Securing Cloud Services for Health: New report by EU Agency for Cybersecurity helps healthcare organisations securely adopt cloud services and prepare for cybersecurity challenges

Agency News, Cyber Security CII sector, Industry News
The European Union Agency for Cybersecurity (ENISA) published the Cloud Security for Healthcare Services report, which provides cybersecurity guidelines for healthcare organisations to help further digitalise with cloud services. Building on ENISA’s procurement guidelines for cybersecurity in hospitals, published early last year, this new report assesses the cybersecurity risks of cloud services and offers good practices for their secure integration into the European healthcare sector. The ENISA report comes as the European Commission is moving forward this year with the European Health Data Space initiative to promote the safe exchange of patients’ data and access to health data.
The COVID-19 pandemic has underlined an increased need for efficient – and secure – digital healthcare services. Cloud solutions allow for the flexible and rapid deployment of the electronic storage of data and electronic communications such as telemedicine. However, the complexity of legal systems and new technologies, as well as concerns over the security of sensitive patient data have slowed the healthcare sector in adopting cloud services.
EU Agency for Cybersecurity Executive Director Juhan Lepassaar said: “A resilient health sector relies on secure digital solutions. The EU Agency for Cybersecurity provides healthcare organisations with guidance to address cybersecurity concerns related to cloud services and is preparing an EU Cloud Cybersecurity Certification scheme, both of which aim to do just that.”
The report addresses these concerns by providing security guidelines for three main areas in which cloud services are used by the healthcare sector, namely for:
Electronic Health Record (EHR), i.e. systems focusing on the collection, storage, management and transmission of health data, such as patient information and medical exam results;
Remote Care, i.e. the subset of telemedicine supporting remote patient-doctor consultation;
Medical Devices, i.e. cloud services supporting the operation of medical devices such as making medical device data available to different stakeholders or for device monitoring.
For each of these use cases, the report highlights the main factors to be considered when healthcare organisations conduct the relevant risk assessment – for example, in terms of risk to sensitive patient data or availability of a medical service. These guidelines, however, are only a first step for healthcare providers to adapt securely to the cloud. More support is needed, such as established industry standards on cloud security, specific direction from national and EU authorities, and further guidelines from Data Protection Authorities on transferring healthcare data to the cloud.
The report also proposes a set of security measures for healthcare organisations to implement when planning their move to cloud services, such as establishing processes for incident management, defining data encryption requirements, and ensuring data portability and interoperability. The measures are proposed taking into consideration the draft candidate EU Cybersecurity Certification Scheme on Cloud Services (EUCS) to ensure compatibility and requirements mapping. The Agency’s draft scheme is part of the larger cybersecurity certification framework aimed at enhancing trust in ICT products, services and processes across Europe. The draft scheme is open for public consultation until 7 February 2021.
The EU Agency for Cybersecurity will continue its work to strengthen the cybersecurity of Europe’s healthcare sector by publishing guidelines, promoting information sharing, collaborating with policy-makers and organising events such as the annual eHealth Conference, addressing the healthcare sector’s major cybersecurity challenges.
Leave a comment , , ,

Africa’s Infrastructure Ministers Validate Africa’s Infrastructure Priorities for 2021-2030

Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
Africa’s infrastructure Ministers convened virtually to discuss the Continent’s infrastructure priorities for 2021-2030 and to validate the outcome of the first extraordinary expert group meeting of the African Union Specialized Technical Committee on Transport, Intercontinental and Interregional Infrastructures, Energy and Tourism (STC-TTIIET) held on December 14, 2021. A large number of African Ministers and institutions actively participated. The AU High Representative for Infrastructure Development, Rt. Hon. Raila Odinga, also addressed the audience.
The Ministerial meeting has looked into the reports of the STCTTIIET experts’ meeting and the bureau of the STC TTIIET, the priority list of projects for PIDA PAP2, the roadmap, policy, and governance structure of the African Single Electricity Market (AfSEM), the implementation of the COVID-19 Emergency Action Plan for Resilience and Recovery and the African Road Safety Action plan of the Decade 2021-2030.
In his opening remarks, Minister of Electricity & Renewable Energy of the Arab Republic of Egypt, Chair of the STC TTIIET, H.E. Dr. Mohamed Shaker El Markabi acknowledged that the determination of the African Union Commission and stakeholders to move Africa’s infrastructure development agenda forward despite the challenges posed by the ongoing COVID-19 pandemic.
The Chair further highlighted that infrastructure development is key for the attainment of Africa’s development aspirations captured by Agenda 2063 and the Sustainable Development Goals (SDGs) and the priorities lined up for the next decade speak to these continental and global goals.
H.E. Dr. Amani Abou-Zeid, African Union Commissioner for Infrastructure and Energy, emphasised the importance of infrastructure in Africa in the next decade as the backbone to the realisation of the much-needed integration and trade facilitation in the continent.
According to AU Commissioner, post-COVID-19 recovery requires the fast-tracking of Africa’s infrastructure development to improve resilience and improve livelihoods and economies. “The COVID-19 pandemic also accelerated digitalisation, exposed the gaps in energy in rural areas and highlighted the need to develop infrastructure that is smart, inclusive and sustainable”, said Dr. Abou-Zeid.
The AU Commissioner seized the opportunity to remind the Committee of the bottomup participatory approach and regional consultations conducted leading to preparation of the PIDA PAP2 and the AfSEM, calling on the AU Member States, Regional Economic Communities and Stakeholders to synergize efforts towards the realizationsof Africa’s infrastructure development ambitions.
“Annually, we have an infrastructure financing gap of between $60 -$90 billion. We need effective and efficient plans to mobilize resources to fund the identified PIDA projects.The long-term solution in my view is the creation of an Africa Continental Infrastructure Fund under the auspices of the AU to pool resources. Such a fund would focus on a combination of domestic sources and private sector financiers”, said the Rt. Hon. Raila Odinga, the AU High Representative for Infrastructure Development.
Infrastructure & Partnerships Division Manager at the African Development Bank(AfDB), Mike Salawou recalled that the bank has been the major financier of infrastructure projects in Africa by availing 7bln USD in the past ten years. “We have been actively supporting the first phase of PIDA and we will continue to support PIDA PAP2, recognizing the long-term effect it will have to spur economic advancement for the continent”.
Mr. William Lugemwa, Director of Private Sector Development and Finance Division at the UNECA, also appeals for ownership of the PIDA PAP2 projects, saying “African leadership from the highest political level is critical for the successful implementation of PIDA PAP2”.
In her closing remarks, AU Commissioner Dr Abou-Zeid thanked Member States, Regional Economic Communities, PIDA Institutions, and partners for their active participation and relentless efforts exerted throughout the processes of PIDA PAP2, the PIDA PAP2 guiding documents, and AfSEM policy documents.
The recommendations and declarations validated by the Ministerial meeting of the STC-TTIIET will be presented to the Assembly of the African Union Heads of States and Government for adoption at the African Union Summit in February 2021.
Leave a comment , ,

