Rural & Community Hospital
Cyber Defense Kit.

The US government will continuously scan your public-facing internet addresses and email you a weekly report of every exposed service and known vulnerability, the same view an attacker gets, in your inbox first. Healthcare is one of the nation's critical infrastructure sectors, so you qualify. Zero effort after enrollment.

1. Email vulnerability@cisa.dhs.gov with the subject line "Requesting Cyber Hygiene Services". Say you are a hospital or clinic (critical infrastructure, you qualify).
2. CISA replies with a service request form and acceptance letter. Fill them in and list your public IP addresses (your ISP can confirm the full range).
3. Scanning usually begins within about three business days; your first report arrives within roughly two weeks, then weekly.
4. Treat every "Critical" or "High" finding as a work order. Anything touching remote access, a VPN, a patient portal, or an imaging system gets fixed that day.

Contact: vulnerability@cisa.dhs.gov · details at cisa.gov/cyber-hygiene-services

This is how hospitals actually get breached. One afternoon of unglamorous work removes the attack paths behind most ransomware and account-takeover incidents.

1. Inventory every way in. List every method anyone uses to reach your systems from outside: VPN, RDP, TeamViewer/AnyDesk, clinic-to-hospital links, and especially remote support from your EHR, imaging, lab, and biomedical-device vendors. Ask each vendor directly: "How do you connect when we call you?"
2. Turn on MFA everywhere it exists, and make it phishing-resistant where you can: email, VPN, the EHR, remote desktop, cloud services, and your bank and payroll. Access to the EHR or to remote tools without MFA is the finding that ends careers.
3. Kill exposed remote access. Remove firewall port-forwards pointing at internal systems; uninstall any remote-access tool no one can explain; close standing vendor back doors and rebuild them as access-on-demand. Rebuild legitimate needs properly (identity-based access, Tier 3 / CIS 6).
4. Change every default and reused password into a password manager (per the VCRI Starter Kit). Enforce least privilege: no one keeps domain-admin or EHR-admin rights "just in case."

Tip: that inventory becomes the seed of your asset list (CIS 1) and your access-review (CIS 5).

Business email compromise runs on spoofed domains, and in healthcare it shows up as fraudulent vendor-payment changes and fake messages to patients and staff. SPF, DKIM, and DMARC let receiving mail servers reject email that forges your hospital's domain.

1. Publish an SPF record listing the servers allowed to send as your domain, and enable DKIM signing in your mail platform (Microsoft 365 / Google Workspace both document this).
2. Publish a DMARC record starting at p=none with reporting turned on, so you can see who sends as you before you enforce.
3. Read the reports with a free analyzer (for example URIports or dmarcian's free tier), fix any legitimate senders, then move to p=quarantine and finally p=reject.
4. Do the same for every lookalike or parked domain you own, so no one can register a near-match and spoof it.

Why it is urgent: a spoofable domain is the raw material for payment-fraud emails aimed at your finance team and your vendors.

Shodan is the search engine attackers use to find exposed systems. A one-time membership lets you put a standing watch on your own addresses: the day something of yours is exposed to the internet, you get an email. This matters acutely in healthcare, where exposed VPNs, patient portals, and especially unprotected medical imaging (DICOM/PACS) servers have been found open on the internet.

1. Create an account at shodan.io and buy the one-time membership (~$49; they run frequent $5 sales).
2. At monitor.shodan.io, add your public IP range and enable all alert types, including DICOM and database exposures.
3. Search Shodan for your hospital's name and town. Anything of yours already listed, especially an imaging or database service, goes to the top of today's list.

Contact: monitor.shodan.io · route alerts to two people, not one.

Hospitals that survive ransomware are the ones with tested, offline backups and a paper downtime plan. Veeam's free edition covers 10 machines, enough for the servers that matter at most small facilities.

