The Cybersecurity and Infrastructure Security Agency Aug. 21 published guidance providing best practices for event logging to mitigate cyberthreats. The document was developed with the FBI, National Security Agency and multiple international cybersecurity agencies. The guide provides recommendations designed to improve organizational resilience in the current cyberthreat environment. 
 
"In the current cyberthreat environment, understanding your network and everything attached to it is critical," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Quality log data helps in building a comprehensive picture of your environment, drives detection and alerting systems to discover issues quickly, and helps incident responders understand what went wrong if you do suffer a cybersecurity incident. This document provides guidance on 'implement(ing) an event logging policy focused on capturing high-quality cyber security events to aid network defenders in correctly identifying cyber security incidents.' 
 
"Ideally, logs should be stored for a period of one year, subject to storage space constraints. In the middle of an incident is not the time to find out that you were not logging useful data, or that you were not retaining that data for long enough to thoroughly investigate the incident. Within the past year, Microsoft has added additional free log storage for several of their service tiers. The field is reminded that rural hospitals are eligible for free and heavily discounted Microsoft services.” 
 
For more information on this or other cyber and risk issues contact Gee at sgee@aha.org. For the latest threat information and other cyber and risk resources visit www.aha.org/cybersecurity.

Related News Articles

Headline
The House Energy and Commerce Oversight and Investigations Subcommittee April 1 discussed cybersecurity threats in legacy medical devices during a hearing. The…
Headline
The Trump Administration March 28 announced that it renewed for one year the public emergency for ongoing malicious cyber-enabled activities against the U.S.…
Headline
The FBI March 26 advised that, after extensive investigation and intelligence review, they have not identified any specific credible threat targeted against…
Headline
A ChatGPT vulnerability identified last year is being used by cyberthreat actors to attack security flaws in artificial intelligence systems, according to a…
Headline
The U.S. Attorney’s Office for the District of New Jersey March 13 announced charges for Rostislav Panev, a dual Russian and Israeli national, for his alleged…
Headline
A joint advisory released March 12 by the FBI, Cybersecurity and Infrastructure Security Agency, and the Multi-State Information Sharing and Analysis Center…