………………………………………………………

Com m ents

13. Does your organisation need / have you asked for any specific support o r guidance from external stakeholders to design and im plement sectoral IR capacities? (*Mandatory)

Yes No I do not know

(Conditional question) If yes, please specify from w ho:

European Union entities Professional associations International authorities CSIRT communities/peers National authorities Industry players

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Other. Please specify: ………………………………..

Com m ents

14. Does your organisation use a specific CSIRT m aturity assessment m ethodology to support the developm ent of IR capabilities w ithin your sector(s)? (*Mandatory)

Yes No I do not know

(Conditional question) If yes, w hich one ?

SIM3 (Security Incident Management Maturity Model) ENISA CSIRT maturity assessment Your National CSIRT maturity tool A CSIRT maturity assessment methodology from the private sector (please specify in comments) Other (please specify in comments)

Com m ents

ORGANISATION AND PERSONNEL

15. Has the scope of responsibility of your entity in regard to Incident Response activities been defined? (*Mandatory)

Not defined Informally defined Formally defined I do not know (Conditional question) If inform ally or form ally defined, could you please provide m ore information on the

scope of responsibility of your entity in regard to Incident Response activities?

Com m ents

16. Has the classification of the incidents handled by your entity been defined? (*Mandatory)

Not defined Informally defined

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Formally defined I do not know (Conditional question) If inform ally or form ally defined, how do you classify the incidents handled by the

entity?

Com m ents

17. Has a security policy for operations been established by your organisation, and to w hich extent is it respected? (*Mandatory)

Not defined Informally defined Formally defined I do not know (Conditional question) If inform ally or form ally defined, could you please provide m ore information on the

security policy for operations, and to w hich extent it is respected?

Com m ents

18. Has your organisation form alised the level of services that it offers in its intervention scope? (*Mandatory)

Not defined Informally defined Formally defined I do not know

(Conditional question) If inform ally or form ally defined, could you please provide m ore information on the level of services that it offers in its intervention scope?

Com m ents

19. How does your organisation approach the need to ensure the resilience of its personnel? (*Mandatory)

Not tackled Informal approach Formal approach I do not know

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

(Conditional question) If inform al or form al approach, could you please provide m ore information on how your organisation approach the need to ensure the resilience of its personnel?

Com m ents

20. How m any people are involved w ith incident-response activities in your organisation? (*Mandatory)

1 - 3 4 - 10 11 - 15 16 - 20 More than 20 – Please specify I do not know

21. How does your organisation ensure the training of staff internally? (*Mandatory)

In-person trainings Online trainings Guidelines Other. Please specify:…………………………………………………………….

22. Based on your experience, w hat are the m ost recurrent personnel-related challenges in the context of incident response team s? (*Mandatory)

Com m ents

23. In your opinion, what are the most recurrent organisational-related challenges in the context of incident response activities? (*Mandatory) Comments CSIRT CAPABILITIES IN HEALTHCARE SECTOR

INCIDENT RESPONSE CAPABILITY DEVELOPMENT IN THE SECTORS

24. Which specific tools does your organisation rely on to conduct the following services? Please tick the right answer: (*Mandatory)

Planning to Out of I do Tool in Service area and Services im plem ent scope or not Please specify service one perim eter know

Service Area 1 – Information security event Management Monitoring and detection     Event analysis     Service Area 2 - Information security incident management

Inform ation security incident report

   

acceptance Inform ation security incident

   

analysis Artifact and forensic evidence

   

analysis

Mitigation and recovery    

Inform ation security incident

   

coordination

Crisis m anagem ent support     Service Area 3 - Vulnerability management Vulnerability discovery / research     Vulnerability report intake    

Vulnerability analysis    

Vulnerability coordination     Vulnerability disclosure     Vulnerability response    

Service area 4 – Situational aw areness

Data acquisition     Analysis and synthesis     Com m unication    

Service area 5 – Know ledge transfer

Aw areness building     Training & Education     Exercises     Technical and policy advisory     Other Service area: Please specify    

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

25. Does your organisation have standard operating procedures (SOPs) that OES’ team s should follow in case of incident? (*Mandatory)

Yes No I do not know

(Conditional question) If yes, could you please provide details for w hich services or functions?

Com m ents

26. Does your organisation m ake use of an incident notification tem plate? (*Mandatory)

Yes No I do not know

(Conditional question) If yes, could you please provide additional inform ation on w ho has (or w ill have) access to the notification tem plate? (e.g., constituents, participat ing organisations, LEA, third-party organisations, CSIRT peers)

Com m ents

(Conditional question) If yes, could you please indicate the nature of the inform ation reported?

Description of the incident and IOCs and TTPs Root cause Services affected Severity Cross border impact Lessons learned Indicators to measure the nature and impact in addition to those of the NIS Directive. Current situation of the incident (actions taken or needed, investigation status etc.) I do not know Other. Please specify.

Com m ents

27. Does your organisation have specific inform ation exchange tools to enable the notification of incidents? (*Mandatory)

Secure emails (e.g., PGP encrypted) MISP standard formats and technologies A special government secured netw ork via an ISAC (Information Sharing and Analysis Center)

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

I do not know Other. Please specify: ……………………………………………………………………………………………………………………

28. How does your organisation ensure the uptake of these tools and procedures by constituents? (*Mandatory)

Obligation stipulated in legislature Code of conduct Promotion by National CSIRT Post-attack measures implemented by National CSIRT I do not know Other. Please specify.