1. Download Veeam Backup & Replication Community Edition from veeam.com and install it on a dedicated machine, not one you are backing up.
2. Back up, in priority order: domain controllers, the on-premises EHR database and application servers, imaging/PACS, pharmacy and lab systems, and file servers holding patient records.
3. Follow 3-2-1: three copies, two media, one offline. The offline copy can be USB drives rotated weekly, the off-rotation drive unplugged in a drawer or offsite. Ransomware cannot encrypt a disconnected drive.
4. Pair it with a paper downtime plan: how the floor runs when the EHR is gone. Put a monthly 30-minute test on the calendar: restore one file, boot one machine's backup, and log it. An untested backup is a hope, not a plan.

Note: confirm your EHR and imaging vendors' own backup and recovery commitments in writing; this covers what you run. Open-source alternatives: Duplicati, restic.

CISA scans you from outside; this scans from inside, where a phished laptop on a flat network does the damage.

1. Nessus Essentials (tenable.com) is free for up to 16 addresses, usually enough for your core IT segment. Install on an office PC or VM and scan monthly.
2. Greenbone / OpenVAS (greenbone.net) is free and open-source with no address limit, more setup effort, no cap.
3. Scan your office and server IT network only. Never actively scan the clinical or biomedical device segments, older medical devices can fault when probed. Visibility there comes passively, from the Tier 3 sensor.

Scope: systems you own and operate. Never actively scan a vendor-hosted EHR or imaging platform without written authorization.

You cannot patch many connected medical devices, so the controls are inventory, segmentation, and passive monitoring. A flat network where an infected billing PC can reach an infusion pump is the nightmare; segmentation makes it survivable.

1. Inventory every connected clinical device: imaging, infusion pumps, patient monitors, lab analyzers, anything with a network jack. The Tier 3 sensor discovers these passively; nmap and Fing can help on the IT side, but keep active scanning off the biomed segment.
2. Segment biomedical devices onto their own VLANs, isolated from the general and guest networks, with firewall rules allowing only the traffic the device actually needs.
3. Demand a software bill of materials (SBOM) and patch commitments from device manufacturers. The FDA's premarket and postmarket cybersecurity guidance sets the expectation that manufacturers support and disclose; use it as leverage at purchase and renewal. This is exactly the vendor-posture question BeaconScore (CIS 15) is built to document.
4. Subscribe to recalls and advisories so a known-vulnerable device becomes a work order, not a surprise.

Caution: passive discovery only on biomed segments. Never run an active scanner against devices in clinical use.

A vulnerability scanner tells you a service might be weak. These tools help answer the sharper question: is it actually exploitable from where an attacker stands? They turn a long list of "criticals" into the short list that truly matters, on the systems you own.

1. Nuclei (github.com/projectdiscovery/nuclei) runs a large, community-maintained library of templates that check for specific, known-exploitable conditions against your public addresses and web apps. Fast, scriptable, and it tells you which known issue is live, not just that a port is open.
2. OWASP ZAP (zaproxy.org) is a free web-application scanner (DAST). Point it at a web app you operate, a marketing site, or a patient-facing portal you host yourself, to find injection, authentication, and session flaws before someone else does.
3. Start with ZAP's passive scan and Nuclei's safe template sets; graduate to active checks only in a test window, with change management, and with monitoring watching.

Going further: the Metasploit Framework (CIS 18) validates exploitability hands-on; treat it as a tool for an authorized tester, internal or hired, never a routine scan and never near patient care.

The HIPAA Security Rule already requires you to run a security risk analysis. The question is which framework you run it against, and healthcare has free, sector-specific ones built for exactly this.

1. HHS 405(d) Health Industry Cybersecurity Practices (HICP) (405d.hhs.gov): a free, HHS-and-industry set of practical, right-sized cybersecurity practices, with a volume aimed specifically at small health organizations, mapped to the NIST Cybersecurity Framework. Start here.
2. HHS Healthcare and Public Health (HPH) Cybersecurity Performance Goals (hphcyber.hhs.gov): the government's prioritized "essential" and "enhanced" goals for the sector, a short, plain checklist of what to do first.
3. NIST CSF 2.0 and the CIS Controls (mapped below) are the concrete, tool-backed way to execute both, and satisfy the HIPAA risk-analysis expectation.
4. Want a board- and auditor-ready snapshot? The free BeaconScore self-assessment grades your whole operation, hands back a prioritized fix list, and produces a report you can take to leadership or keep on file if OCR asks. Re-run it to show progress over time.

