Are Medical Devices at Risk of Ransomware Attacks?

In May 2017, the first documented ransomware assault on
networked medical equipment happened. The worldwide ransomware
assault WannaCry compromised radiological and other instruments in
several hospitals during its height, after a software failure
caused by a cyberattack on its third-party vendor’s oncology cloud
service, cancer patients having radiation therapy at four
healthcare institutions had to reschedule appointments.

These examples show how cyberattacks and data breaches may have
a significant impact on the healthcare industry, heavily reliant on
connected medical equipment. PHI (patient health information)
captured and stored in these connected medical devices must be
secured. Because PHI is transferred over the cloud via server-based
systems, making it very susceptible to hackers.

Ransomware attacks on health care professionals have become more
common, sophisticated, and severe in recent years. Individual bad
actors have been supplanted as the main perpetrators by organized
criminal gangs, nation-states and military groups. Despite great
effort, law enforcement and government have been unable to stop the
escalating wave of attacks on hospital devices and other key
infrastructure. Medical device security^[1]
will be a key part of hospital cybersecurity as ransomware attacks
on healthcare organizations increase.

Medical Devices have Grown In Scale

The safety of external medical equipment, whether fixed,
implanted, or wearable, is critical to patients’ lives and
well-being. Life-saving medical devices include insulin pumps,
heart defibrillators, artificial cardiac pacemakers, and
ventilators, to name a few. Examples include artificial joints, MRI
and CT scanners, infusion pumps, clinic programming, and home
monitoring.

In a hospital or healthcare institution, security cameras, RFID
readers, point-of-sale systems, and guest access cards should all
be safeguarded from cyber attacks and security breaches. Medical
equipment frequently includes computer systems and networks.

In today’s world, medical equipment is linked to all other
connected devices in a hospital or medical care institution.
Built-in sensors in linked medical equipment collect data that may
be sent to other devices and the Internet. These gadgets and their
data make up the Internet of Medical Things (IoMT), which assists
in the diagnosis, monitoring, and delivery of medicine.

These ransomware attacks on medical devices demonstrate the
impact of cyberattacks and data breaches on the healthcare
business, which is highly reliant on linked medical equipment.
Patient Health Information recorded and stored in these linked
medical devices must be protected. PHI is sent via server-based
systems over the cloud, making it highly vulnerable to hackers.

The connected medical devices, which significantly improve
patient care and provide better patient outcomes, should be
maintained and upgraded to ensure patient safety from the design
stage to their use in healthcare organizations or at home.

IoT Ecosystem

The IoT ecosystem consists of medical device manufacturers,
providers, systems and software providers, system integrators,
connectivity providers, and end-users. More collaboration between
stakeholders to tackle the cybersecurity vulnerabilities and risks
of connected medical devices will help prevent cyber attacks.

Ransomware assaults on healthcare institution networks trigger
medical device outages that put patient lives at risk. You can’t
have safe and functional medical equipment if it’s unavailable due
to ransomware. There has been a significant shift in the Medtech
sector over the last decade to identify the rising cyber threat to
devices. Nation-states and organized crime syndicates are wreaking
havoc on medical equipment, jeopardizing their safety and efficacy
for healthcare providers.

In a Ponemon Institute poll, a quarter of healthcare delivery
businesses indicated they witnessed increased death rates after a
ransomware assault. Health systems are at a higher risk of having a
negative influence on patient care as linked medical devices become
more widely used. The latest issue for healthcare institutions and
the MedTech sector is maintaining the availability of medical
equipment in the face of escalating cyber threats that threaten
patient safety.

Medical devices need to be designed with security in mind to
resist even everyday, run-of-the-mill threats like ransomware.
Currently, there is no statutory requirement, premarket or
postmarket, that expressly compels device manufacturers to address
cybersecurity.

Security measures in the cloud

In the event of a data breach, the healthcare institution, not
the cloud services provider, is responsible. On the other hand,
Cloud providers must follow stringent security guidelines. FDA
Cybersecurity Guidelines, cloud security engineering best
practices, frequent security audits, disaster recovery scenarios,
and action based on a well-defined security and data-protection
incident management system are instances of this.

With medical devices or associated software, real-time
monitoring, cyber threat modeling and analysis, threat mitigation,
and remediation should all be achievable. Due to regular
recordkeeping and monitoring, every breach is detected as soon as
it occurs. Early detection of a breach helps determine the severity
of the breach and ensures that it is remedied.

Medical gadgets, which are frequently obsolete, are not always
upgradeable. Assaults on medical equipment with minimal support
might cause vital functions to be disrupted, putting lives at
danger. Medical device owners should contact the vendor or
manufacturer ahead of time if they have any maintenance or update
problems with their medical equipment.

The FDA has incorporated a requirement in its Medical Device
Safety Action Plan that compels medical device manufacturers to
embed security updates and patch capabilities into
network-connected devices from the outset, in response to the
rising danger.

It also outlines procedures for disclosing any faults in these
devices once being released to the general public. It’s becoming
increasingly critical for engineers to consider cybersecurity
considerations while assessing the danger of a medical device.
Anti-ransomware/cyberattack protection should be included in the
device’s specs. If you’re submitting one of these devices to the
FDA, expect them to ask many questions about how you’re dealing
with cybersecurity issues.

Conclusion

From the design stage to their usage in healthcare organizations
or at home, connected medical devices that significantly improve
patient care and improve patient outcomes must be properly
maintained and upgraded to guarantee patient safety against
ransomware outages.

Medical device makers, suppliers, systems and software
providers, system integrators, connection providers, and end-users
make up the IoT ecosystem. It will be easier to avoid cyber
assaults if all stakeholders work together to address the
cybersecurity vulnerabilities and hazards of connected medical
equipment.