How to assess the security of hospital IoT
“We’ve seen infusion pumps infected with malware – while connected to patients,” says Joe Lea, vice president of product safety at Armis Security.
That sentence should give chills to hospital leaders of any stripe – whether security or IT staff, clinicians or patient safety officers.
More and medical devices and machines – from smartpumps to MRIs to implantable sensors – are linked up to the ever-expanding internet of things. And IoT’s connection to the web leaves those technologies vulnerable to attack, putting patients at risk and the bottom line of healthcare organizations under threat.
Lea and his colleague, Armis Security CMO Michael Parker, recently spoke with Healthcare IT News about about some of the ways IoT devices are left open to attack, and offered some advice on how health systems can help manage the threats.
An explosion of devices makes a network that more porous, from the inside and out, Lea says, noting that in an average hospital setting there is an average of ten devices per employee.
That could range from a crash cart laptop that a worker uses to check Facebook on a slow night to an ultrasound machine that never gets patched or updated despite running an out of the box Windows or Linux OS. He also points out a patient’s Google Home could become compromised as a surveillance device.
Parker stresses the importance of staying on top of every piece of equipment by keeping a close watch on their network traffic.
“We know what constitutes normal network behavior from massive dataset,” said Lea. We know what an infusion pump does, so based normal behavior if we see it connecting to unusual ports we can notify relevant people.”
Once under the sway of a malicious actor, there are a variety of ill gains for which a compromised IoT device can be exploited.