Com m ents

29. Based on your experience, w hat are the m ain challenges related to sectoral CSIRTs’ tools and procedures? (*Mandatory)

Com m ents

INCIDENT RESPONSE COOPERATION AND OPERATIONAL MODELS WITHIN THE SECTORS

Cooperation w ith OES/Critical Infrastructure (in particular from the private sector)

30. In case of an incident, does your organisation have: (*Mandatory)

Specific cooperation agreements betw een the national cybersecurity author ities and the IR teams of OES (in particular for private companies) Specific consultation process involving OES’ incident response capabilities (in particular for private companies) Specific process allow ing OES to request operational assistance from the national, governmental or military CSIRT Specific process to share lessons learned among national and sectoral CSIRT after a crisis (e.g.: after incident standard report, meetings etc.) I do not know

Com m ents

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

31. What are the m ain challenges faced w hen collaborating w ith OES in the health sector? (*Mandatory)

Confidentiality issues Cross-border related issues Commercial issues Regulatory issues GDPR-related issues Resources or expertise issues No 24/7 coverage / capabilities Supply chain management Lack of security culture among OES The management (and the security) of OES IT infrastructure is often outsourced Lack of established cooperation tools and channels w ith OES IR teams Cross-sector interdependencies and cooperation I do not know Other. Please specify: …………………………………………………….

Com m ents

Incident response in cross -border crisis situations

32. Does your organisation have specific procedures to address cross-border incidents w ithin the sector? (*Mandatory)

Yes, there are such procedures at a national level Yes, there are such procedures at a sectoral level Yes, indirectly (through a trusted third-party Point-of-Contact such as governmental CSIRT, LEA) No, but these are planned to be implemented No, it is not planned at the moment I do not know

Com m ents

33. What is the nature of these procedures? (*Mandatory)

Bilateral agreement w ith the other MS Designation of a Point of Contact at national or sectoral level to facilitate cross-border cooperation in case of incident Participation of representative of the other country in the crisis response process

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Organisation of cross-border exercises Information sharing platform (existing or about to be implemented) I do not know Other. Please specify: ………………………………………

34. Does your organisation have specific m easures in place to inform the relevant actors (national authorities and OES) in neighbouring countries about an incident that m ay im pact them ? (*Mandatory)

Yes, direct contact (communicating w ith relevant actors using their direct contact information, w ithout going through an intermediary). Yes, indirectly (through a Point of Contact, a trusted third-party) No, but it is planned to establish some No, it is not planned at the moment I do not know (Conditional question) If yes directly or indirectly, please specify.

Com m ents

GDPR COMPLIANCE AND DATA BREACH MANAGEMENT

35. Does your organisation have an appointed “privacy cham pion”? (*Mandatory)

Yes No I do not know

(Conditional question) If yes, could you please detail his/her functions and tasks (full tim e or part tim e, exclusively or partially dedicated to privacy related issues)? (*Mandatory)

Com m ents

36. Does your organisation provide aw areness training in GDPR? (*Mandatory)

Yes No I do not know

(Conditional question) If yes, could you please describe the training policy (frequency, percentage of the team that has been trained, regular updates)? If not, w here can you receive guidance related to GDPR m atters?

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

Com m ents

(Conditional question) If no, could you please provide inform ation on how or w here can you receive guidance related to GDPR m atters?

Com m ents

37. Does your organisation’s Incident Response Policy specify how to identify a Data Breach, as defined by the GDPR (articles 33 & 34)? (*Mandatory)

Yes No I do not know

Com m ents

38. Does your organisation’s Incident Response Management Process indicate the inform ation of the Data Protection Officer (DPO), or any other person or institution in charge of the privacy/GDPR com pliance concerns? (*Mandatory)

Yes No I do not know

Com m ents

39. Does your organisation have a forensics m anual or guidelines to handle evidence related to a Personal Data Breach? (*Mandatory)

Yes No I do not know

Com m ents

CSIRT CAPABILITIES IN HEALTHCARE SECTOR

LESSONS LEARNED AND RECOMMENDATIONS

40. Do you use groups/forum to exchange w ith peers IR inform ation, good practices, and experience in your sector w ith peers ? (*Mandatory)

Yes No I do not know (Conditional question) If yes, could you please specify w hich group?

Com m ents

41. In your opinion, w hat possible m easures undertaken by European Institutions, international or national authorities, or private body in a specific sector, w ould help im prove the effectiveness of the health sector IR capacities? (*Mandatory)

Com m ents

42. What specific tools or processes in place in your organisation w ould help im prove the effectiveness of sector IR capacities? (*Mandatory)

Com m ents

43. Do you have any other inputs about your w ork or about the IR capacities w ithin the health sector in your country you w ould like to share w ith us?

Com m ents

END OF QUESTIONNAIRE

-N -EN -067 -21 -07 TP

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustw orthiness of ICT products, services and processes w ith cybersecurity certification schemes, cooperates w ith Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow . Through know ledge sharing, capacity building and aw areness raising, the Agency w orks together w ith its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its w ork can be found here: w w w.enisa.europa.eu.

ISBN: 978-92-9204-542-5 DOI: 10.2824/201143