While it’s no secret that the healthcare sector became a major target for ransomware attacks during the COVID-19 pandemic, former Cybersecurity and Infrastructure Security Agency (CISA) Director Chris Krebs is shedding new light on the tone of CISA’s efforts to bite back against health-sector threats.
Speaking during a Feb. 24 webinar organized by Checkpoint, Krebs said CISA took these threats “very, very seriously,” and undertook a security effort dubbed “Project Taken” – after the Liam Neeson movie – in response. That effort was aimed at letting threat actors know how seriously the agency regarded threats to the healthcare industry and COVID-19 data and came with a message: tread lightly.
“The key there once again was flexibility with agility and understanding from a threat modeling perspective and being constantly aware of shifting dynamics. And as COVID changed the way in the importance of healthcare facilities, we had to be able to rapidly shift,” Krebs said at the webinar.
“If they came after and disrupted our ability to respond to COVID, we would not take that kindly and we would come after them using our very particular set of skills,” Krebs said.
Krebs said the effort took a partnership between the government, the intelligence community (IC), law enforcement, and the healthcare industry. Overall, he called it just another example of threat modeling and said the effort could help lay the groundwork for threat modeling partnerships going forward.
“Looking forward, what we wanted to do was, again, build capabilities that allow us to work with the private sector to work with other aspects of government, and a more unified coordinated response,” Krebs said.
Such a response, he continued, would help guard against and respond to supply chain hacks like the SolarWinds Orion hack, which Krebs is working with SolarWinds to understand. He also pointed to the importance of simply knowing where similar enterprise software services fit into the cybersecurity puzzle.
“If the recent supply chain compromise teaches us anything, [it] is that there are a set of very critical systemically important enterprise software service and services that we don’t fully understand how they fit into the economy, and how they fit into enterprises at large,” Krebs said. “We need to understand where our systemically important companies are, how they fit into the systems we use every single day. We need to bring everyone together into meaningful operational partnerships.”