One ICT regulator’s journey to 5th-generation regulation

Cyber Security CII sector, Industry News, Telecomms sector
The global regulatory and technology landscape is complex and fast-moving.
Regulators find themselves grappling with an ever-growing array of challenges, chief among them achieving the Sustainable Development Goals (SDGs) by the 2030 deadline, now just a decade away.
The Kingdom of Saudi Arabia’s ICT regulator is no exception, as the country continues to prioritize the rapid growth of its ICT sector and pursue sustainable economic diversification as part of its Vision 2030.
But what is 5th-generation in the first place? And how is Saudi Arabia’s Communications and Information Technology Commission (CITC) planning to get there?
The evolving role of the ICT regulator
If we think in terms of regulatory “generations”, the first employed a “command and control approach”, which often took the form of public or national telecom monopolies. The second-generation regulatory landscape saw the opening of markets, facilitating partial liberalization and privatization of telecommunications. By generation three, we saw accelerated investment, innovation, and access opportunities emerge, with regulators placing a dual focus on stimulating competition while ensuring consumer protection.
Fourth generation features integrated regulation, led by economic and social policy goals. A 4th-generation regulator is one that ensures or is working towards universal access, consults stakeholders regularly, and promotes international and regional cooperation, equitable spectrum management, and stronger consumer protection.
Where do regulators stand globally?
According to ITU’s Global ICT Regulatory Outlook 2020, 8 per cent of countries now has holistic, forward-looking regulatory frameworks enabling digital transformation across the economy.
40 per cent of countries remain in regulatory generations 1 and 2, missing development opportunities and remaining disconnected from the digital transformation of their economies. While one third of countries have achieved G4, characterized by thriving markets for ICT services and the lowest proportion of unconnected populations, some have already set 5th-generation regulation in their sights. In a 5th-generation regulatory environment, collaboration among even more stakeholders is key to shaping decisions in a harmonized way not only within the telecommunications realm, but across a broad range of sectors now dependent on ICTs.
CITC’s regulatory transformation
With a guiding vision of a “connected nation for a thriving digital economy”, CITC is stepping up to meet the 5th-generation regulation challenge with an ambitious new digital transformation strategy. Their vision also emphasizes safeguarding the public, providing reliable service, ensuring fair competition, and balancing the diverse needs of multiple stakeholders.
Historically, the Commission’s mandate focused on regulating the telecommunication and information technology sectors. But the last two years have seen that mandate evolve to reflect a changing global regulatory and technology landscape.
The Saudi Arabian regulator has met the challenges of an increasingly complex regulatory environment with a series of initiatives, including, among others:
• Promoting investment and infrastructure development while ensuring access to high-quality services. CITC reported investing 15 billion USD in infrastructure, including meeting major deployment milestones on network infrastructure and quality. Mobile broadband download speed reached 77.55 Mbps in August 2020, and mobile coverage increased to 99 per cent of the population for 3G and 94 per cent for 4G, according to CITC estimates.
• Establishing a National Regulatory Committee that will bring together 8 core regulators to collaborate on ICT and digital cross-sectoral topics like blockchain, smart cities and digital platforms, and proactively anticipate emerging topics. Additional public and private entities will be involved as needed. This collaboration was set up to accelerate regulation-to-adoption and seeks to drive innovation, job creation, and investor confidence by promoting coherence and efficiency across Saudi Arabia’s ICT ecosystem.
• Acting collaboratively to deploy ICTs during the COVID-19 pandemic. As the pandemic reached Saudi Arabia, CITC collaborated quickly and effectively with telecom operators to meet the surge in demand for online access and data with increased speeds and data capacity, free services, expanded spectrum use, and enhanced network configurations and connectivity. This rapid response played a critical role in enabling remote work, business continuity, delivery apps, e-government services, and remote learning across Saudi Arabia.
[courtesy of ITU]
Leave a comment , , ,

ENISA and eu-LISA – Cooperation for a More Digitally Resilient Europe

Agency News, Cyber Security CII sector, Industry News
Within the priorities of the Portuguese Presidency of the Council of the European Union and the current Recovery Plan for Europe put forward by the European Commission, the words “digital” and “resilience” are prominent and at times used together. When combined they bring to mind IT-related challenges that need to be addressed to ensure a stronger and safer Europe for its citizens. One of the primary concerns is cybersecurity; and, given that this is a topic of common interest to the European Union Agency for Cybersecurity (ENISA) and the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), it gives the two Agencies further impetus to work together to face this growing threat.
Earlier today Executive Directors Juhan Lepassaar (ENISA) and Krum Garkov (eu-LISA) signed a multiannual Cooperation Plan. The plan sets out activities that will provide benefits through joint actions to the Agencies themselves and to the EU Member States.
The three-year Cooperation Plan complements the existing regulations applicable to ENISA and eu-LISA, and lays out various actions within complimentary areas that the Agencies can draw benefits from by sharing knowledge, information and expertise. Information Security, Business Continuity, Research, Data Protection and Corporate Quality Management are among the priority areas identified for collaboration.
ENISA Executive Director Juhan Lepassaar said: “Securing our digital future is facilitated by sharing knowledge and expertise. This Cooperation Plan will allow our Agencies to find solutions together.”
"With cybersecurity and digital resilience high on the European agenda for the coming years, it seems fitting to take the opportunity to strengthen our cooperation with ENISA and to boost our common contributions to the goals set for Europe's digital future. There are many areas where our respective consolidated expertise can be put to good use. The EU Cybersecurity Strategy, adopted by the Commission in December, is one of these and the fast changing landscape of cyber threats including the ensuing need to secure common cyber spaces are examples of where we can mutually assist each other. This renewed agreement is the best way to kick-off 2021 and eu-LISA is looking forward to extending its relationship with ENISA." said Krum Garkov, Executive Director of eu-LISA.
It is in the common interest of both Agencies to promote and share activities with their stakeholders and the general public in order to provide increased visibility and further improve awareness of their respective responsibilities and joint successes. For this reason, the Cooperation Plan includes core activity related plans, as well as communication and information sharing as important areas for joint actions.
Leave a comment , , ,

