NSA recommends adoption of zero trust controls to improve cybersecurity of essential functions

The National Security Agency Oct. 8 released guidance for critical infrastructure organizations that recommends adopting high-impact zero trust strategies to improve cybersecurity for operational technology. For healthcare, such technology includes tools that manage energy control, HVAC, life-safety systems, door access controls, physical security systems, alarms and medical gasses. Zero trust is a security principle that assumes a compromise is possible or already present and continuously verifies users and devices. The guidance also highlights recent nation-state attacks, including the People’s Republic of China’s prepositioning of disruptive malware known as Volt Typhoon on critical infrastructure entities that healthcare depends on, such as energy. The guidance also explains how threat actors’ use of artificial intelligence is making cyberattacks more sophisticated and potentially more severe.

For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.