HHS Urges Health Sector to Beef Up OT, IoMT Security

The security of medical devices has been getting most of the attention from regulators in recent years, but other devices that make up the medical internet of things and operational technology systems are also vulnerable to cyberattacks, federal authorities warned in a new advisory.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

Outdated software, inadequate cybersecurity measures and poor integration with IT infrastructures render OT, IoMT and other connected devices found in healthcare environments increasingly attractive targets for threat actors, the U.S. Department of Health and Human Services warned in a bulletin issued Wednesday.

“These devices play a crucial role in numerous vital operational activities, such as patient care, product manufacturing, facility management and data collection,” HHS said. “Threat actors may exploit critical vulnerabilities in OT and the IoMT to interfere with healthcare services, jeopardize patient information and threaten patient safety.”

The Food and Drug Administration, through the help of expanded authority granted by Congress in December 2022, has been raising the bar for medical device makers, but other connected OT systems – ranging from heating, ventilation and air conditioning systems and elevators – don’t fall under that same level of scrutiny. (see: Raising the Regulatory Bar on Medical Device Cybersecurity).

IoMT devices include a wide range of connected products such as infusion pumps and medical imaging systems, but also other devices such as wearable glucose monitors and implantable devices, including pacemakers.

The FDA in 2016 also issued cybersecurity guidance for post-market medical devices. But older legacy medical devices – including expensive gear like medical imaging systems that are frequently used for decades by many hospitals – often contain vulnerabilities and other issues that put are putting these products at risk of exploitation (see: Legacy Medical Devices: Critical Cyber Risk Considerations).

HHS pointed out that hackers can potentially compromise insecure network traffic to access data or exploit hardcoded or default passwords to gain access. Meanwhile, “the technological constraints of OT and IoMT devices hinder the adoption of robust security measures, including encryption, advanced communication protocols, and threat detection capabilities,” HHS said.

Further, OT and IoMT often operate within outdated environments, which include firmware, software or hardware that may receive “little to no support” from vendors, HHS said.

“This lack of support exacerbates the challenges associated with applying patches and addressing known vulnerabilities. Consequently, these vulnerabilities can be exploited to obtain unauthorized access to systems, potentially leading to the compromise of sensitive data or interruptions in operations.”

Cyberthreats to OT and IoMT range from data breaches, disruptions to critical operations, dangers to patient safety, unauthorized access to IoMT, and the potential alteration of sensitive patient data, HHS warns. “These vulnerabilities frequently stem from insufficient security protocols in these devices and systems, making them especially vulnerable to cyberattacks.”

Recent analysis by Health Information Sharing and Analysis Center found that 12 medical devices from five different manufacturers had vulnerabilities that were top targets of exploitation by malicious cyber actors, said Errol Weiss, chief security officer at Health-ISAC.

“What strikes me is that we now know that attackers are actively exploiting known vulnerabilities that also exist in medical devices – if anything that should raise the priority to patch these devices before they are compromised,” he said.

OT and IoMT also can be especially vulnerable to non-targeted attacks, other experts said.

“Although a targeted attack with the intent to do harm is certainly something we need to think about, I believe that a non-targeted compromise of a vulnerable device – such as we find in OT or medical IoT – is a far more likely scenario because it fits the attack profile – a certain malware or attack tool,” said Axel Wirth, chief security strategist at device security firm MedCrypt.

“So, an attacker may not be looking for a medical device, they may be looking for an unpatched Windows computer, which happens to be a medical device.”

But looking ahead, healthcare organizations also need to be concerned about OT and IoMT devices being targeted by ransomware and similar extortion attacks, he said.

“Compromise of infrastructure systems will inflict much more pain and therefore will increase the payout that can be demanded and the likelihood of getting paid,” he said.

“Over the past few years ransomware attackers have demonstrated their strategic thinking to grow their business. Further, as a highly regulated industry, the trend seems to be to wait for the regulator to impose and maintain the baseline of security,” he said. “However, attackers are evolving faster than regulations and therefore, waiting for the regulator may not be an advisable strategy.”

Taking Action

HHS recommends that healthcare organizations implement a “robust” cybersecurity and risk management strategy for their OT and IoMT that addresses all stages of the System Development Life Cycle.

That should include asset inventory and lifecycle management; implementing a threat-based risk identification and management approach for OT and IoMT; using network micro segmentation; restricting remote access to those devices; vetting third-party vendors that have access to the products; regularly updating software and firmware; and safeguarding wireless signals and data transfers according to the risk associated with the device.

“Securing OT and IoMT equipment across the HPH sector requires a proactive risk-management approach rooted in cybersecurity best practices,” HHS said.

Weiss said he’s glad to see this latest advisory from HHS because it helps raise awareness about the cybersecurity risks in healthcare systems.

Besides following the recommendations HHS provides in the advisory, he suggests healthcare entities also follow the Health Sector Coordinating Council’s, “Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,” which he said contains “practical, cost-effective cybersecurity practices to protect network connected medical devices” (see: Updated Best Practice Playbook for Healthcare Cyberthreats).