NSA releases “Eliminating Obsolete Transport Layer Security (TLS) Protocol Configurations” Cybersecurity Information

Agency News, Cyber Security CII sector, Industry News
The National Security Agency released a cybersecurity product Tuesday detailing how to detect and fix out-of-date encryption protocol implementations. Networks and systems that use deprecated forms of Transport Layer Security (TLS) or Secure Sockets Layer (SSL) for traffic sessions are at risk of sensitive data exposure and decryption.
The Cybersecurity Information Sheet, “Eliminating Obsolete Transport Layer Security (TLS) Protocol Configurations” instructs National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) system administrators on how to detect, prioritize, and replace unauthorized or deprecated TLS protocols with ones that meet current standards. Committee on National Security Systems (CNSS) Policy 15 requires that TLS protocols used by National Security Systems meet specified algorithm standards. Remediation is crucial to decreasing computer system and network attack surfaces and preventing unauthorized access to private data.
To help system administrators fix their network components, NSA developed several server configurations and network signatures to accompany the report that are available on the NSA Cybersecurity Github. While this information is provided to assist NSA's mission customers, any network administrator interested in finding and fixing their network components to allow only authorized and strong encryption protocol configurations may find it useful.
NSA seeks to regularly release unique, actionable, and timely cybersecurity guidance to secure the Department of Defense, National Security Systems, and the Defense Industrial Base. For more information or other cybersecurity products, visit NSA.gov/cybersecurity-guidance.
Leave a comment ,

FAA Should Examine a Range of Options to Support U.S. Launch Infrastructure

Agency News, Industry News, Space Sector
Demand for commercial space launches is expected to increase. Twelve launch sites in The US held operator licenses in Aug. 2020, and 11 more were seeking licenses from the Federal Aviation Administration.
Congress asked the FAA to recommend ways to facilitate and promote investments in space transportation infrastructure. The FAA told the GAO that its response would focus on 2 existing FAA grant programs.
Launch providers support the deployment of people and payloads, such as national security and commercial satellites or research probes, into space. The majority of these providers told GAO that U.S. space transportation infrastructure—located at sites across the country—is generally sufficient for them to meet their customers' current requirements. This situation is in part a result of the launch providers' investments in launch sites, along with state and local funding. Launch providers and site operators alike seek future improvements but differ on the type and location of infrastructure required. Some launch providers said that infrastructure improvements would be required to increase launch capacity at existing busy launch sites, while a few site operators said that new infrastructure and additional launch sites would help expand the nation's overall launch capacity.
The Federal Aviation Administration (FAA) was directed by statute to make recommendations to Congress on how to facilitate and promote greater investments in space transportation infrastructure, among other things. However, FAA's initial draft report was limited because it focused only on two existing FAA programs, rather than a range of options. FAA officials stated that they did not examine other options because of limited time and resources, and that the two identified programs could be implemented quickly because FAA has administrative authority to manage them. Leading practices in infrastructure investment emphasize the importance of conducting an examination of potential approaches, which can help identify how best to support national interests; avoid overlap or duplication of federal effort; and enhance, not substitute, participation by non-federal stakeholders. An examination may also help identify alternatives to making funding available, such as increasing efficiency and capacity through technology improvements. By focusing only on these existing programs, FAA may overlook other options that better meet federal policy goals and maximize the effect of any federal investment. Although FAA has already prepared its initial report to respond to the statute, it still has opportunities, such as during subsequent mandated updates, to report separately on potential approaches.
Demand for commercial space launches is anticipated to increase in the coming years. FAA, the agency responsible for overseeing the sites where these launches occur, was directed by statute to submit a report—and update it every 2 years until December 2024—that makes recommendations on how to facilitate and promote greater investments in space transportation infrastructure.
Leave a comment , , ,

