MEDICAL DEVICES: SECURITY CHALLENGES for Hdos and MANUFACTURERS

W H I T E P A P E R MEDICAL DEVICES: SECURITY CHALLENGES FOR HDOs AND MANUFACTURERS RICH CURTISS | DIRECTOR, COALFIRE INTRODUCTION This paper aims to help organizations understand the issue of security in the context of medical devices. Medical devices have not historically been included in HIPAA compliance regulations or healthcare security and risk programs, yet their capabilities make them prime targets for exploitation. Increased connectivity of medical devices has exposed them to cyber attacks from which they not were designed to prevent. At stake are both patient safety and privacy plus healthcare delivery organizations’ (HDOs) network security. One objective for this paper is to get this issue on the radar of HDOs. We’ll also review the benefits of ‘security by design’ and the concept of embedding security into devices for medical device manufacturers as they seek market differentiation, rapid go-to-market capabilities, and security throughout the product life cycle. SAFE VS. SECURE In the age of the digitized enterprise, the security of electronic protected health information (ePHI) is paramount on every front and endpoint. HIPAA does not regulate medical devices, but it does impose requirements on covered entities and business associates for the safeguarding of ePHI that is created, received, maintained, or transmitted. For this reason, medical devices should be included in HDOs’ HIPAA security programs, and security should be embedded in every stage of a device manufacturer’s product development lifecycle. Beyond patient privacy, the lack of medical device security can be a patient safety issue if an attacker is able to compromise them. When medical devices become the weak link in the network, they can also become easy targets for attackers who want to use them to get access to hospital networks and launch attacks on other valuable assets. All stakeholders should work together – HDOs, device manufacturers, and regulators – to better align and coordinate implementation guidance to create a holistic cybersecurity ecosystem. In recent years, the Food & Drug Administration (FDA) has taken a leadership role in providing guidance to manufacturers on the cybersecurity of medical devices. NOT SCIENCE FICTION Safety can be compromised by poor security, as illustrated in dramatic fashion in 2012, when security researcher Barnaby Jack (his real name) was able to wirelessly reprogram an insulin pump to deliver a fatal dose. The same researcher also revealed the ability to remotely activate a pacemaker to deliver a fatal shock. This was a plot element on a popular TV show that led to widespread concern over the viability of the attack. More recently, there have been multiple demonstrations of hacking medical devices. In 2017, the FDA issued a recall of St. Jude pacemakers to patch security holes. An attack on medical devices has the potential to cause patient harm in several ways. For example, a malicious actor infiltrating an infusion pump could alter the drug parameters that could result in adverse impact on the patient. The WannaCry attack in 2017 impacted several medical devices across the world limiting organizations’ ability to treat their patients and impacting patient care and safety. Medical Devices: Security Challenges for Providers and Manufacturers | Whitepaper 2 Ransomware continued to be a threat to healthcare organizations as demonstrated by the resurgence of SamSam ransomware. These examples demonstrate that security is no longer a ‘nice-to-have’ feature, but a necessary and indispensable part of medical device design and implementation. Device manufacturers must plan for pre-market ‘security by design’ rather than security that is bolted on later in the product lifecycle. RISK REDUCTION EFFORTS Security risks to medical devices are being studied and evaluated by many entities from academic to governmental to industry. As healthcare is delivered outside the walls of a hospital with big data ramifications, more medical devices are connected to the network. Addressing the security challenges starts with understanding the root of the problem. SECURITY RESEARCH There are major efforts underway to discover the relevant issues with the security of medical devices. The Archimedes Project at Ann Arbor Research Center has been uncovering security issues since 2006. These problems range from data insecurity to safety concerns. Their research has provided valuable feedback to the industry and is influencing the security design of medical devices. In recent years, due to high visibility from ransomware attacks and coordinated efforts, more research and disclosures are happening. The number of security vulnerabilities published by ICS-CERT has increased exponentially since 2017. FDA GUIDANCE In the 1960s, a broad movement began with the intention to regulate medical devices and culminated in the Medical Devices Regulation Act of 1976. Among many provisions, this act authorized the FDA to regulate medical devices. For devices classified to pose the highest risk to human life, pre-market approval was required to provide reasonable assurance of their safety and effectiveness. The FDA issued a series of guidance documents regarding cybersecurity of medical devices. Their guidance for pre-market submissions published in 2014, and updated in late 2018, identifies issues manufacturers should consider in the design and development of medical devices to ensure they adequately address cybersecurity vulnerabilities. Pre-market clearance is relevant for devices that represent the highest risk to human life. This guidance particularly points out the value of documentation of risk analysis, including lifecycle recommendations. Later, the FDA followed up with detailed guidance about the use of wireless technology in medical devices, emphasizing the use of authentication and encryption. Although no attacks are known to have occurred in the real world, the exploitable vectors discovered by researchers are directly addressed in this guidance, which is likewise aimed at pre-market submissions. Medical Devices: Security Challenges for Providers and Manufacturers | Whitepaper 3 The FDA’s 2018 updates to the pre-market guidance for medical devices includes recommendations based on this evolving space, including sharing of cybersecurity bill of materials (CBOM). Meanwhile, they issued guidance in October 2017 clarifying that manufacturers should release information gathered by the devices directly to patients upon request, addressing a gap in HIPAA. The FDA's post-market cybersecurity guidance issued in December 2016 recommends that medical device manufacturers "address cybersecurity throughout the product lifecycle, including during the design, development, production, distribution, deployment and maintenance of the device". The guidance emphasizes that manufacturers should monitor, identify and address cybersecurity vulnerabilities and exploits as part of their post-market management of medical devices. For most cases, actions taken by manufacturers to address cybersecurity vulnerabilities and exploits are considered 'cybersecurity routine updates or patches,' for which the FDA does not require advance notification or reporting, the document notes. In October 2018, MITRE Corporation in collaboration with the FDA launched “The Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook”, which outlines a framework for HDOs to plan for and respond to medical device cybersecurity incidents. The College of Healthcare Information Management Executives (CHIME) suggests that manufacturers should be required to configure their devices with respect to an industry-accepted security standard – a standard that accounts for the basic principles of cybersecurity controls and alleviates risks. They also recommend that the guidance should grant manufacturers some level of 'safe harbor' protection against regulatory enforcement, provided that they achieve third-party certification, actively participate in a centralized Information Sharing and Analysis Organization (ISAO) and develop security patches in a timely manner. ISO AND AAMI GUIDANCE FOR MANUFACTURERS A detailed guide to risk management for the safety of medical devices is described in ISO 14971. It makes the central philosophical point: “All stakeholders need to understand that the use of a medical device entails some degree of risk.” Minimization of those inherent risks is the aim of the processes outlined. These include: • Detailed example questions that can illuminate intended use • Types of hazardous situations • Sample controls that can be applied to discovered risks Medical Devices: Security Challenges for Providers and Manufacturers | Whitepaper 4 AAMI subsequently released TIR57 in 2016, “Principles for medical device security – Risk management”. TIR57 blends security and safety risk management by showing how to apply the principles presented in ANSI/AAMI/ISO 14971, Medical devices – Application of risk management to medical devices, to security threats that could impact the confidentiality, integrity, and/or availability of a medical device or information processed by the device. It lists a six-step process for medical device security risk management: • Security risk analysis • Security risk evaluation • Security risk control • Evaluation of overall residual security risk acceptability • Security risk management report • Production and postproduction information HELP FROM THE INDUSTRY Manufacturers have responded by issuing Manufacturer Disclosure Statements for Medical

Load more