509,846 active members
3,861 visitors online
Register for free
Login Register
WIBU-SYSTEMS Blog

Cybersecurity for Medical Device Endpoints

January 2018
25
Author: Wibu-Systems
Company: WIBU-SYSTEMS AG
Cybersecurity for Medical Device Endpoints

With the recent, highly publicized incidents of identity theft, ransomware and malware attacks directed at healthcare facilities, the medical device community is on high security alert. Cybersecurity exploits have resulted in the theft of patient data, intrusions to hospital IT networks, and malicious manipulation of medical devices and systems connected to these networks. The consequences of these attacks are potentially catastrophic: personal identity theft, disruption of critical hospital services, and an overall threat to patient privacy, care and safety. No one in the medical device community would argue that there is an urgent need to secure medical systems, devices and data.

Government organizations, like the FDA and National Institute for Standards and Technology (NIST), are now giving more attention to cybersecurity in the medical area as well.

The US FDA recently published recommendations for both manufacturers and regulators to address medical device cybersecurity. The document, Postmarket Management of Cybersecurity in Medical Devices: Guidance for Industry and Food and Drug Administration Staff, encourages manufacturers to address cybersecurity throughout the product lifecycle, including during the design, development, production, distribution, deployment and maintenance of the device.

Updated guidelines from NIST include specific updates regarding cybersecurity metrics and considerations about supply chain risk management and common terminology used to communicate with outside partners and vendors.

Industry organizations, including the Industrial Internet Consortium (IIC), are involved as well. Earlier in 2016, the IIC released its Industrial Internet Security Framework (IISF) document that identified endpoint vulnerabilities, many of which are prevalent in medical network environments, and ways to protect against them.

Security Considerations for Medical Device Endpoints
An endpoint device includes any computer-based device or system that is Internet-enabled and connected to an IP network. In the medical area, endpoints can be surgery robots, X-ray machines, MRI scanners, dental devices, infusion pumps, patient monitors or any other medical equipment with a computer chip and connection to the Internet. Security experts consider endpoints to be most vulnerable to hackers, particularly in the healthcare environment. Securing medical device endpoints involves many aspects:

  • physical security to prevent uncontrolled changes to or the removal of the endpoint
  • root of trust to provide confidence on the endpoint identity
  • integrity protection to ensure that the endpoint is in the configuration that enables it to perform its functions predictably
  • access control to ensure that proper identification, authentication and authorization protocols are performed
  • secure configuration and management to control updates of security policies and settings
  • monitoring and analysis for integrity checking, detecting malicious usage patterns or denial of service activities, and enforcing security policies and analytics
  • data protection to control data integrity, confidentiality and availability
  • security model and policy for governing the implementation of security functions

Integrity Protection
The term “Integrity Protection” encompasses security measures, namely protection of system resources, programs and data against unauthorized manipulation, or at least identification and display of such modifications. The challenge consists in guaranteeing data integrity, and, if not possible, bringing the system to a safe mode and stopping the execution of any function. The best integrity protection solutions are based on cryptography and associated security mechanisms, such as digital signatures and message authentication.

Secure Boot
Secure Boot functionality utilizes a digital certificate-based chain of trust to help prevent malicious software applications from loading during the system start-up process.

These are just a few examples of security measures that developers have available to ensure the proper use and performance of the medical device in a healthcare setting.

If you are planning to attend MD&M West February 6-8 in Anaheim, stop by Wibu-Systems booth #976 and we’ll tell you more about protecting medical device end points and security.

0 comments

Blog Archiv

November 2019
October 2019
September 2019
August 2019
July 2019
June 2019
May 2019
April 2019
March 2019
February 2019
January 2019
December 2018
November 2018
October 2018
September 2018
August 2018
July 2018
June 2018
May 2018
April 2018
March 2018
February 2018
January 2018
December 2017
November 2017
October 2017
September 2017
August 2017
July 2017
June 2017
May 2017
April 2017
March 2017
February 2017
January 2017
December 2016
October 2016
September 2016
July 2016
June 2016
May 2016
April 2016
March 2016
February 2016
January 2016