DEVICE SECURITY: WE’RE UNDER ATTACK!

Should Med Device Manufacturers Do More to Protect Us from Cyber Criminals?

Medical device manufacturers, users and clinicians take note, your medical devices are becoming increasingly exposed to the threat of cyber attack, is it time to review security systems and practices to keep hackers out? Alan Grau, president and co-founder of US-based Icon labs certainly thinks so. Granted his company provides security systems to the medical device world and other industries, and thus would profit from increased expenditure on cyber security, but he does raise some interesting and valid points about the vulnerability of medical devices to cyber attacks.

Grau references several recent events to back up his views, such as in 2013 when “manufacturers shipped out more than 300 devices to customers with hard-coded passwords” which could have allowed hackers to take control of the devices and render them defenceless against future attacks, or the US sponsored attacks on Iranian computer systems that used malware to crack encryption algorithms and harvest data.

Grau argues against relying on the concept of ‘security by obscurity’ to protect oneself from hackers. Cyber criminals will sooner than later become interested in exploiting weak points in medical devices to access data and for other nefarious purposes. The FDA has set out guidelines for manufacturers to ensure that high levels of security are observed, but of course these are not always followed.

Providing a high level of security is expensive and many healthcare facilities possess older equipment that is in need of security upgrades; and that doesn’t come cheap. For those cases, Grau counsels employing a bump-in-the-wire solution such as Icon Labs’ Floodgate defender, a complete embedded firewall, which prevents “hackers from even attempting to connect” to your systems or devices. We should all be concerned about how secure our devices and systems are, the debate has already begun, let us hope we can remain one step ahead of the cyber criminals.