Lessons Learned from the CISA COVID Task Force & Healthcare Attacks

The session recounts how a CISA task force formed during the COVID-19 pandemic started with a list of more than a thousand companies and no set method for deciding which to protect first. The speakers describe adapting a wartime idea of focusing on the critical weak points in a chain. Entities were scored on product type, how scarce the product was, supply levels, and dependencies, such as the specialized lipids needed by nucleic acid vaccines. The scored list was sorted into tiers so a small cybersecurity team could concentrate on the most critical organizations.

The talk then turns to healthcare. Ransomware attacks on hospitals disrupted electronic records, communications, and the processing of test results, and the team's research linked these effects to excess deaths, with the steepest increases among adults aged 25 to 44. Outreach to small manufacturers and hospitals often met suspicion, and many of these organizations had no security staff or incident response plans. The team responded with free services and plain guidance aimed at smaller healthcare providers and related sectors.

The closing lessons focus on organization. Outside perspectives and nimble, cross-agency teams helped, crisis conditions made it possible to pilot new approaches, and breaking down silos between agencies such as the FBI took sustained effort. The speakers also argue that practitioners should describe security risk in terms of business impact so that leaders act on it.