Medical Device Security CHIME Edition 2018
What Are the Greatest Challenges and How Can They be Overcome?

Safeguarding medical devices requires a joint effort from both provider organizations and device manufacturers. Yet regardless of their level of confidence, interviewed organizations are almost unanimous in citing manufacturer-related factors as a cause of their medical device security issues. A CISO explained, “I think there needs to be a coordinated effort between the manufacturers, the provider sites, and the regulators. I wish there were some other way for us to address this issue, but without that three-way partnership, I just don’t see how things will work out.”

There is a gap between how long organizations expect to be able to use a device and how long vendors feel they can keep a device up to date and secure. As a result, nearly all interviewed organizations have struggled with out-of-date operating systems or the inability to patch a device throughout its expected life cycle. Currently, many manufacturers do not allow customers to patch devices themselves (or void warranties if they do). Insufficient security controls, insufficient encryption, and hardcoded passwords are each cited as manufacturer-caused issues by about half of respondents. Adding to provider organizations’ frustration, on average, almost one-third of medical device vendors decline to offer contract provisions favorable to security. However, some manufacturers have been receptive to standardized security contract language proposed by forward-thinking provider organizations, a practice becoming more commonplace in the industry.

Aside from manufacturer-caused issues, there are also organizational factors that hinder better medical device security. In this research, organizations most often highlight poor asset/inventory visibility and ambiguous security ownership. Organizations may be at serious risk if they lack visibility into what devices are connected to their network or what information is being sent and received by those devices. Additionally, shared ownership of medical device security can create confusion, and organizations with shared ownership are less likely to report confidence in their security strategy’s ability to protect patient safety. As one CISO explained, “When everybody is in charge, nobody is in charge.” Difficulties in these two areas often stem from a lack of adequate resources—whether that be in the form of staff shortages, budget constraints, process issues, or inadequate technology.

Patching Strategies
Out of necessity, organizations are resourceful when it comes to patching. They actively reach out to vendors to find out when patches are available; sometimes they patch devices themselves, and sometimes they have the vendor do it for them. They have also begun requesting that vendors use contract language that clearly outlines patching responsibilities and timelines.

Third-Party Software and Services
Nearly 75% of respondents use or plan to use third-party software or services to improve medical device security. Network access control (NAC) is most often used to segment networks and approve/deny access. Cisco is used most widely, followed by ForeScout and Aruba. To reduce costs and clearly define ownership, other organizations outsource their clinical engineering. Traditional clinical engineering vendors Aramark, Sodexo, and TRIMEDX have begun to also be used for device security. Some respondents use vulnerability-scanning tools from Tenable and Qualys. Up-and-comers CloudPost and Zingbox are gaining traction, offering comprehensive security platforms that help with network discovery, anomalous-behavior detection, blacklisting, and microsegmentation.