Keep the artifact: your completed risk analysis against HICP or the HPH CPGs, plus the BeaconScore snapshot and your scan logs, is the evidence that you run a real program.

Two hours walking through "the EHR is encrypted and we are on paper", often the first time clinical leadership, IT, and administration talk through the same emergency. CISA and Health-ISAC both publish ready-made healthcare scenarios with facilitator scripts.

1. Download a CISA Tabletop Exercise Package from cisa.gov (a ransomware or business-email-compromise scenario), and ask Health-ISAC and your state hospital association about healthcare exercises.
2. Invite administration, the CMO or a nurse leader, whoever does IT, health information management, and your EHR/IT vendor. Walk the scenario and capture every "wait, who calls whom, and how do we run the floor?"
3. Write the one-page result: who declares an incident; who calls the FBI/IC3, HHS, your cyber insurer, and Health-ISAC; your downtime clinical procedures; and your HIPAA breach-notification path. Print it, the plan must survive the network being down.

During an incident: report@cisa.gov · 1-844-SAY-CISA · ic3.gov · plus Health-ISAC and your cyber insurer.

This is the "tripwire" function: file integrity monitoring plus host intrusion detection. An agent on each critical server watches the files, registry keys, and accounts that should almost never change, and alerts the moment they do, exactly how you catch an intruder who already has a foothold. Wazuh is the actively developed successor to OSSEC and adds log collection and alerting; OSSEC is the lighter original if you want minimal footprint.

1. Install the Wazuh server (wazuh.com) on a dedicated VM, then deploy the agent to your highest-value hosts: domain controllers, the on-premises EHR and database servers, imaging/PACS, pharmacy and lab systems, and any server holding patient records.
2. Turn on file integrity monitoring for the directories, binaries, and registry keys that should not change day to day, and enable the rules for new admin accounts, failed logins, service changes, and ransomware-like file activity.
3. Prefer OSSEC (ossec.net) if you want a lean, server-only HIDS/FIM; add AIDE (aide.github.io) on Linux hosts for simple, classic tripwire-style integrity checks. Deploy agents to servers and workstations, not to embedded medical devices.
4. Weekly ritual (30 min, calendared): review integrity alerts, new accounts, and authentication failures. Screenshot the dashboard into a running log, that trail is gold for auditors and any future incident.

Note: Wazuh also satisfies much of CIS 8 (audit log management) for the hosts it covers.

One quiet PC plugged into a mirror port on your core switch, running free, open-source software. It listens to a copy of your traffic, it cannot touch operations, and gives you intrusion detection, full network visibility, and an automatic asset inventory, including the medical devices you could not safely scan: the architecture commercial products charge five figures a year for.

 INTERNET ── FIREWALL ── CORE SWITCH ────────── clinic PCs, servers
                             │ ░ SPAN/mirror port (copy of traffic)
                             ▼
                       ┌───────────────┐
                       │  SENSOR BOX   │  NIC 1: sniffing (no IP address)
                       │  Security     │  NIC 2: management (dashboards)
                       │  Onion        │
                       └───────────────┘

Hardware (~$800-1,500): a small server or mini-PC with 8+ cores, 32 GB RAM (64 GB if budget allows), a 1-2 TB SSD, and at least two Ethernet ports. Refurbished business hardware works fine.

1. Configure a SPAN/mirror port on your core switch to copy all traffic, and cable it to the box's sniffing NIC (the sniffing NIC gets no IP address). A second mirror from the biomed switch gives you safe, passive visibility there.
2. Install Security Onion (securityonionsolutions.com), the free, open-source monitoring distribution. One install gives you Suricata (intrusion detection), Zeek (traffic analysis), full packet search, and dashboards, and it integrates Wazuh from the tier above.
3. Baseline week: let it run, then review the asset list with your IT lead and biomed. "What is that device?" is the whole point, and it doubles as your medical-device inventory.
4. Weekly review (30 min): top alerts, new devices, authentication failures, anything talking to somewhere it should not. Log it.