TIM-6735: Cybersecurity Threats and Vulnerabilities in Healthcare

Ayala, L. (2016). Cybersecurity for hospitals and healthcare facilities: A guide to detection and prevention [eBook edition]. Apress.
NOTE* If it is your first time accessing O’Reilly, it may prompt you to choose an institution. If so, select "Not Listed? Click Here" from the Institution List and sign in for access using your NCU school email address.
Reading: Chapter 7
This chapter provides information on using cyber hygiene to prevent cyber-attacks and ensure compliance related to the authority to operate in a healthcare network environment.

National Institute of Standard and Technology. (n.d.). Computer security resource center.
The document (NIST SP 800-79-2) listed on the website reviews the possible decisions made by regulatory authorities that demonstrate the extent that an organization has completed all assessment activities leading to an authority to operate. Specifically, it includes Chapter 2, Preparation for Assessment and Authorization; Chapter 3, Taxonomy of Issuer Controls; Chapter 4, Issuer Controls Assessment & Authorization Decision Process; and Chapter 5, Assessment and Authorization Lifecycle is relevant to the assignment. The appendices contain helpful templates for plans and reporting. This document is a valuable tool to have as a reference.

U.S. Department of Health & Human Services. (n.d.). The security rule. HHS.
This web page provides background information on The Security Rule, which requires that all healthcare system providers ensure the confidentiality, integrity, and security of electronic protected health information (e-PHI) through the use of appropriate administrative, physical and technical measures.

National Institute of Standard and Technology. (n.d.). Computer security resource center.
The document (NIST SP 800-79-2) listed on the website reviews the possible decisions made by regulatory authorities that demonstrate the extent that an organization has completed all assessment activities leading to an authority to operate. Specifically, it includes Chapter 2, Preparation for Assessment and Authorization; Chapter 3, Taxonomy of Issuer Controls; Chapter 4, Issuer Controls Assessment & Authorization Decision Process; and Chapter 5, Assessment and Authorization Lifecycle is relevant to the assignment. The appendices contain helpful templates for plans and reporting. This document is a valuable tool to have as a reference.

U.S. Department of Health & Human Services. (n.d.). HITECH act enforcement interim final rule. HHS.
This web page details the four categories of violations that are covered under the act as a means of promoting the adoption and meaningful use of health information technology.

U.S. Department of Health & Human Services. (n.d.). HHS rules of behavior for the use of HHS information and IT resources policy. HHS.
This web page provides the policy that governs the acceptable use of HHS resources by healthcare providers. Specifically, the policy details the requirements for general users, privileged users, and system-specific users.

Zrahia, A. (2018). Threat intelligence sharing between cybersecurity vendors: Network, dyadic, and agent views. Journal of Cybersecurity, 1.
This article stresses the importance of sharing threat intelligence between vendors to limit the duplication of effort and allowing the knowledge gained by one organization to prevent attacks for other organizations.

Siegel, C.A., & Sweeney, M. (2020). Cyber strategy: Risk-driven security and resiliency. Auerbach Publications.
This e-book describes cybersecurity strategies using several of the industry-standard frameworks discussed in this class. Some of the topics detailed are cyber risks and controls, current and target statement assessments, and measuring cybersecurity plan performance. This e-book is a valuable tool to have as a reference, and specific chapters are valuable resources for the weekly assignments.