Croatia hit by multiple earthquakes affecting infrastructure and homes

Industry News, Power/Energy/Oil & Gas sector
At least seven people were killed and scores injured after a 6.4 magnitude earthquake struck central Croatia on December 29. The quake—the strongest recorded in 140 years—struck just after noon local time about 30 miles southeast of the capital Zagreb, and could be felt across the Balkans. The earthquake led to widespread damage to buildings and infrastructure, including the region’s largest hospital and a variety of other healthcare-related facilities. Hundreds of thousands of people were left without power, and travel has been widely disrupted as officials continue to assess damage to roads, bridges and local airports.
In recent days, the area has suffered from strong aftershocks. On January 6, a 4.9 magnitude earthquake occurred in the same area, with the epicenter near Petrinja, just 4 miles (7 kilometers) west-northwest of the December 29 quake.
Reports indicate significant damages to buildings and homes and possible utility disruptions in Petrinja, Zagreb, and Sisak in Croatia. Slovenia has also shut down power to its nuclear power plant, as a precaution due to the possibility of aftershocks. Some damage to infrastructure has also been reported in Bosnia and Herzegovina.
Within hours of the earthquake, International Medical Corps deployed more than $50,000 worth of personal protective equipment (PPE) to support Croatian health authorities involved in relief efforts. It also deployed an Emergency Response Team from the Croatia office to conduct an assessment of the damage and critical needs in Petrinja, Sisak, Glina and the surrounding villages.
The IMC team is working closely with the Croatian Ministry of Health’s Crisis Management Center to evaluate needs and coordinate opportunities to connect resources with those affected by the earthquake. Based on discussions with the Ministry of Health (MoH), a clear priority is to restore primary healthcare services in the affected region.
IACIPP Regional Director, Robert Mikac, who is actively involved in disaster management and relief in Croatia, is supporting the government response to the disaster.
Leave a comment , , ,

US Partnering with Cyprus on a Training Centre for Port and Border Security, known as CYCLOPS

Agency News, Cyber Security CII sector, Industry News

This $5 million training facility donated by the United States will be owned and operated by the Republic of Cyprus and will allow international partners to train in a dedicated facility with cutting edge equipment. Here, experts from the region will receive state of the art instruction in border security, customs and export controls, port and maritime security, and cybersecurity.

A mobile cyber security training laboratory will allow regional partners to learn best practices to secure their critical infrastructure and engage in cross-border cyber investigations. These training platforms will serve as a hub that works in close association with partner countries in the Mediterranean, the Middle East, and elsewhere.

The CYCLOPS center is just one important result of continuing American engagement in the Eastern Mediterranean region and of the strong relationship between the United States and the Republic of Cyprus. We look forward to continuing our security partnership with the Republic of Cyprus and the region in the coming years.

Leave a comment , ,

CISA Updates Emergency Directive 21-01 Supplemental Guidance and Activity Alert on SolarWinds Orion Compromise

