Эксперт по кибербезопасности предложил метод «вычитательного упрочнения» для устранения путей атак в здравоохранении

Governance & Risk Management , Healthcare , Industry Specific How 'Subtractive' Security Erases Attack Paths Chris Frenz, Rectangle Health CISO, on Reducing Risk From Attackers in Healthcare Healthcare security teams can reduce cyber risk by removing attacker options before an incident occurs rather than relying primarily on detection and response, said Chris Frenz, CISO at Rectangle Health who developed a "subtractive-hardening" architecture standard for the Open Worldwide Application Security Project. See Also: How Data-Centric Security Enables the Agentic Enterprise Frenz's security approach prioritizes architectural deletion first, architectural constraint second, and detection and response third. This approach reduces attack paths without disrupting business or clinical operations, he said. For example, healthcare organizations should carefully study which technologies and functions employees use, who uses them, then remove unnecessary capabilities. If a capability remains essential, security teams should restrict who can use it and where. "Let's take something like SSH [Secure Shell]. It's commonly used by the network and server team to log into various resources to fix certain things within the IT environment. But there's no nurse or doctor that really ever has a legitimate need to launch SSH," Frenz said. "So, if you do a behavioral analytics study, you can easily determine that the IT team uses this utility, but no one else does in the environment," he said. "That gives you the ability to take away the functionality from all the non-IT desktops. It has no impact on business operations because the people who still need it have the access, but everyone else who doesn't need it doesn't, and that greatly reduces the attack graph within the organization," he said. "So, I think one of the mistakes a lot of CISOs make is that they won't take something away if somebody needs it," he said. Generally speaking, he said, security teams "focus heavily on detection and response, but we focus a lot less on controls that are architectural or preventative." Subtractive-hardening "takes a more reliability engineering type approach towards security architecture," he said. "If the outcome of an alert is an architectural change, then you're treating it like an engineering discipline." Frenz's OWASP Subtractive Hardening Top 10 also includes a path erasure rate, a metric designed to show how many attack paths an organization eliminates over time. Frenz said the goal is to reduce attacker optionality instead of simply adding more monitoring around an unchanged environment. Continuous threat exposure monitoring vendors and attack path management vendors do a great job of identifying attack paths in the environment, but "nobody ever asked the question: How can I eliminate these attack paths?" "I think that the path erasure rate metric in the OWASP project asks an important question, because it asks: 'What can I do to actually reduce attacker optionality? What architectural changes can I make to make less attack paths in the environment and how do I track this over time?'" he said. "For me, I think it changes the goal for security." In this video interview with ISMG, Frenz also discussed: - Tips for implementing a reductive security approach in healthcare environments; - How recurring security alerts can guide architectural root cause analysis and help security teams identify attack paths to remove; - Why unused protocols, administrative utilities and legacy functionality should be candidates for architectural deletion; - How segmentation and application constraints can limit ransomware lateral movement after a workstation or another device is compromised in a healthcare IT environment. Frenz, a longtime healthcare CISO, currently leads security at Rectangle Health, a healthcare technology firm. Besides developing the OWASP Subtractive Hardening Top 10 architecture, Frenz is also an expert in zero trust, micro segmentation, medical device security and evidence-based methods for measuring control efficacy.