OIG contracted with Defense Point Security, a cybersecurity provider, to conduct network and web application penetration testing at four of the agency’s 11 operating divisions in fiscal year 2016. The goal of the audit was to determine whether the operating division networks were able to detect cyberattacks and whether HHS security controls were able to prevent cyberattacks.
“On the basis of the systems we tested, we determined that security controls across the four HHS [operating divisions] needed improvement to more effectively detect and prevent certain cyberattacks,” the report reads.
OIG provided a restricted report of the vulnerabilities to the four operating divisions. In written comments, HHS “in general concurred with all six of our observations in the draft report,” according to OIG. The four operating divisions told OIG the vulnerabilities were corrected or in the process of being corrected.
OIG noted the agency did not validate the operating divisions’ corrective actions.
To access the OIG report, click here.
More articles on cybersecurity:
9 HIPAA settlement fines in 2017
Almost half of health IT pros cite email as most likely source of data breach: 4 survey insights
Trend Micro: 6 cybersecurity predictions for 2018
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.