How to Manage Cyber Risk of Medical Devices

Even the smallest hospitals can have hundreds, if not thousands, of medical devices – while larger healthcare organizations have many, many more – often in the tens of thousands. And that could include scores of older devices and legacy products that are no longer supported by vendors.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

Meanwhile, newer devices – including those enabled with artificial intelligence and machine learning – are continuously entering healthcare IT environments. The rise of chronic diseases and demand for surgical procedures and diagnostic testing is fueling demand in the global medical device market, expected to grow from $542 billion last year to $886 billion by 2032.

Faced with this onslaught of smart, connected medical equipment, many healthcare providers are looking for device cybersecurity strategies and ways to help make these products more secure. Experts say it requires ongoing commitment to device security – something many providers haven’t yet done.

The Food and Drug Administration is now requiring medical device makers to detail a host of life cycle cybersecurity issues involving their products in their pre-market submission to the agency. And cyber experts also recommend providers take a robust, comprehensive life cycle approach to managing their medical device security risk.

Manufacturers’ life cycles are applicable to a device type, model or version, and the cycle spans from conception to design and from product release to end-of-life – driven by economic or technical factors, said Axel Wirth, chief security strategist at medical device security firm MedCrypt.

In contrast, he said, the healthcare delivery organization’s life cycle is focused on individual devices. It starts with replacement planning and procurement and “spans over installation and go-live, operation and maintenance, to end-of-use and decommissioning.”

For healthcare providers, each of these medical device life cycle phases should be accompanied by specific cybersecurity activities.

That includes cybersecurity assessments in purchasing contracts, detection of and response to cyber incidents during operation, regular patching and log review as part of maintenance activities, and removal of all sensitive information – such as patient data and network and user credentials – from the devices during decommissioning, he said.

But in reality, the complexity of a given hospital’s medical device ecosystem often conflicts with the institution’s available resources to address cyber issues. And that complexity is growing, said Shankar Somasundaram, CEO of device security firm Asimily.

“Fortunately, over the past few years, we have seen dedicated and network-based medical device security tools enter the market that help to improve visibility, to automate security activities and with the implementation of best practices,” he said.

“Individual clinical engineering departments are at differing stages of their security journey, but the same approach should be taken by everyone – recognize where you are, define where you should be and start on your journey today. And seek help where needed,” he said.

Available Resources

The Food and Drug Administration, the Health Sector Coordinating Council and several other industry groups in recent months – and over the years – have issued guidance and best practices to help healthcare delivery organizations better manage the security of connected medical devices in their environments, including legacy devices.

The HSCC’s “Health Industry Cybersecurity – Managing Legacy Technology Security” – or HIC-MaLTS – guidance offers organizations best practices that can be used to manage cyber risks of legacy medical technologies, said Phil Englert, vice president of medical device security at the Health Information Sharing and Analysis Center (see: Help Available for Tackling Legacy Medical Device Security).

HIC-MaLTS takes on common healthcare cybersecurity challenges. For example, “many different types of medical devices and the diverse locations in which they are used possess unique risk profiles and include diagnostic, therapeutic, wearable, implantable and software-as-a-medical device features, among others, that can be used in hospitals, clinics, and other non-clinical and home healthcare settings,” he said.

In addition to HIC-MaLT tacking legacy devices, the International Medical Device Regulators Forum’s IMDRF Principles and Practices for the Cybersecurity of Legacy Medical Devices also provides guidance related to four life cycle phases of medical devices, Englert said.

These are development, support, limited support and end of support, he said. “Healthcare delivery organizations increasingly perform security assessments during procurement but would benefit from re-evaluating the security posture at each life cycle phase.”

“These evaluations quantify the residual risks to inform security strategies. A not-to-exceed risk threshold can be established combined with not-to-exceed cost thresholds to drive maintenance operations decisions and inform strategic replacement plans,” he said.

Another good practice is performing “system-view” inventories combined with segmentation and network access controls, Englert said. “These practices provide healthcare delivery organizations with significantly improved resiliency and response capabilities across the medical equipment population.”

But with an enhanced cybersecurity focus by the FDA on newer medical devices entering the marketplace, healthcare delivery organizations have an opportunity to more carefully vet products earlier on – before they’re procured.

“Neglecting early planning and negotiating shared cyber resilience responsibilities in medical device procurement is the biggest missed chance to better manage cybersecurity risks,” Englert said.

HSCC’s Model Contract-Language for Medtech Cybersecurity – or MC2 – offers a reference point for shared cooperation and coordination between healthcare delivery organizations and medical device manufacturers regarding the security, compliance, management, operation, services and security of MDM-managed medical devices, solutions and connections, he said (see: Template Aims to Help Add Cyber in Medical Device Contracts).

This effort is all aimed at helping protect providers against cybersecurity threats and risks through the establishment and maintenance of appropriate security contract terms and commitments, Englert said.

Health-ISAC’s medical device security council is also developing a medical tech-specific responsibility assignment matrix to assist healthcare entities in mapping out security roles and duties, Englert said.

“Healthcare entities should demand better transparency for medical devices, including typical patch and update cycles, installation responsibilities, and lists of addressed issues and vulnerabilities to effectively manage residual risks and business impacts,” he said.

Healthcare delivery organizations need to be aware of the risks and threats that come with failing to address cybersecurity concerns associated with medical devices, the experts said.

“Security researchers have demonstrated that individual medical devices, be it implantable cardiac defibrillators, insulin pumps or imaging systems, can be maliciously manipulated and patients could be harmed,” Wirth said. “However, what we have seen in practice has more of an indirect impact on patients through delays of care due to a broader attack on a health system.”

“Medical devices have been caught up in ransomware attacks but not necessarily because they were targeted but rather because they fit the attack profile,” he said. “My biggest concern would be that future attacks could shift and target medical devices as cyber adversaries may recognize their criticality in the care process and may use such an attack to maximize impact and payout.”