Risk
9/30/2013
01:01 PM
50%
50%

Medical Device Security: A Work In Progress

Healthcare organizations vary widely in how prepared they are to handle breaches of medical devices, says Deloitte report.

Healthcare Robotics: Patently Incredible Inventions
Healthcare Robotics: Patently Incredible Inventions
(click image for larger view)
Healthcare organizations are in various stages of mitigating the cybersecurity risks of medical devices such as patient monitors, infusion pumps, ventilators, pacemakers and imaging devices, a new Deloitte report says. Overall, however, Deloitte's interviews with medical device security leaders at nine large hospital systems indicate that their organizations have a long way to go and that they'll need more cooperation from device manufacturers.

Last June, the Food and Drug Administration (FDA) released a guidance on the "content of premarket submissions for management of cybersecurity in medical devices." This guidance suggested that device makers incorporate security features into their products to limit access to only trusted users, determine trusted content, and use fail-safe and recovery devices. FDA called on the manufacturers to consider threats such as hacking, malware and other vulnerabilities of device software and to work with providers on use cases.

"The cybersecurity guidance has definitely gotten the attention of some of the manufacturers," said Russell Jones, a report author and a partner in Deloitte's life sciences and healthcare division, in an interview. "The FDA has made it clear, with the guidance and the additional communications they've published, that this is an area of importance."

However, he told InformationWeek Healthcare, many device makers are still not ready to include these security features in their purchasing agreements with healthcare providers. Although providers and manufacturers have begun collaborating on this issue, he said, they have a long way to go.

[ Are apps the answer to doctors' hectic schedules? Read Healthcare Apps Could Be Doctor's Best Friend. ]

Also, the Deloitte report noted, healthcare organizations have had difficulty in developing risk-mitigation strategies for devices that are more than five years old and run on proprietary operating systems. "These legacy devices are difficult to test for vulnerabilities because off-the-shelf security scanning tools do not exist," the paper said. In cases where hospitals lack spare devices of the same kind, these products can't even be taken offline for testing, Jones added.

Other devices that run on "well known commercial operating systems" have the same vulnerabilities as other types of systems connected to a network, the report said.

For both these and the legacy devices, the most extreme risk mitigation method is to quarantine the medical devices from the rest of the hospital IT system. But, partly because of the complexity of running multiple systems that aren't networked, Deloitte suggested that organizations do this only where it's appropriate.

"We recommend that organizations consider quarantining, and if it doesn't make sense, fall back to other types of controls, such as detection controls and sim systems," Jone said. "That may be the best you can do to see whether there has been activity that suggests hacking or unauthorized access to medical devices."

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anon2450048136
50%
50%
anon2450048136,
User Rank: Apprentice
1/12/2015 | 5:13:45 AM
re: medical device security
go and read here on schneier.com
MarciaNWC
100%
0%
MarciaNWC,
User Rank: Apprentice
11/17/2013 | 7:06:57 PM
re: medical device security
Even though the threat level is low right now, it's incumbent on medical device makers to step up on security, and for health care providers to require security in their purchasing agreements. It doesn't take long for attackers to exploit vulnerabilities.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.