Agency News, Cyber Security CII sector, Industry News
CISA has released Emergency Directive (ED) 21-01 Supplemental Guidance version 3: Mitigate SolarWinds Orion Code Compromise, providing guidance that supersedes Required Action 4 of ED 21-01 and Supplemental Guidance versions 1 and 2.
- Federal agencies without evidence of adversary follow-on activity on their networks that accept the risk of running SolarWinds Orion in their enterprises should rebuild or upgrade, in compliance with hardening steps outlined in the Supplemental Guidance, to at least SolarWinds Orion Platform version 2020.2.1 HF2. The National Security Agency (NSA) examined this version and verified it eliminates the previously identified malicious code. This version also includes updates to fix un-related vulnerabilities, including vulnerabilities that SolarWinds has publicly disclosed.
- Federal agencies with evidence of follow-on threat actor activity on their networks should keep their affected versions disconnected, conduct forensic analysis, and consult with CISA before rebuilding or reimaging affected platforms and host operating systems.
The updated supplemental guidance also includes forensic analysis and reporting requirements.
CISA has also updated AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations, originally released December 17, 2020. This update includes new information on initial access vectors, updated mitigation recommendations, and new indicators of compromise (IOCs).
Although the Emergency Directive only applies to Federal Civilian Executive Branch agencies, CISA encourages state and local governments, critical infrastructure entities, and other private sector organizations to review CISA Emergency Directive 21-01 - Supplemental Guidance v.3 for recommendations on operating the SolarWinds Orion Platform. Review the following resources for additional information on the SolarWinds Orion compromise.
Leave a comment ,

CISA Releases ICT Supply Chain Risk Management Task Force Year 2 Report

Agency News, Cyber Security CII sector, Industry News, Transport sector
The Cybersecurity and Infrastructure Security Agency (CISA) and government and industry members of the Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force released an annual report on its progress to advance meaningful partnerships and analysis around supply chain security and resilience.
The ICT SCRM Task Force Year 2 Report builds upon previous work completed in year one of the ICT SCRM Task Force. It showcases the collective ongoing efforts of four working within the Task Force to address challenges to information sharing, threat analysis, qualified bidder and qualified manufacturer lists, and vendor assurance. It also reflects a new working group, Working Group 5, which recently released an analysis report on the impacts of the COVID-19 pandemic on ICT supply chains.
Developed through the expertise and contributions of government and industry, the ICT SCRM Task Force Year 2 Report addresses the lifecycle of supply chain risk management, including how stakeholders identify and understand risk, communicate about and work together to address risk, grow their structural operations for addressing risks, and improve their understanding and self-assessment of their risk posture.
“Government can’t act in a silo,” said Bob Kolasky, CISA Assistant Director and ICT SCRM Task Force Co-Chair. “We must work in partnership with public and private industry. The Task Force has and will continue to serve as a model of excellence in helping to improve the Nation’s collective ability to assess and mitigate threats to the ICT supply chain.”
“As we were reminded this week, supply chain security is a matter of urgency and consequence, and the best way to increase our defenses is through substantial coordination and cooperation between government and industry,” said Robert Mayer, Senior Vice President of Cybersecurity and Innovation at USTelecom and ICT SCRM Task Force Co-Chair. “That is the mission of our task force. Through this partnership with DHS and more than a dozen agencies, the Information Technology and Communications sectors has tackled tough issues like information sharing, threat assessment, qualified bidders and manufacturer lists, and security issues presented by the pandemic. This is a partnership that will expand in 2021 and further strengthen the security and resiliency of our supply chain.”
“For the past two years, the Information Technology and Communications sectors have worked hand-in-glove with CISA and other federal government partners to establish the Task Force as the preeminent public-private partnership tackling the critical issue of global ICT supply chain security,” said John Miller, Senior Vice President of Policy and Senior Counsel at Information Technology Industry Council (ITI) and ICT SCRM Task Force Co-Chair. “The Year 2 Report represents a significant milestone, delivering actionable recommendations to help public and private sector organizations better assess and manage supply chain risks, including by creating tools to address supply chain threat information sharing, threat analysis, and vendor assurance and trust. The Task Force looks forward to working with our federal partners in 2021 and beyond to operationalize the policy recommendations in this report to better manage today’s all-too-real supply chain threats and to develop future work products that will address other dimensions of this important national security issue.”
The Task Force plans to release working group reports described in the Year 2 Report in the coming weeks. Members will continue to explore means for building partnerships with international partners, new sectors, and stakeholders who can help grow the applicability and utilization of Task Force products.
Leave a comment , , ,
1 … 37 38 39 40 41 … 54