Medical advancements have improved the quality of life for patients with chronic health problems and assist doctors in the continued monitoring of their patients. Medical devices use radio or network technology to transmit vital information to warn physicians of any changes to a patient’s condition. However, like other electronic devices, this technology is not immune to viral attacks or hacking.
To understand the challenge faced by modern healthcare providers, one expert in penetration testing for medical devices explains: “Most hospitals now have 10-15 networked medical devices per patient bed. Many of these devices are used to monitor vital functions and deliver medication. These medical devices have numerous vulnerabilities that can be exploited. It is simply a matter of time before we have a major attack on these devices with catastrophic and fatal consequences.” – Christian Espinosa, CEO, Alpine Security.
Theft of sensitive information or a ransomware attack could lead to loss of confidence towards institutions or medical devices – or even worse: it could be used to target a specific patient or group of patients.
Which devices have proven to be most vulnerable and how?
Pacemakers
The US Food and Drug Administration (FDA) recently recalled 500,000 pacemakers. The latest generation of pacemakers allows for remote monitoring of patients and is particularly vulnerable to hacking. Patient lives can be endangered if hackers cause the battery to completely drain or allow the pacemaker to accelerate at a dangerous speed for the heart. Dick Cheney, former US vice-president, had his pacemaker disabled due to these risks.
Heart Rate Monitors
Implantable Cardioverter Defibrillators (ICDs) are like pacemakers but offer the heart an electrical charge to shock it out of ventricle fibrillation. The ease with which these devices could be hacked was discovered at the University of Washington in 2008; even though the potential of an attack is lower than that of pacemakers. Potential hackers, according to the study, could attack the device wirelessly. The attacker could induce a bigger shock than needed, creating a dangerous, life threatening arrhythmia to the patient.
Drug Infusion Pumps
Drug infusion pumps are essential to delivering life saving medications to patients, including hormones, insulin, chemotherapy, and nutrients, allowing for even the smallest dose to be delivered with extreme accuracy, especially in acute critical care or intensive neonatal care and other areas. The pumps could be remotely accessed, and dosages changed. During 2017, eight manufacturers of vulnerable drug infusion pumps were identified in the US.
MRI Systems
It is still unclear how, but there is evidence of a cyber attack on 200,000 Windows systems in hospitals across the UK and US in May 2017. The attack affected at least one medical device, a Bayer Medrad radiology tool which injects a chemical agent to a patient ensuring improved medical imagery. MRI scans are used to detect injuries, strokes and tumors, especially of the brain or spine. This was the first attack on a medical device in the US and even though it did not threaten patient safety directly, the scanning machine stopped working allowing for reading mistakes and delays. Bayer immediately took steps to prevent the recurrence of such an attack.
Hospital Networks
The most serious type of attack would be to an entire hospital network and there have been numerous ones in the UK and US. These hospitals were completely unprepared and the attacks were due to security flaws in Microsoft operating systems. Hospital equipment and records are all tightly connected within the hospital network and an attack could be devastating.
Alpine Security Services
Rapid advancements in medical diagnosing and treatments have resulted in the swift development of devices but not enough thought was initially given to their cybersecurity.
Medical facilities and manufacturers need to be made aware of the risks and how to implement the correct security to prevent compromising sensitive information. Effective security measures need to be put into place from the outset. Alpine Security recommends that all parties involved work closely together.
Initially, Alpine Security advises a penetration test in order to reveal any weaknesses within a hospital network and medical devices. This includes wired and wireless medical devices. The penetration test recommends fix actions and prioritizes them. Alpine Security offers a full catalog of remote and onsite testing for inclusive cyber threat emulation . The results are accurate and offer huge returns on investment once the identified gaps are remediated.
Alpine Security recommends regular testing at all Healthcare Delivery Organizations in order to increase patient safety and reduced risks. Their team of experts has a combined experience of dozens of years in offering cybersecurity solutions to medical institutions and medical device manufacturers. They keep up to date with newer technologies in prevention and solutions for all types of cyber attacks and hacking.
